The Samba-Bugzilla – Attachment 18631 Details for
Bug 15844
getpwuid does not shift to new DC when current DC is down
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
Terminal output and three scenario winbind logs
dcissue_output.txt (text/plain), 3.66 MB, created by
Subba Ramanna Bodda (dead mail address)
on 2025-04-09 12:12:54 UTC
(
hide
)
Description:
Terminal output and three scenario winbind logs
Filename:
MIME Type:
Creator:
Subba Ramanna Bodda (dead mail address)
Created:
2025-04-09 12:12:54 UTC
Size:
3.66 MB
patch
obsolete
>Terminal Output for three scenarios as below: winbind and wb-<domain> logs follow at end >======================================================================================= > >Two node samba cluster which talks to adprotocolx.com and two DCs (they are DNS as well). >Each node has nameserver as both the DC IPs to search. nslookup would be round-robin or balanced. >windc1 and windc2 are DC names. >These DCs are old like 2016 etc. and not 2025. > >Scenario 1 >========== > >4.19.9 default code with no fixes. The node currently uses windc1. We will make that down. >Search for where wbinfo -P shifts to windc2. getpwuid (getent) will not shift to new DC. > >This is what we run in terminal. > >log.winbindd.scenario1 and log.wb-ADPROTOCOLX.scenario1 are the logs. >Child process invokes cm_open_connection in PingDc doing the rediscovery. >You can see that GetDcName (rediscovery) is never invoked by getwuid (getent). >Meanwhile DCINFO could be written with an info and it would always keep reading from cache same name as failed DC. > > ># date; while true; do sleep 5; echo "Clearing ids in cache"; for i in `net cache list | grep -E "IDMAP|SID2NAME|NAME2SID" | awk '{print $2}'`; do net cache del $i; done; echo ""; date; echo "Displaying net cache list"; net cache list; tdbdump /run/gpfs-samba/lock/gencache.tdb; echo "Pinging using wbinfo -P"; time wbinfo -P; echo "Issuing getent passwd"; time getent passwd 10001; echo ""; done >Wed Apr 9 06:57:52 EDT 2025 >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 06:57:57 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.023s >user 0m0.013s >sys 0m0.006s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.017s >user 0m0.002s >sys 0m0.001s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 06:58:03 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.023s >user 0m0.013s >sys 0m0.005s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.013s >user 0m0.002s >sys 0m0.000s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 06:58:08 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.026s >user 0m0.013s >sys 0m0.007s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.015s >user 0m0.001s >sys 0m0.001s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 06:58:14 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.024s >user 0m0.013s >sys 0m0.006s >Issuing getent passwd > >real 0m15.031s >user 0m0.001s >sys 0m0.003s > >Clearing ids in cache > >Wed Apr 9 06:58:34 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m26.804s >user 0m0.011s >sys 0m0.009s >Issuing getent passwd > >real 0m6.408s >user 0m0.004s >sys 0m0.000s > >Clearing ids in cache > >Wed Apr 9 06:59:13 EDT 2025 >Displaying net cache list >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 >Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:14:06 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:10:01 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:14:06 Value: windc2.adprotocolx.com >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00b_C#" >} >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "~V\F6g\00\00\00\00windc2.adprotocolx.com\00\D9\ED\0F\A8" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\89U\F6g\00\00\00\0010.28.1.93:0\00rU\EFd" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "~V\F6g\00\00\00\00windc2.adprotocolx.com\00\DF\D2\7Fn" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.023s >user 0m0.010s >sys 0m0.009s >Issuing getent passwd > >real 0m7.758s >user 0m0.003s >sys 0m0.002s > >Clearing ids in cache > >Wed Apr 9 06:59:25 EDT 2025 >Displaying net cache list >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 >Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:14:06 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: <binary length 119> (expired) >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:10:01 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:14:06 Value: windc2.adprotocolx.com >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00b_C#" >} >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "~V\F6g\00\00\00\00windc2.adprotocolx.com\00\D9\ED\0F\A8" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\89U\F6g\00\00\00\0010.28.1.93:0\00rU\EFd" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "~V\F6g\00\00\00\00windc2.adprotocolx.com\00\DF\D2\7Fn" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.025s >user 0m0.012s >sys 0m0.008s >Issuing getent passwd > >real 0m8.066s >user 0m0.001s >sys 0m0.003s > > >Scenario 2 >========== > >4.19.9 with fixes. > >Fixes as below. > > >diff --git a/source3/winbindd/wb_sids2xids.c b/source3/winbindd/wb_sids2xids.c >index f0f6c23fc20..58bff30e0d0 100644 >--- a/source3/winbindd/wb_sids2xids.c >+++ b/source3/winbindd/wb_sids2xids.c >@@ -608,7 +608,9 @@ static void wb_sids2xids_done(struct tevent_req *subreq) > return; > } > >- if (NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) && >+ if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) || >+ NT_STATUS_EQUAL(result, NT_STATUS_HOST_UNREACHABLE) || >+ NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) && > !state->tried_dclookup) { > > struct lsa_DomainInfo *d; >@@ -618,7 +620,7 @@ static void wb_sids2xids_done(struct tevent_req *subreq) > > subreq = wb_dsgetdcname_send( > state, state->ev, d->name.string, NULL, NULL, >- DS_RETURN_DNS_NAME); >+ DS_RETURN_DNS_NAME | DS_FORCE_REDISCOVERY); > if (tevent_req_nomem(subreq, req)) { > return; > } >diff --git a/source3/winbindd/wb_xids2sids.c b/source3/winbindd/wb_xids2sids.c >index 86bd7f9deab..4af4b7732d6 100644 >--- a/source3/winbindd/wb_xids2sids.c >+++ b/source3/winbindd/wb_xids2sids.c >@@ -140,12 +140,14 @@ static void wb_xids2sids_dom_done(struct tevent_req *subreq) > return; > } > >- if (NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) && >+ if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) || >+ NT_STATUS_EQUAL(result, NT_STATUS_HOST_UNREACHABLE) || >+ NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) && > !state->tried_dclookup) { > > subreq = wb_dsgetdcname_send( > state, state->ev, state->dom_map->name, NULL, NULL, >- DS_RETURN_DNS_NAME); >+ DS_RETURN_DNS_NAME | DS_FORCE_REDISCOVERY); > if (tevent_req_nomem(subreq, req)) { > return; > } > > > > >In terminal, we run as below again. >Logs are attached as log.winbindd.scenario2 and log.wb-ADPROTOCOLX.scenario2. >You can see in logs that getpwuid invokes GetDcName and gets shifted to new DC. > ># date; while true; do sleep 5; echo "Clearing ids in cache"; for i in `net cache list | grep -E "IDMAP|SID2NAME|NAME2SID" | awk '{print $2}'`; do net cache del $i; done; echo ""; date; echo "Displaying net cache list"; net cache list; tdbdump /run/gpfs-samba/lock/gencache.tdb; echo "Pinging using wbinfo -P"; time wbinfo -P; echo "Issuing getent passwd"; time getent passwd 10001; echo ""; done >Wed Apr 9 07:30:30 EDT 2025 >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:30:36 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.025s >user 0m0.012s >sys 0m0.008s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.030s >user 0m0.001s >sys 0m0.002s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:30:42 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.022s >user 0m0.009s >sys 0m0.009s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.014s >user 0m0.002s >sys 0m0.000s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:30:47 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.022s >user 0m0.012s >sys 0m0.006s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.013s >user 0m0.000s >sys 0m0.002s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:30:53 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.023s >user 0m0.010s >sys 0m0.009s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.020s >user 0m0.000s >sys 0m0.002s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:30:58 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.028s >user 0m0.012s >sys 0m0.008s >Issuing getent passwd > >real 0m13.029s >user 0m0.000s >sys 0m0.004s > >Clearing ids in cache > >Wed Apr 9 07:31:16 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m13.612s >user 0m0.013s >sys 0m0.008s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m8.170s >user 0m0.000s >sys 0m0.002s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:31:44 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:46:30 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:42:27 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:46:30 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\16^\F6g\00\00\00\00windc1.adprotocolx.com\00\91LT\05" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\00KD\B6\1B" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "#]\F6g\00\00\00\0010.28.1.92:0\00\A6\DF\FE\1D" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\16^\F6g\00\00\00\00windc1.adprotocolx.com\00\97s$\C3" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.022s >user 0m0.016s >sys 0m0.003s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.012s >user 0m0.000s >sys 0m0.002s > > >Scenario 3 >========== > >4.20.8 with fixes applied. >log.winbindd.scenario3 and log.wb-ADPROTOCOLX.scenario3 are the attached files. >getpwuid invokes GetDcName for rediscovery but that fails with NO_LOGON_SERVERS error, and keeps giving the same. > > ># date; while true; do sleep 5; echo "Clearing ids in cache"; for i in `net cache list | grep -E "IDMAP|SID2NAME|NAME2SID" | awk '{print $2}'`; do net cache del $i; done; echo ""; date; echo "Displaying net cache list"; net cache list; tdbdump /run/gpfs-samba/lock/gencache.tdb; echo "Pinging using wbinfo -P"; time wbinfo -P; echo "Issuing getent passwd"; time getent passwd 10001; echo ""; done >Wed Apr 9 07:45:38 EDT 2025 >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:45:44 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:57:07 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 (expired) >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:57:07 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B7f\1C\0E" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B1Yl\C8" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.025s >user 0m0.012s >sys 0m0.009s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.047s >user 0m0.001s >sys 0m0.002s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:45:50 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:57:07 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 (expired) >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:57:07 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B7f\1C\0E" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B1Yl\C8" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.025s >user 0m0.012s >sys 0m0.007s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.014s >user 0m0.000s >sys 0m0.002s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:45:55 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:57:07 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 (expired) >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:57:07 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B7f\1C\0E" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B1Yl\C8" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.025s >user 0m0.012s >sys 0m0.008s >Issuing getent passwd >ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false > >real 0m0.013s >user 0m0.001s >sys 0m0.001s > >Clearing ids in cache >Entry deleted. >Entry deleted. >Entry deleted. >Entry deleted. > >Wed Apr 9 07:46:01 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:57:07 Value: windc1.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 (expired) >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 (expired) >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:57:07 Value: windc1.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B7f\1C\0E" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B1Yl\C8" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded > >real 0m0.026s >user 0m0.014s >sys 0m0.006s >Issuing getent passwd > >real 1m5.380s >user 0m0.001s >sys 0m0.003s > >Clearing ids in cache > >Wed Apr 9 07:47:11 EDT 2025 >Displaying net cache list >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 08:02:11 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:58:06 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 08:02:11 Value: windc2.adprotocolx.com >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" >data(21) = "V^\F6g\00\00\00\00c0000001\00\0B\18\1B\C9" >} >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "\C3a\F6g\00\00\00\00windc2.adprotocolx.com\00\0F\ED\9C9" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com\00" >data(21) = "V^\F6g\00\00\00\00c0000001\00\17\14\ED{" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "\CE`\F6g\00\00\00\0010.28.1.93:0\00\EA\B5Y(" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "\C3a\F6g\00\00\00\00windc2.adprotocolx.com\00\09\D2\EC\FF" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "" failed >failed to call wbcPingDc: WBC_ERR_WINBIND_NOT_AVAILABLE > >real 1m4.732s >user 0m0.014s >sys 0m0.009s >Issuing getent passwd > >real 1m5.181s >user 0m0.002s >sys 0m0.004s > >Clearing ids in cache > >Wed Apr 9 07:49:26 EDT 2025 >Displaying net cache list >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 08:04:15 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com Timeout: 07:50:05 Value: c0000194 >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com Timeout: 07:50:05 Value: c0000194 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 08:00:10 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 08:04:15 Value: windc2.adprotocolx.com >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" >data(21) = "V^\F6g\00\00\00\00c0000001\00\0B\18\1B\C9" >} >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "?b\F6g\00\00\00\00windc2.adprotocolx.com\00\EC\F5G\C9" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com\00" >data(21) = "V^\F6g\00\00\00\00c0000001\00\17\14\ED{" >} >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com\00" >data(21) = "\ED^\F6g\00\00\00\00c0000194\00\C8\FA&\BE" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com\00" >data(21) = "\ED^\F6g\00\00\00\00c0000194\00\D4\F6\D0\0C" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "Ja\F6g\00\00\00\0010.28.1.93:0\00\B4\17tm" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "?b\F6g\00\00\00\00windc2.adprotocolx.com\00\EA\CA7\0F" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.026s >user 0m0.014s >sys 0m0.007s >Issuing getent passwd > >real 0m7.914s >user 0m0.000s >sys 0m0.004s > >Clearing ids in cache > >Wed Apr 9 07:49:39 EDT 2025 >Displaying net cache list >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com Timeout: 07:50:36 Value: c0000194 >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com Timeout: 07:50:36 Value: c0000194 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 08:00:10 Value: 10.28.1.93:0 >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" >data(21) = "V^\F6g\00\00\00\00c0000001\00\0B\18\1B\C9" >} >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com\00" >data(21) = "V^\F6g\00\00\00\00c0000001\00\17\14\ED{" >} >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com\00" >data(21) = "\0C_\F6g\00\00\00\00c0000194\00\FC<\81^" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com\00" >data(21) = "\0C_\F6g\00\00\00\00c0000194\00\E00w\EC" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "Ja\F6g\00\00\00\0010.28.1.93:0\00\B4\17tm" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.027s >user 0m0.012s >sys 0m0.007s >Issuing getent passwd > >real 0m7.088s >user 0m0.001s >sys 0m0.003s > >Clearing ids in cache > >Wed Apr 9 07:49:52 EDT 2025 >Displaying net cache list >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 08:04:46 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com Timeout: 07:50:36 Value: c0000194 >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com Timeout: 07:50:36 Value: c0000194 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 08:00:41 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 08:04:46 Value: windc2.adprotocolx.com >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" >data(21) = "V^\F6g\00\00\00\00c0000001\00\0B\18\1B\C9" >} >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "^b\F6g\00\00\00\00windc2.adprotocolx.com\00\9E94\CF" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com\00" >data(21) = "V^\F6g\00\00\00\00c0000001\00\17\14\ED{" >} >{ >key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com\00" >data(21) = "\0C_\F6g\00\00\00\00c0000194\00\FC<\81^" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com\00" >data(21) = "\0C_\F6g\00\00\00\00c0000194\00\E00w\EC" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "ia\F6g\00\00\00\0010.28.1.93:0\00\8F\B0\A2\81" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "^b\F6g\00\00\00\00windc2.adprotocolx.com\00\98\06D\09" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.025s >user 0m0.011s >sys 0m0.009s >Issuing getent passwd > > >real 0m22.120s >user 0m0.000s >sys 0m0.005s > >Clearing ids in cache > >Wed Apr 9 07:50:19 EDT 2025 >Displaying net cache list >Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) >Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com >Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 08:05:05 Value: windc2.adprotocolx.com >Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) >Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) >Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 >Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 >Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: <binary length 119> >Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 08:01:00 Value: 10.28.1.93:0 >Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 08:05:05 Value: windc2.adprotocolx.com >{ >key(19) = "DCINFO/ADPROTOCOLX\00" >data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" >} >{ >key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" >} >{ >key(14) = "NBT/WINDC1#20\00" >data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" >data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" >} >{ >key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" >data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" >} >{ >key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" >data(35) = "qb\F6g\00\00\00\00windc2.adprotocolx.com\00@\F90\97" >} >{ >key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" >data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" >} >{ >key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" >data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" >} >{ >key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" >} >{ >key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" >data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" >} >{ >key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" >data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" >} >{ >key(23) = "NBT/ADPROTOCOLX.COM#1C\00" >data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" >} >{ >key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" >data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" >} >{ >key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" >data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" >} >{ >key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" >data(25) = "|a\F6g\00\00\00\0010.28.1.93:0\00F%eG" >} >{ >key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" >data(35) = "qb\F6g\00\00\00\00windc2.adprotocolx.com\00F\C6@Q" >} >Pinging using wbinfo -P >checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded > >real 0m0.027s >user 0m0.013s >sys 0m0.009s >Issuing getent passwd > >real 0m7.446s >user 0m0.002s >sys 0m0.002s > > > >Logs name: log.winbindd.scenario1 >======================== >[2025/04/09 06:57:16.554986, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:57:16.555032, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2338102)]: ping >[2025/04/09 06:57:16.555079, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338102):PING]: delivered response to client >[2025/04/09 06:57:16.555194, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:57:16.573329, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:57:16.573402, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:16.573426, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338104)]: request interface version (version = 32) >[2025/04/09 06:57:16.573468, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338104):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:16.573558, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:16.573589, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338104)]: request interface version (version = 32) >[2025/04/09 06:57:16.573634, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338104):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:16.573725, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:57:16.573752, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2338104)]: request misc info >[2025/04/09 06:57:16.573806, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338104):INFO]: delivered response to client >[2025/04/09 06:57:16.573922, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:57:16.573947, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2338104)]: request netbios name >[2025/04/09 06:57:16.574016, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338104):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:57:16.574107, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:57:16.574135, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2338104)]: request domain name >[2025/04/09 06:57:16.574173, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338104):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:57:16.574278, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338104)] Handling async request: DOMAIN_INFO >[2025/04/09 06:57:16.574311, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2338104]: domain_info [ADPROTOCOLX] >[2025/04/09 06:57:16.574399, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338104):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:57:16.574461, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338104):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:57:16.574567, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338104)] Handling async request: PING_DC >[2025/04/09 06:57:16.574659, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:57:16.578164, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:57:16.578271, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338104):PING_DC]: NT_STATUS_OK >[2025/04/09 06:57:16.578348, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338104):PING_DC]: delivered response to client >[2025/04/09 06:57:16.578984, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:57:19.789222, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 06:57:19.789607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:57:19.789645, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 06:57:19.789671, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:57:19.789690, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 06:57:19.789715, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:57:30.993987, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:57:30.999533, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:30.999587, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338343)]: request interface version (version = 32) >[2025/04/09 06:57:30.999658, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338343):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:31.006234, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:57:31.006271, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2338343)]: ping >[2025/04/09 06:57:31.006319, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338343):PING]: delivered response to client >[2025/04/09 06:57:31.008580, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:57:31.032482, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:57:31.032607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:31.032634, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338365)]: request interface version (version = 32) >[2025/04/09 06:57:31.032700, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338365):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:31.032804, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:31.032830, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338365)]: request interface version (version = 32) >[2025/04/09 06:57:31.032869, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338365):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:31.032982, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:57:31.033011, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2338365)]: request misc info >[2025/04/09 06:57:31.033054, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338365):INFO]: delivered response to client >[2025/04/09 06:57:31.033148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:57:31.033179, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2338365)]: request netbios name >[2025/04/09 06:57:31.033222, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338365):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:57:31.033314, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:57:31.033339, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2338365)]: request domain name >[2025/04/09 06:57:31.033377, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338365):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:57:31.033494, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338365)] Handling async request: DOMAIN_INFO >[2025/04/09 06:57:31.033528, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2338365]: domain_info [ADPROTOCOLX] >[2025/04/09 06:57:31.033562, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338365):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:57:31.033616, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338365):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:57:31.033720, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338365)] Handling async request: PING_DC >[2025/04/09 06:57:31.033803, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:57:31.036454, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:57:31.036527, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338365):PING_DC]: NT_STATUS_OK >[2025/04/09 06:57:31.036583, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338365):PING_DC]: delivered response to client >[2025/04/09 06:57:31.038060, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:57:45.954060, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:57:45.955858, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:45.955900, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338645)]: request interface version (version = 32) >[2025/04/09 06:57:45.955978, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338645):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:45.956121, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:57:45.956147, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2338645)]: ping >[2025/04/09 06:57:45.956188, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338645):PING]: delivered response to client >[2025/04/09 06:57:45.958168, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:57:45.979206, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:57:45.979343, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:45.979370, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338649)]: request interface version (version = 32) >[2025/04/09 06:57:45.979429, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338649):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:45.980605, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:45.980687, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338649)]: request interface version (version = 32) >[2025/04/09 06:57:45.980744, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338649):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:45.981653, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:57:45.981699, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2338649)]: request misc info >[2025/04/09 06:57:45.981756, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338649):INFO]: delivered response to client >[2025/04/09 06:57:45.981861, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:57:45.981886, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2338649)]: request netbios name >[2025/04/09 06:57:45.981938, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338649):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:57:45.982067, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:57:45.982092, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2338649)]: request domain name >[2025/04/09 06:57:45.982132, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338649):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:57:45.982226, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338649)] Handling async request: DOMAIN_INFO >[2025/04/09 06:57:45.982253, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2338649]: domain_info [ADPROTOCOLX] >[2025/04/09 06:57:45.982283, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338649):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:57:45.982347, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338649):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:57:45.982447, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338649)] Handling async request: PING_DC >[2025/04/09 06:57:45.982504, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:57:46.002698, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:57:46.002784, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338649):PING_DC]: NT_STATUS_OK >[2025/04/09 06:57:46.002839, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338649):PING_DC]: delivered response to client >[2025/04/09 06:57:46.006128, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:57:49.791752, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 06:57:49.791975, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:57:49.792002, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 06:57:49.792035, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:57:49.792053, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 06:57:49.792077, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:57:58.084527, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:57:58.084675, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:58.084711, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338939)]: request interface version (version = 32) >[2025/04/09 06:57:58.084756, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338939):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:58.084866, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:58.084901, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338939)]: request interface version (version = 32) >[2025/04/09 06:57:58.084942, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338939):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:58.085079, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:57:58.085111, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2338939)]: request misc info >[2025/04/09 06:57:58.085153, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338939):INFO]: delivered response to client >[2025/04/09 06:57:58.085242, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:57:58.085266, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2338939)]: request netbios name >[2025/04/09 06:57:58.085304, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338939):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:57:58.085392, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:57:58.085415, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2338939)]: request domain name >[2025/04/09 06:57:58.085452, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338939):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:57:58.085543, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338939)] Handling async request: DOMAIN_INFO >[2025/04/09 06:57:58.085569, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2338939]: domain_info [ADPROTOCOLX] >[2025/04/09 06:57:58.085609, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338939):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:57:58.085660, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338939):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:57:58.085759, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338939)] Handling async request: PING_DC >[2025/04/09 06:57:58.085802, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:57:58.088284, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:57:58.088348, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338939):PING_DC]: NT_STATUS_OK >[2025/04/09 06:57:58.088392, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338939):PING_DC]: delivered response to client >[2025/04/09 06:57:58.089549, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:57:58.091915, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:57:58.092020, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:57:58.092049, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2338940)]: request interface version (version = 32) >[2025/04/09 06:57:58.092093, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2338940):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:57:58.092187, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2338940)] Handling async request: GETPWUID >[2025/04/09 06:57:58.092221, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2338940)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 06:57:58.092258, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 06:57:58.092362, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 06:57:58.092389, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:57:58.092435, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:57:58.094401, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 06:57:58.094493, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:57:58.094515, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 06:57:58.094536, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 06:57:58.094555, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:57:58.094596, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:57:58.098214, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 06:57:58.098318, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:57:58.098340, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:57:58.098363, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 06:57:58.098392, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 06:57:58.098457, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 06:57:58 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 06:57:58.098514, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 06:57:58 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 06:57:58.098565, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 06:57:58.098588, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:418(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:57:58.098626, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:57:58.098662, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:57:58.098709, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 06:57:58.098746, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 06:57:58.098776, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:57:58.098809, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 06:57:58.098832, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 06:57:58.098857, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 06:57:58.098888, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:775(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 06:57:58.098918, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:782(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:57:58.098938, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:57:58.098983, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:57:58.099009, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 06:57:58.099027, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 06:57:58.099077, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 06:57:58.099135, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 06:57:58.099174, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:57:58.099272, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 06:57:58.099297, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 06:57:58.099331, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 06:57:58.099416, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 06:57:58.099441, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 06:57:58.099471, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:57:58.103236, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 06:57:58.103278, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 06:57:58.103377, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 06:57:58.103397, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 06:57:58.103430, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:57:58.103531, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 06:57:58.103578, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:57:58.105953, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 06:57:58.106140, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:57:58.106245, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 06:57:58.106264, 5, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:57:58.106398, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 06:57:58.106435, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 06:57:58.106464, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2338940):GETPWUID]: NT_STATUS_OK >[2025/04/09 06:57:58.106509, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2338940):GETPWUID]: delivered response to client >[2025/04/09 06:57:58.106823, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:00.991440, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:00.991619, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:00.991648, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338960)]: request interface version (version = 32) >[2025/04/09 06:58:00.991710, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338960):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:00.999986, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:58:01.000021, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2338960)]: ping >[2025/04/09 06:58:01.000073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338960):PING]: delivered response to client >[2025/04/09 06:58:01.001263, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:01.022265, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:01.022402, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:01.022431, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338982)]: request interface version (version = 32) >[2025/04/09 06:58:01.022484, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338982):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:01.023163, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:01.023196, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2338982)]: request interface version (version = 32) >[2025/04/09 06:58:01.023255, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338982):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:01.026361, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:58:01.026394, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2338982)]: request misc info >[2025/04/09 06:58:01.026446, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338982):INFO]: delivered response to client >[2025/04/09 06:58:01.028028, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:58:01.028061, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2338982)]: request netbios name >[2025/04/09 06:58:01.028110, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338982):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:58:01.031030, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:58:01.031079, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2338982)]: request domain name >[2025/04/09 06:58:01.031139, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338982):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:58:01.031289, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338982)] Handling async request: DOMAIN_INFO >[2025/04/09 06:58:01.031318, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2338982]: domain_info [ADPROTOCOLX] >[2025/04/09 06:58:01.031365, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338982):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:58:01.031418, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338982):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:58:01.031520, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2338982)] Handling async request: PING_DC >[2025/04/09 06:58:01.031570, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:01.035083, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:01.035180, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2338982):PING_DC]: NT_STATUS_OK >[2025/04/09 06:58:01.035233, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2338982):PING_DC]: delivered response to client >[2025/04/09 06:58:01.038367, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:03.536097, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:03.536314, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:03.536341, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339048)]: request interface version (version = 32) >[2025/04/09 06:58:03.536395, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339048):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:03.536516, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:03.536541, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339048)]: request interface version (version = 32) >[2025/04/09 06:58:03.536580, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339048):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:03.536670, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:58:03.536694, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2339048)]: request misc info >[2025/04/09 06:58:03.536732, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339048):INFO]: delivered response to client >[2025/04/09 06:58:03.536821, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:58:03.536845, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2339048)]: request netbios name >[2025/04/09 06:58:03.536882, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339048):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:58:03.536998, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:58:03.537030, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2339048)]: request domain name >[2025/04/09 06:58:03.537073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339048):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:58:03.537176, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339048)] Handling async request: DOMAIN_INFO >[2025/04/09 06:58:03.537202, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2339048]: domain_info [ADPROTOCOLX] >[2025/04/09 06:58:03.537230, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339048):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:58:03.537280, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339048):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:58:03.537374, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339048)] Handling async request: PING_DC >[2025/04/09 06:58:03.537424, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:03.540577, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:03.540643, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339048):PING_DC]: NT_STATUS_OK >[2025/04/09 06:58:03.540687, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339048):PING_DC]: delivered response to client >[2025/04/09 06:58:03.541862, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:03.543733, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:03.543806, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:03.543831, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2339049)]: request interface version (version = 32) >[2025/04/09 06:58:03.543874, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2339049):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:03.544010, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2339049)] Handling async request: GETPWUID >[2025/04/09 06:58:03.544055, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2339049)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 06:58:03.544080, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 06:58:03.544148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 06:58:03.544176, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:58:03.544200, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:58:03.545108, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 06:58:03.545194, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:58:03.545216, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 06:58:03.545238, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 06:58:03.545269, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:58:03.545292, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:58:03.547495, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 06:58:03.547579, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:58:03.547600, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:58:03.547630, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 06:58:03.547651, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 06:58:03.547679, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 06:58:03 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 06:58:03.547743, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 06:58:03 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 06:58:03.547779, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 06:58:03.547799, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:418(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:03.547822, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:58:03.547847, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:03.547875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 06:58:03.547898, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 06:58:03.547921, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:03.547947, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 06:58:03.548016, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 06:58:03.548038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 06:58:03.548061, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:775(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 06:58:03.548092, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:782(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:03.548113, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:58:03.548132, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:58:03.548158, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 06:58:03.548177, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 06:58:03.548224, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 06:58:03.548263, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 06:58:03.548285, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:03.548377, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 06:58:03.548397, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 06:58:03.548416, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 06:58:03.548455, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 06:58:03.548480, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 06:58:03.548505, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:03.551596, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 06:58:03.551648, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 06:58:03.551744, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 06:58:03.551765, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 06:58:03.551786, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:03.551887, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 06:58:03.551926, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:03.553685, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 06:58:03.553841, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:03.553944, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 06:58:03.553998, 5, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:03.554112, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 06:58:03.554139, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 06:58:03.554166, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2339049):GETPWUID]: NT_STATUS_OK >[2025/04/09 06:58:03.554208, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2339049):GETPWUID]: delivered response to client >[2025/04/09 06:58:03.554495, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:09.012559, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:09.012798, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:09.012828, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339420)]: request interface version (version = 32) >[2025/04/09 06:58:09.012897, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339420):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:09.013017, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:09.013046, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339420)]: request interface version (version = 32) >[2025/04/09 06:58:09.013111, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339420):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:09.013382, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:58:09.013415, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2339420)]: request misc info >[2025/04/09 06:58:09.013471, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339420):INFO]: delivered response to client >[2025/04/09 06:58:09.013670, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:58:09.013697, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2339420)]: request netbios name >[2025/04/09 06:58:09.013748, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339420):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:58:09.013842, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:58:09.013867, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2339420)]: request domain name >[2025/04/09 06:58:09.013916, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339420):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:58:09.014029, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339420)] Handling async request: DOMAIN_INFO >[2025/04/09 06:58:09.014079, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2339420]: domain_info [ADPROTOCOLX] >[2025/04/09 06:58:09.014133, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339420):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:58:09.014191, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339420):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:58:09.014341, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339420)] Handling async request: PING_DC >[2025/04/09 06:58:09.014405, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:09.017721, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:09.017808, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339420):PING_DC]: NT_STATUS_OK >[2025/04/09 06:58:09.017864, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339420):PING_DC]: delivered response to client >[2025/04/09 06:58:09.017995, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:09.021610, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:09.021700, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:09.021726, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2339421)]: request interface version (version = 32) >[2025/04/09 06:58:09.021780, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2339421):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:09.021856, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2339421)] Handling async request: GETPWUID >[2025/04/09 06:58:09.021883, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2339421)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 06:58:09.021908, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 06:58:09.021972, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 06:58:09.022010, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:58:09.022045, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:58:09.022947, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 06:58:09.023059, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:58:09.023101, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 06:58:09.023124, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 06:58:09.023144, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:58:09.023169, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:58:09.027025, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 06:58:09.027151, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:58:09.027174, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:58:09.027198, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 06:58:09.027217, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 06:58:09.027257, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 06:58:09 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 06:58:09.027322, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 06:58:09 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 06:58:09.027361, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 06:58:09.027387, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:418(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:09.027413, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:58:09.027440, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:09.027469, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 06:58:09.027493, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 06:58:09.027516, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:09.027543, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 06:58:09.027565, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 06:58:09.027585, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 06:58:09.027606, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:775(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 06:58:09.027626, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:782(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:09.027647, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:58:09.027667, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 06:58:09.027689, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 06:58:09.027708, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 06:58:09.027742, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 06:58:09.027774, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 06:58:09.027794, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:09.027895, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 06:58:09.027917, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 06:58:09.027936, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 06:58:09.028000, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 06:58:09.028025, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 06:58:09.028054, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:09.031768, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 06:58:09.031818, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 06:58:09.031906, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 06:58:09.031931, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 06:58:09.031954, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:09.032116, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 06:58:09.032146, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:09.034075, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 06:58:09.034229, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:09.034344, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 06:58:09.034366, 5, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 06:58:09.034484, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 06:58:09.034513, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 06:58:09.034541, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2339421):GETPWUID]: NT_STATUS_OK >[2025/04/09 06:58:09.034595, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2339421):GETPWUID]: delivered response to client >[2025/04/09 06:58:09.034653, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:14.516451, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:14.516651, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:14.516690, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339448)]: request interface version (version = 32) >[2025/04/09 06:58:14.516750, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339448):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:14.516834, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:14.516859, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339448)]: request interface version (version = 32) >[2025/04/09 06:58:14.516904, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339448):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:14.516992, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:58:14.517033, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2339448)]: request misc info >[2025/04/09 06:58:14.517082, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339448):INFO]: delivered response to client >[2025/04/09 06:58:14.517196, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:58:14.517223, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2339448)]: request netbios name >[2025/04/09 06:58:14.517270, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339448):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:58:14.517341, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:58:14.517365, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2339448)]: request domain name >[2025/04/09 06:58:14.517408, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339448):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:58:14.517468, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339448)] Handling async request: DOMAIN_INFO >[2025/04/09 06:58:14.517493, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2339448]: domain_info [ADPROTOCOLX] >[2025/04/09 06:58:14.517526, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339448):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:58:14.517585, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339448):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:58:14.517655, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339448)] Handling async request: PING_DC >[2025/04/09 06:58:14.517705, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:14.520216, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:14.520291, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339448):PING_DC]: NT_STATUS_OK >[2025/04/09 06:58:14.520343, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339448):PING_DC]: delivered response to client >[2025/04/09 06:58:14.520478, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:14.523456, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:14.523527, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:14.523551, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2339449)]: request interface version (version = 32) >[2025/04/09 06:58:14.523597, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2339449):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:14.523868, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2339449)] Handling async request: GETPWUID >[2025/04/09 06:58:14.523897, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2339449)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 06:58:14.523937, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 06:58:14.524015, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 06:58:14.524042, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:58:14.524068, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:58:14.524847, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 06:58:14.524925, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:58:14.524946, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 06:58:14.524988, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 06:58:14.525010, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:58:14.525039, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:58:15.981039, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 06:58:15.981171, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:15.981215, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339480)]: request interface version (version = 32) >[2025/04/09 06:58:15.981275, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339480):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:15.984492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:58:15.984527, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2339480)]: ping >[2025/04/09 06:58:15.984582, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339480):PING]: delivered response to client >[2025/04/09 06:58:15.985438, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 06:58:16.011439, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 06:58:16.011527, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:16.011552, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339493)]: request interface version (version = 32) >[2025/04/09 06:58:16.011598, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339493):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:16.011692, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:16.011717, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339493)]: request interface version (version = 32) >[2025/04/09 06:58:16.011756, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339493):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:16.011856, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:58:16.011880, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2339493)]: request misc info >[2025/04/09 06:58:16.011920, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339493):INFO]: delivered response to client >[2025/04/09 06:58:16.012033, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:58:16.012062, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2339493)]: request netbios name >[2025/04/09 06:58:16.012113, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339493):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:58:16.012232, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:58:16.012256, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2339493)]: request domain name >[2025/04/09 06:58:16.012295, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339493):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:58:16.012387, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339493)] Handling async request: DOMAIN_INFO >[2025/04/09 06:58:16.012413, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2339493]: domain_info [ADPROTOCOLX] >[2025/04/09 06:58:16.012459, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339493):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:58:16.012505, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339493):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:58:16.012604, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339493)] Handling async request: PING_DC >[2025/04/09 06:58:16.012651, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:16.014801, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:16.014872, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339493):PING_DC]: NT_STATUS_OK >[2025/04/09 06:58:16.014920, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339493):PING_DC]: delivered response to client >[2025/04/09 06:58:16.016130, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 06:58:19.796048, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 06:58:19.796254, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:19.796290, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 06:58:19.796316, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:19.796335, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 06:58:19.796358, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:29.549058, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_IO_TIMEOUT >[2025/04/09 06:58:29.549184, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 06:58:29.549212, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 06:58:29.549245, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_IO_TIMEOUT >[2025/04/09 06:58:29.549284, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2339449):GETPWUID]: NT_STATUS_IO_TIMEOUT >[2025/04/09 06:58:29.549377, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_IO_TIMEOUT. >[2025/04/09 06:58:29.549424, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2339449):GETPWUID]: delivered response to client >[2025/04/09 06:58:29.549486, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 15.025583 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:58:14.523866] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:58:29.549449] [15.025583] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 06:58:14.523897] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 06:58:29.549244] [15.025347] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:256 [2025/04/09 06:58:14.523936] ../../source3/winbindd/wb_xids2sids.c:349 [2025/04/09 06:58:29.549176] [15.025240] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 06:58:14.524009] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 06:58:14.524009] [0.000000] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:58:14.524014] ../../source3/winbindd/wb_xids2sids.c:191 [2025/04/09 06:58:14.524985] [0.000971] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:58:14.524064] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:58:14.524924] [0.000860] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:58:14.524065] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:58:14.524922] [0.000857] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:58:14.524066] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:58:14.524921] [0.000855] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:58:14.524181] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:58:14.524843] [0.000662] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:58:14.524183] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:58:14.524842] [0.000659] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:58:14.524183] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:58:14.524840] [0.000657] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:58:14.524185] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:58:14.524188] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:58:14.524195] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:58:14.524836] [0.000641] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:58:14.524195] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:58:14.524240] [0.000045] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:14.524195] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:14.524238] [0.000043] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:58:14.524241] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:58:14.524835] [0.000594] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:58:14.524241] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:58:14.524833] [0.000592] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:58:14.524988] ../../source3/winbindd/wb_xids2sids.c:157 [2025/04/09 06:58:29.549175] [15.024187] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:58:14.525035] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:58:29.549173] [15.024138] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:58:14.525036] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:58:29.549164] [15.024128] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:58:14.525037] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:58:29.549148] [15.024111] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:58:14.525118] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:58:29.549044] [15.023926] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:58:14.525120] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:58:29.549030] [15.023910] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:58:14.525120] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:58:29.549022] [15.023902] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:58:14.525122] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:58:14.525125] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:58:14.525131] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:58:29.549010] [15.023879] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:58:14.525131] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:58:14.525168] [0.000037] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:14.525132] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:14.525166] [0.000034] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:58:14.525170] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:58:29.549008] [15.023838] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:58:14.525171] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:58:29.548993] [15.023822] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:58:29.549342] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:58:29.549423] [0.000081] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:29.549343] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:29.549361] [0.000018] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 06:58:29.551938, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:30.964107, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:30.964231, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:30.964257, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339766)]: request interface version (version = 32) >[2025/04/09 06:58:30.964319, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339766):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:30.964630, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:58:30.964658, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2339766)]: ping >[2025/04/09 06:58:30.964699, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339766):PING]: delivered response to client >[2025/04/09 06:58:30.966143, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:31.006176, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:31.006299, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:31.006335, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339778)]: request interface version (version = 32) >[2025/04/09 06:58:31.006390, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339778):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:31.008914, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:31.008971, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339778)]: request interface version (version = 32) >[2025/04/09 06:58:31.009024, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339778):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:31.009148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:58:31.009174, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2339778)]: request misc info >[2025/04/09 06:58:31.009214, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339778):INFO]: delivered response to client >[2025/04/09 06:58:31.009305, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:58:31.009335, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2339778)]: request netbios name >[2025/04/09 06:58:31.009378, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339778):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:58:31.009485, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:58:31.009517, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2339778)]: request domain name >[2025/04/09 06:58:31.009555, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339778):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:58:31.009645, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339778)] Handling async request: DOMAIN_INFO >[2025/04/09 06:58:31.009678, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2339778]: domain_info [ADPROTOCOLX] >[2025/04/09 06:58:31.009726, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339778):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:58:31.009769, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339778):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:58:31.009902, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339778)] Handling async request: PING_DC >[2025/04/09 06:58:31.010008, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:34.733173, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 06:58:34.733358, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:34.733386, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339863)]: request interface version (version = 32) >[2025/04/09 06:58:34.733444, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339863):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:34.733533, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:34.733586, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2339863)]: request interface version (version = 32) >[2025/04/09 06:58:34.733632, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339863):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:34.733692, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:58:34.733715, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2339863)]: request misc info >[2025/04/09 06:58:34.733758, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339863):INFO]: delivered response to client >[2025/04/09 06:58:34.733817, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:58:34.733839, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2339863)]: request netbios name >[2025/04/09 06:58:34.733892, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339863):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:58:34.733969, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:58:34.734006, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2339863)]: request domain name >[2025/04/09 06:58:34.734052, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339863):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:58:34.734135, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339863)] Handling async request: DOMAIN_INFO >[2025/04/09 06:58:34.734162, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2339863]: domain_info [ADPROTOCOLX] >[2025/04/09 06:58:34.734192, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339863):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:58:34.734256, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339863):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:58:34.734555, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2339863)] Handling async request: PING_DC >[2025/04/09 06:58:34.734623, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:49.799413, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 06:58:49.799519, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:49.799545, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 06:58:49.799568, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:49.799586, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 06:58:49.799608, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:56.018312, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) > winbind_client_activity[2339778:PING_DC]: client has closed connection - removing client >[2025/04/09 06:58:56.018409, 2, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) > final write to client failed: Broken pipe >[2025/04/09 06:58:56.018618, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) > wb_child_request_cleanup: keep orphaned subreq[0x56144d5bd960] >[2025/04/09 06:58:56.082322, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:56.082451, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:56.082479, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340362)]: request interface version (version = 32) >[2025/04/09 06:58:56.082525, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340362):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:56.082649, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:58:56.082674, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2340362)]: ping >[2025/04/09 06:58:56.082712, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340362):PING]: delivered response to client >[2025/04/09 06:58:56.083464, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:58:56.100438, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:58:56.100510, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:56.100535, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340364)]: request interface version (version = 32) >[2025/04/09 06:58:56.100577, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340364):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:56.100670, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:58:56.100694, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340364)]: request interface version (version = 32) >[2025/04/09 06:58:56.100732, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340364):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:58:56.100827, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:58:56.100861, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2340364)]: request misc info >[2025/04/09 06:58:56.100902, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340364):INFO]: delivered response to client >[2025/04/09 06:58:56.101012, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:58:56.101040, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2340364)]: request netbios name >[2025/04/09 06:58:56.101085, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340364):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:58:56.101175, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:58:56.101199, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2340364)]: request domain name >[2025/04/09 06:58:56.101237, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340364):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:58:56.101326, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2340364)] Handling async request: DOMAIN_INFO >[2025/04/09 06:58:56.101351, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2340364]: domain_info [ADPROTOCOLX] >[2025/04/09 06:58:56.101382, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2340364):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:58:56.101435, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340364):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:58:56.101531, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2340364)] Handling async request: PING_DC >[2025/04/09 06:58:56.101586, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:56.101649, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1673(fork_domain_child) > fork_domain_child called for domain 'ADPROTOCOLX' >[2025/04/09 06:58:56.103704, 10, pid=2340366, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1747(fork_domain_child) > Child process 2340366 >[2025/04/09 06:58:56.104246, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) > msg_ctdb_ref_destructor: refs=(nil) >[2025/04/09 06:58:56.104304, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) > msg_dgm_ref_destructor: refs=0x56144d5eb480 >[2025/04/09 06:58:56.104864, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) > messaging_dgm_ref: messaging_dgm_init returned Success >[2025/04/09 06:58:56.104927, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) > messaging_dgm_ref: unique = 7358286915525418268 >[2025/04/09 06:58:56.105060, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 06:58:56.105234, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 06:58:56.105404, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=12937543341900013315 >[2025/04/09 06:58:56.105569, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2340366 >[2025/04/09 06:58:56.105677, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 >[2025/04/09 06:58:56.105773, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=7358286915525418268 >[2025/04/09 06:58:56.105870, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) > vnn pid 2340366 = 1 >[2025/04/09 06:58:56.105904, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) > messaging_ctdb_ref: messaging_ctdb_init returned Success >[2025/04/09 06:58:56.105950, 5, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) > register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE >[2025/04/09 06:58:56.106071, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 06:58:56.106183, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 06:58:56.106269, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=13153174298078018425 >[2025/04/09 06:58:56.106418, 5, pid=2340366, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:157(make_pdb_method_name) > Attempting to find a passdb backend to match tdbsam (tdbsam) >[2025/04/09 06:58:56.106456, 5, pid=2340366, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:178(make_pdb_method_name) > Found pdb backend tdbsam >[2025/04/09 06:58:56.106585, 5, pid=2340366, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:190(make_pdb_method_name) > pdb backend tdbsam has a valid init >[2025/04/09 06:58:57.783467, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2329712 matches my id: 1:2329712, type=0x40b >[2025/04/09 06:58:57.783544, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2329718 >[2025/04/09 06:58:57.783584, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! >[2025/04/09 06:58:57.795803, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) > wb_child_request_orphaned: cleanup orphaned subreq[0x56144d5bd960] >[2025/04/09 06:59:01.505438, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2329712 matches my id: 1:2329712, type=0x40b >[2025/04/09 06:59:01.505519, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2329769 >[2025/04/09 06:59:01.505569, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! >[2025/04/09 06:59:01.515612, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:01.515708, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2339863):PING_DC]: NT_STATUS_OK >[2025/04/09 06:59:01.515782, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2339863):PING_DC]: delivered response to client >[2025/04/09 06:59:01.515846, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 26.781257 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:58:34.734552] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:01.515809] [26.781257] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 06:58:34.734591] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 06:59:01.515705] [26.781114] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 06:58:34.734595] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 06:59:01.515704] [26.781109] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 06:58:34.734597] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 06:59:01.515702] [26.781105] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:58:34.734619] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:01.515698] [26.781079] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:58:34.734673] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:01.515596] [26.780923] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:58:34.734675] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 06:59:01.515592] [26.780917] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 06:58:34.734676] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 06:59:01.515586] [26.780910] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:58:34.734689] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:01.515583] [26.780894] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:58:34.734691] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:58:34.734697] [0.000006] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:58:34.734705] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:01.515555] [26.780850] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:58:34.734706] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:58:34.734743] [0.000037] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:34.734706] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:34.734741] [0.000035] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:58:34.734745] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:01.515549] [26.780804] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:58:34.734750] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:01.515544] [26.780794] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:01.515753] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:01.515781] [0.000028] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:01.515754] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:01.515775] [0.000021] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 06:59:01.516572, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 06:59:01.521898, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 06:59:01.522133, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:01.522162, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2340452)]: request interface version (version = 32) >[2025/04/09 06:59:01.522230, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2340452):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:01.522310, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2340452)] Handling async request: GETPWUID >[2025/04/09 06:59:01.522349, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2340452)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 06:59:01.522382, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 06:59:01.522457, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 06:59:01.522493, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:59:01.522529, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:59:01.523789, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 06:59:01.523875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:59:01.523903, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 06:59:01.523926, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 06:59:01.523990, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:59:01.524029, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:59:06.347566, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2329712 matches my id: 1:2329712, type=0x40b >[2025/04/09 06:59:06.347633, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2340366 >[2025/04/09 06:59:06.347665, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! >[2025/04/09 06:59:06.351881, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:06.352037, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2340364):PING_DC]: NT_STATUS_OK >[2025/04/09 06:59:06.352123, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340364):PING_DC]: delivered response to client >[2025/04/09 06:59:06.352169, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 10.250622 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:58:56.101529] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:06.352151] [10.250622] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 06:58:56.101556] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 06:59:06.352012] [10.250456] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 06:58:56.101559] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 06:59:06.352010] [10.250451] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 06:58:56.101569] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 06:59:06.352008] [10.250439] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:58:56.101575] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:06.351993] [10.250418] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:58:56.101625] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:06.351871] [10.250246] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:58:56.101626] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 06:59:06.351869] [10.250243] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 06:58:56.101627] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 06:59:06.351867] [10.250240] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:58:56.101633] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:06.351861] [10.250228] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:58:56.101634] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:58:56.101647] [0.000013] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:58:56.107623] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:06.351838] [10.244215] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:58:56.107630] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:58:56.107689] [0.000059] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:56.107631] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:56.107686] [0.000055] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:58:56.107692] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:06.351837] [10.244145] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:58:56.107695] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:06.351825] [10.244130] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:06.352094] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:06.352122] [0.000028] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:06.352096] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:06.352115] [0.000019] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 06:59:06.352808, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:06.410009, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:59:06.410138, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:06.410163, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340460)]: request interface version (version = 32) >[2025/04/09 06:59:06.410216, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340460):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:06.410291, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:59:06.410313, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2340460)]: ping >[2025/04/09 06:59:06.410363, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340460):PING]: delivered response to client >[2025/04/09 06:59:06.410427, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:06.428317, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:59:06.428392, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:06.428417, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340462)]: request interface version (version = 32) >[2025/04/09 06:59:06.428458, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340462):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:06.428549, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:06.428573, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340462)]: request interface version (version = 32) >[2025/04/09 06:59:06.428612, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340462):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:06.428702, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:59:06.428725, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2340462)]: request misc info >[2025/04/09 06:59:06.428764, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340462):INFO]: delivered response to client >[2025/04/09 06:59:06.428853, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:59:06.428876, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2340462)]: request netbios name >[2025/04/09 06:59:06.428914, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340462):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:59:06.429031, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:59:06.429059, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2340462)]: request domain name >[2025/04/09 06:59:06.429099, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340462):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:59:06.429190, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2340462)] Handling async request: DOMAIN_INFO >[2025/04/09 06:59:06.429220, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2340462]: domain_info [ADPROTOCOLX] >[2025/04/09 06:59:06.429259, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2340462):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:59:06.429303, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340462):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:59:06.429398, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2340462)] Handling async request: PING_DC >[2025/04/09 06:59:06.429432, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:06.431729, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:06.431799, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2340462):PING_DC]: NT_STATUS_OK >[2025/04/09 06:59:06.431847, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340462):PING_DC]: delivered response to client >[2025/04/09 06:59:06.432431, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:07.924029, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:07.924182, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 06:59:07.924206, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:07.924251, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:07.924276, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2340452):GETPWUID]: NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:07.924325, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_HOST_UNREACHABLE. >[2025/04/09 06:59:07.924355, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2340452):GETPWUID]: delivered response to client >[2025/04/09 06:59:07.924398, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 6.402074 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:59:01.522308] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:07.924382] [6.402074] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 06:59:01.522348] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 06:59:07.924249] [6.401901] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:256 [2025/04/09 06:59:01.522381] ../../source3/winbindd/wb_xids2sids.c:349 [2025/04/09 06:59:07.924181] [6.401800] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 06:59:01.522450] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 06:59:01.522450] [0.000000] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:01.522456] ../../source3/winbindd/wb_xids2sids.c:191 [2025/04/09 06:59:01.523922] [0.001466] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:01.522520] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:01.523873] [0.001353] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:01.522523] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:01.523872] [0.001349] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:01.522526] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:01.523870] [0.001344] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:01.522648] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:01.523785] [0.001137] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:01.522651] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:01.523783] [0.001132] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:01.522652] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:01.523780] [0.001128] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:01.522654] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:01.522658] [0.000004] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:01.522665] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:01.523776] [0.001111] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:01.522667] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:01.522709] [0.000042] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:01.522668] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:01.522707] [0.000039] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:01.522711] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:01.523775] [0.001064] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:01.522712] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:01.523773] [0.001061] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:01.523925] ../../source3/winbindd/wb_xids2sids.c:157 [2025/04/09 06:59:07.924179] [6.400254] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:01.524025] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:07.924178] [6.400153] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:01.524027] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:07.924176] [6.400149] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:01.524028] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:07.924172] [6.400144] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:01.524110] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:07.924007] [6.399897] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:01.524111] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:07.924003] [6.399892] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:01.524112] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:07.923999] [6.399887] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:01.524114] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:01.524117] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:01.524123] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:07.923991] [6.399868] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:01.524124] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:01.524150] [0.000026] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:01.524125] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:01.524148] [0.000023] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:01.524152] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:07.923990] [6.399838] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:01.524153] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:07.923985] [6.399832] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:07.924303] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:07.924354] [0.000051] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:07.924305] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:07.924323] [0.000018] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 06:59:07.928164, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 06:59:13.093059, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:59:13.093261, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:13.093288, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340835)]: request interface version (version = 32) >[2025/04/09 06:59:13.093347, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340835):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:13.093471, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:13.093495, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340835)]: request interface version (version = 32) >[2025/04/09 06:59:13.093534, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340835):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:13.093629, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:59:13.093654, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2340835)]: request misc info >[2025/04/09 06:59:13.093698, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340835):INFO]: delivered response to client >[2025/04/09 06:59:13.093787, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:59:13.093811, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2340835)]: request netbios name >[2025/04/09 06:59:13.093849, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340835):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:59:13.093937, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:59:13.093985, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2340835)]: request domain name >[2025/04/09 06:59:13.094028, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340835):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:59:13.094196, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2340835)] Handling async request: DOMAIN_INFO >[2025/04/09 06:59:13.094225, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2340835]: domain_info [ADPROTOCOLX] >[2025/04/09 06:59:13.094254, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2340835):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:59:13.094305, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340835):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:59:13.094408, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2340835)] Handling async request: PING_DC >[2025/04/09 06:59:13.094459, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:13.097254, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:13.097339, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2340835):PING_DC]: NT_STATUS_OK >[2025/04/09 06:59:13.097388, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340835):PING_DC]: delivered response to client >[2025/04/09 06:59:13.098014, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:13.100518, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:59:13.100593, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:13.100618, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2340836)]: request interface version (version = 32) >[2025/04/09 06:59:13.100667, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2340836):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:13.100745, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2340836)] Handling async request: GETPWUID >[2025/04/09 06:59:13.100782, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2340836)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 06:59:13.100806, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 06:59:13.100852, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 06:59:13.100878, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:59:13.100911, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:59:13.102051, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 06:59:13.102148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:59:13.102170, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 06:59:13.102191, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 06:59:13.102209, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:59:13.102231, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:59:15.983501, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 06:59:15.983607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:15.983633, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340866)]: request interface version (version = 32) >[2025/04/09 06:59:15.983678, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340866):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:15.983782, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:59:15.983807, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2340866)]: ping >[2025/04/09 06:59:15.983852, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340866):PING]: delivered response to client >[2025/04/09 06:59:15.984908, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 06:59:16.004127, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 06:59:16.004255, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:16.004286, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340875)]: request interface version (version = 32) >[2025/04/09 06:59:16.004357, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340875):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:16.005023, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:16.005055, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2340875)]: request interface version (version = 32) >[2025/04/09 06:59:16.005099, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340875):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:16.005222, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:59:16.005248, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2340875)]: request misc info >[2025/04/09 06:59:16.005289, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340875):INFO]: delivered response to client >[2025/04/09 06:59:16.005382, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:59:16.005406, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2340875)]: request netbios name >[2025/04/09 06:59:16.005457, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340875):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:59:16.005577, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:59:16.005615, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2340875)]: request domain name >[2025/04/09 06:59:16.005660, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340875):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:59:16.005784, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2340875)] Handling async request: DOMAIN_INFO >[2025/04/09 06:59:16.005809, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2340875]: domain_info [ADPROTOCOLX] >[2025/04/09 06:59:16.005846, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2340875):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:59:16.005887, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340875):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:59:16.005980, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2340875)] Handling async request: PING_DC >[2025/04/09 06:59:16.006039, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:16.008201, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:16.008276, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2340875):PING_DC]: NT_STATUS_OK >[2025/04/09 06:59:16.008321, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2340875):PING_DC]: delivered response to client >[2025/04/09 06:59:16.008929, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 06:59:19.800165, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 06:59:19.800545, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:59:19.800574, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 06:59:19.800599, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:59:19.800618, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 06:59:19.800642, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:59:20.851861, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:20.851997, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 06:59:20.852026, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:20.852047, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:20.852077, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2340836):GETPWUID]: NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:20.852138, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_HOST_UNREACHABLE. >[2025/04/09 06:59:20.852169, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2340836):GETPWUID]: delivered response to client >[2025/04/09 06:59:20.852220, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 7.751447 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:59:13.100743] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:20.852190] [7.751447] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 06:59:13.100782] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 06:59:20.852046] [7.751264] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:256 [2025/04/09 06:59:13.100806] ../../source3/winbindd/wb_xids2sids.c:349 [2025/04/09 06:59:20.851996] [7.751190] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 06:59:13.100847] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 06:59:13.100848] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:13.100852] ../../source3/winbindd/wb_xids2sids.c:191 [2025/04/09 06:59:13.102188] [0.001336] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:13.100907] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:13.102147] [0.001240] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:13.100908] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:13.102146] [0.001238] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:13.100909] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:13.102144] [0.001235] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:13.101059] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:13.102047] [0.000988] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:13.101061] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:13.102046] [0.000985] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:13.101061] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:13.102044] [0.000983] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:13.101062] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:13.101065] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:13.101071] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:13.102040] [0.000969] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:13.101072] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:13.101107] [0.000035] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:13.101072] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:13.101105] [0.000033] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:13.101108] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:13.102040] [0.000932] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:13.101108] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:13.102037] [0.000929] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:13.102190] ../../source3/winbindd/wb_xids2sids.c:157 [2025/04/09 06:59:20.851994] [7.749804] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:13.102228] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:20.851993] [7.749765] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:13.102229] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:20.851991] [7.749762] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:13.102230] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:20.851987] [7.749757] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:13.102306] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:20.851849] [7.749543] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:13.102308] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:20.851846] [7.749538] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:13.102308] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:20.851843] [7.749535] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:13.102310] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:13.102312] [0.000002] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:13.102318] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:20.851831] [7.749513] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:13.102318] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:13.102343] [0.000025] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:13.102319] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:13.102341] [0.000022] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:13.102344] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:20.851824] [7.749480] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:13.102345] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:20.851819] [7.749474] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:20.852111] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:20.852168] [0.000057] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:20.852119] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:20.852136] [0.000017] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 06:59:20.856067, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:26.031326, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:59:26.031481, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:26.031511, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341152)]: request interface version (version = 32) >[2025/04/09 06:59:26.031587, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341152):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:26.031701, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:26.031727, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341152)]: request interface version (version = 32) >[2025/04/09 06:59:26.031768, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341152):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:26.031875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:59:26.031901, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2341152)]: request misc info >[2025/04/09 06:59:26.031943, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341152):INFO]: delivered response to client >[2025/04/09 06:59:26.032090, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:59:26.032120, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2341152)]: request netbios name >[2025/04/09 06:59:26.032163, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341152):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:59:26.032259, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:59:26.032284, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2341152)]: request domain name >[2025/04/09 06:59:26.032324, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341152):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:59:26.032442, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2341152)] Handling async request: DOMAIN_INFO >[2025/04/09 06:59:26.032470, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2341152]: domain_info [ADPROTOCOLX] >[2025/04/09 06:59:26.032514, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2341152):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:59:26.032581, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341152):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:59:26.032722, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2341152)] Handling async request: PING_DC >[2025/04/09 06:59:26.032776, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:26.035205, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:26.035275, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2341152):PING_DC]: NT_STATUS_OK >[2025/04/09 06:59:26.035327, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341152):PING_DC]: delivered response to client >[2025/04/09 06:59:26.036022, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:26.038503, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:59:26.038581, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:26.038608, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2341153)]: request interface version (version = 32) >[2025/04/09 06:59:26.038665, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2341153):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:26.038733, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2341153)] Handling async request: GETPWUID >[2025/04/09 06:59:26.038760, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2341153)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 06:59:26.038790, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 06:59:26.038839, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 06:59:26.038866, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:59:26.038891, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:59:26.039761, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 06:59:26.039849, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 06:59:26.039875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 06:59:26.039897, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 06:59:26.039918, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 06:59:26.039943, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 06:59:31.009818, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 06:59:31.009970, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:31.010011, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341184)]: request interface version (version = 32) >[2025/04/09 06:59:31.010066, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341184):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:31.012393, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:59:31.012481, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2341184)]: ping >[2025/04/09 06:59:31.012535, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341184):PING]: delivered response to client >[2025/04/09 06:59:31.015628, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 06:59:31.035554, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 06:59:31.035632, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:31.035665, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341197)]: request interface version (version = 32) >[2025/04/09 06:59:31.035714, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341197):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:31.038031, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:31.038070, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341197)]: request interface version (version = 32) >[2025/04/09 06:59:31.038116, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341197):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:31.038247, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:59:31.038272, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2341197)]: request misc info >[2025/04/09 06:59:31.038312, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341197):INFO]: delivered response to client >[2025/04/09 06:59:31.038404, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:59:31.038458, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2341197)]: request netbios name >[2025/04/09 06:59:31.038501, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341197):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:59:31.038605, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:59:31.038637, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2341197)]: request domain name >[2025/04/09 06:59:31.038678, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341197):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:59:31.042772, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2341197)] Handling async request: DOMAIN_INFO >[2025/04/09 06:59:31.042812, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2341197]: domain_info [ADPROTOCOLX] >[2025/04/09 06:59:31.042849, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2341197):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:59:31.042911, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341197):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:59:31.044056, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2341197)] Handling async request: PING_DC >[2025/04/09 06:59:31.044115, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:31.051077, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:31.051145, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2341197):PING_DC]: NT_STATUS_OK >[2025/04/09 06:59:31.051196, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341197):PING_DC]: delivered response to client >[2025/04/09 06:59:31.052713, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 06:59:34.099860, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:34.100025, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 06:59:34.100049, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:34.100075, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:34.100104, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2341153):GETPWUID]: NT_STATUS_HOST_UNREACHABLE >[2025/04/09 06:59:34.100161, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_HOST_UNREACHABLE. >[2025/04/09 06:59:34.100198, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2341153):GETPWUID]: delivered response to client >[2025/04/09 06:59:34.100234, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 8.061489 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:59:26.038731] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:34.100220] [8.061489] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 06:59:26.038759] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 06:59:34.100069] [8.061310] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:256 [2025/04/09 06:59:26.038790] ../../source3/winbindd/wb_xids2sids.c:349 [2025/04/09 06:59:34.100017] [8.061227] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 06:59:26.038833] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 06:59:26.038834] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:26.038838] ../../source3/winbindd/wb_xids2sids.c:191 [2025/04/09 06:59:26.039894] [0.001056] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:26.038887] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:26.039848] [0.000961] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:26.038888] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:26.039847] [0.000959] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:26.038890] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:26.039845] [0.000955] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:26.039017] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:26.039756] [0.000739] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:26.039019] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:26.039754] [0.000735] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:26.039019] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:26.039728] [0.000709] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:26.039020] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:26.039023] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:26.039030] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:26.039724] [0.000694] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:26.039030] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:26.039064] [0.000034] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:26.039031] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:26.039062] [0.000031] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:26.039065] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:26.039723] [0.000658] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:26.039065] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:26.039721] [0.000656] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:26.039897] ../../source3/winbindd/wb_xids2sids.c:157 [2025/04/09 06:59:34.100016] [8.060119] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:26.039939] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:34.100011] [8.060072] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:26.039940] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:34.100006] [8.060066] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:26.039941] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:34.099995] [8.060054] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:26.040102] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:34.099836] [8.059734] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:26.040104] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:34.099830] [8.059726] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:26.040104] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:34.099822] [8.059718] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:26.040105] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:26.040109] [0.000004] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:26.040114] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:34.099815] [8.059701] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:26.040115] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:26.040147] [0.000032] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:26.040116] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:26.040145] [0.000029] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:26.040149] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:34.099809] [8.059660] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:26.040150] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:34.099805] [8.059655] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:34.100143] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:34.100197] [0.000054] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:34.100145] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:34.100159] [0.000014] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 06:59:34.105376, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:49.375563, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:59:49.375729, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:49.375768, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341583)]: request interface version (version = 32) >[2025/04/09 06:59:49.375840, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341583):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:49.375928, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 06:59:49.375974, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2341583)]: ping >[2025/04/09 06:59:49.376038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341583):PING]: delivered response to client >[2025/04/09 06:59:49.376112, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:49.395122, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 06:59:49.395199, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:49.395225, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341585)]: request interface version (version = 32) >[2025/04/09 06:59:49.395268, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341585):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:49.395364, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 06:59:49.395388, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341585)]: request interface version (version = 32) >[2025/04/09 06:59:49.395427, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341585):INTERFACE_VERSION]: delivered response to client >[2025/04/09 06:59:49.395528, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 06:59:49.395552, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2341585)]: request misc info >[2025/04/09 06:59:49.395591, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341585):INFO]: delivered response to client >[2025/04/09 06:59:49.395682, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 06:59:49.395713, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2341585)]: request netbios name >[2025/04/09 06:59:49.395765, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341585):NETBIOS_NAME]: delivered response to client >[2025/04/09 06:59:49.395859, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 06:59:49.395882, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2341585)]: request domain name >[2025/04/09 06:59:49.395921, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341585):DOMAIN_NAME]: delivered response to client >[2025/04/09 06:59:49.396040, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2341585)] Handling async request: DOMAIN_INFO >[2025/04/09 06:59:49.396083, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2341585]: domain_info [ADPROTOCOLX] >[2025/04/09 06:59:49.396131, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2341585):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 06:59:49.396184, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341585):DOMAIN_INFO]: delivered response to client >[2025/04/09 06:59:49.396289, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2341585)] Handling async request: PING_DC >[2025/04/09 06:59:49.396356, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:49.399019, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:49.399109, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2341585):PING_DC]: NT_STATUS_OK >[2025/04/09 06:59:49.399161, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341585):PING_DC]: delivered response to client >[2025/04/09 06:59:49.399771, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 06:59:49.801286, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 06:59:49.801379, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:59:49.801409, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 06:59:49.801433, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:59:49.801451, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 06:59:49.801473, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:00:01.022014, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:00:01.022173, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:01.022209, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341832)]: request interface version (version = 32) >[2025/04/09 07:00:01.022271, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341832):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:01.026073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:00:01.026115, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2341832)]: ping >[2025/04/09 07:00:01.026163, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341832):PING]: delivered response to client >[2025/04/09 07:00:01.028985, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:00:01.048681, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:00:01.048786, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:01.048812, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341839)]: request interface version (version = 32) >[2025/04/09 07:00:01.048858, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341839):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:01.049029, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:01.049064, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2341839)]: request interface version (version = 32) >[2025/04/09 07:00:01.049106, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341839):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:01.049200, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:00:01.049225, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2341839)]: request misc info >[2025/04/09 07:00:01.049264, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341839):INFO]: delivered response to client >[2025/04/09 07:00:01.049357, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:00:01.049381, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2341839)]: request netbios name >[2025/04/09 07:00:01.049435, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341839):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:00:01.049541, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:00:01.049565, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2341839)]: request domain name >[2025/04/09 07:00:01.049604, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341839):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:00:01.049708, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2341839)] Handling async request: DOMAIN_INFO >[2025/04/09 07:00:01.049746, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2341839]: domain_info [ADPROTOCOLX] >[2025/04/09 07:00:01.049777, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2341839):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:00:01.049836, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341839):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:00:01.049950, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2341839)] Handling async request: PING_DC >[2025/04/09 07:00:01.050027, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:00:01.052661, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:00:01.052727, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2341839):PING_DC]: NT_STATUS_OK >[2025/04/09 07:00:01.052772, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2341839):PING_DC]: delivered response to client >[2025/04/09 07:00:01.054158, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:00:15.996604, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:00:15.997591, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:15.997641, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342286)]: request interface version (version = 32) >[2025/04/09 07:00:15.997694, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342286):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:15.997828, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:00:15.997861, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2342286)]: ping >[2025/04/09 07:00:15.997905, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342286):PING]: delivered response to client >[2025/04/09 07:00:16.009380, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:00:16.018818, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:00:16.018902, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:16.018929, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342296)]: request interface version (version = 32) >[2025/04/09 07:00:16.019017, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342296):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:16.019543, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:16.019573, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342296)]: request interface version (version = 32) >[2025/04/09 07:00:16.019619, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342296):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:16.019722, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:00:16.019748, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2342296)]: request misc info >[2025/04/09 07:00:16.019805, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342296):INFO]: delivered response to client >[2025/04/09 07:00:16.019947, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:00:16.019995, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2342296)]: request netbios name >[2025/04/09 07:00:16.020044, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342296):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:00:16.020143, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:00:16.020295, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2342296)]: request domain name >[2025/04/09 07:00:16.020349, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342296):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:00:16.020774, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2342296)] Handling async request: DOMAIN_INFO >[2025/04/09 07:00:16.020805, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2342296]: domain_info [ADPROTOCOLX] >[2025/04/09 07:00:16.020839, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2342296):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:00:16.020900, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342296):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:00:16.021027, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2342296)] Handling async request: PING_DC >[2025/04/09 07:00:16.021098, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:00:16.024499, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:00:16.024583, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2342296):PING_DC]: NT_STATUS_OK >[2025/04/09 07:00:16.024635, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342296):PING_DC]: delivered response to client >[2025/04/09 07:00:16.025825, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:00:19.805832, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:00:19.806070, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:00:19.806108, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:00:19.806134, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:00:19.806159, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:00:19.806191, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:00:30.984982, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:00:30.985180, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:30.985207, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342572)]: request interface version (version = 32) >[2025/04/09 07:00:30.985266, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342572):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:30.986492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:00:30.986523, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2342572)]: ping >[2025/04/09 07:00:30.986569, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342572):PING]: delivered response to client >[2025/04/09 07:00:30.991348, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:00:31.040540, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:00:31.041260, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:31.041299, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342592)]: request interface version (version = 32) >[2025/04/09 07:00:31.041346, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342592):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:31.041466, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:31.041495, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342592)]: request interface version (version = 32) >[2025/04/09 07:00:31.041535, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342592):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:31.041626, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:00:31.041658, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2342592)]: request misc info >[2025/04/09 07:00:31.041696, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342592):INFO]: delivered response to client >[2025/04/09 07:00:31.041791, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:00:31.041821, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2342592)]: request netbios name >[2025/04/09 07:00:31.041870, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342592):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:00:31.041976, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:00:31.042005, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2342592)]: request domain name >[2025/04/09 07:00:31.042044, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342592):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:00:31.042134, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2342592)] Handling async request: DOMAIN_INFO >[2025/04/09 07:00:31.042164, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2342592]: domain_info [ADPROTOCOLX] >[2025/04/09 07:00:31.042210, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2342592):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:00:31.042255, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342592):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:00:31.042354, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2342592)] Handling async request: PING_DC >[2025/04/09 07:00:31.042403, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:00:31.045506, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:00:31.045586, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2342592):PING_DC]: NT_STATUS_OK >[2025/04/09 07:00:31.045633, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342592):PING_DC]: delivered response to client >[2025/04/09 07:00:31.047367, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:00:45.999434, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:00:45.999632, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:45.999659, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342887)]: request interface version (version = 32) >[2025/04/09 07:00:45.999742, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342887):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:45.999864, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:00:45.999888, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2342887)]: ping >[2025/04/09 07:00:45.999926, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342887):PING]: delivered response to client >[2025/04/09 07:00:46.002060, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:00:46.018883, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:00:46.018988, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:46.019018, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342900)]: request interface version (version = 32) >[2025/04/09 07:00:46.019061, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342900):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:46.019154, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:00:46.019179, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2342900)]: request interface version (version = 32) >[2025/04/09 07:00:46.019217, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342900):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:00:46.019307, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:00:46.019330, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2342900)]: request misc info >[2025/04/09 07:00:46.019385, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342900):INFO]: delivered response to client >[2025/04/09 07:00:46.019483, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:00:46.019507, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2342900)]: request netbios name >[2025/04/09 07:00:46.019549, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342900):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:00:46.019643, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:00:46.019666, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2342900)]: request domain name >[2025/04/09 07:00:46.019716, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342900):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:00:46.019806, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2342900)] Handling async request: DOMAIN_INFO >[2025/04/09 07:00:46.019831, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2342900]: domain_info [ADPROTOCOLX] >[2025/04/09 07:00:46.019883, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2342900):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:00:46.019927, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342900):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:00:46.020036, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2342900)] Handling async request: PING_DC >[2025/04/09 07:00:46.020084, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:00:46.025844, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:00:46.025931, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2342900):PING_DC]: NT_STATUS_OK >[2025/04/09 07:00:46.025994, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2342900):PING_DC]: delivered response to client >[2025/04/09 07:00:46.027518, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:00:49.809792, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:00:49.809970, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:00:49.810010, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:00:49.810036, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:00:49.810055, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:00:49.810098, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:01:01.008376, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:01:01.008510, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:01.008549, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343188)]: request interface version (version = 32) >[2025/04/09 07:01:01.008614, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343188):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:01.011049, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:01:01.011082, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2343188)]: ping >[2025/04/09 07:01:01.011136, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343188):PING]: delivered response to client >[2025/04/09 07:01:01.016894, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:01:01.038880, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:01:01.039038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:01.039081, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343200)]: request interface version (version = 32) >[2025/04/09 07:01:01.039145, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343200):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:01.040095, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:01.040127, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343200)]: request interface version (version = 32) >[2025/04/09 07:01:01.040175, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343200):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:01.042940, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:01:01.043008, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2343200)]: request misc info >[2025/04/09 07:01:01.043072, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343200):INFO]: delivered response to client >[2025/04/09 07:01:01.043688, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:01:01.043715, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2343200)]: request netbios name >[2025/04/09 07:01:01.043757, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343200):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:01:01.043896, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:01:01.043921, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2343200)]: request domain name >[2025/04/09 07:01:01.043997, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343200):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:01:01.044110, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2343200)] Handling async request: DOMAIN_INFO >[2025/04/09 07:01:01.044137, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2343200]: domain_info [ADPROTOCOLX] >[2025/04/09 07:01:01.044178, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2343200):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:01:01.044233, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343200):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:01:01.044376, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2343200)] Handling async request: PING_DC >[2025/04/09 07:01:01.044444, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:01:01.049524, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:01:01.049598, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2343200):PING_DC]: NT_STATUS_OK >[2025/04/09 07:01:01.049648, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343200):PING_DC]: delivered response to client >[2025/04/09 07:01:01.052817, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:01:16.019160, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:01:16.020314, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:16.020348, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343581)]: request interface version (version = 32) >[2025/04/09 07:01:16.020412, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343581):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:16.020511, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:01:16.020535, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2343581)]: ping >[2025/04/09 07:01:16.020573, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343581):PING]: delivered response to client >[2025/04/09 07:01:16.021825, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:01:16.055665, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:01:16.055752, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:16.055776, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343593)]: request interface version (version = 32) >[2025/04/09 07:01:16.055822, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343593):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:16.056984, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:16.057016, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343593)]: request interface version (version = 32) >[2025/04/09 07:01:16.057072, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343593):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:16.057564, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:01:16.057591, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2343593)]: request misc info >[2025/04/09 07:01:16.057638, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343593):INFO]: delivered response to client >[2025/04/09 07:01:16.059743, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:01:16.059780, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2343593)]: request netbios name >[2025/04/09 07:01:16.059835, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343593):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:01:16.061442, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:01:16.061474, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2343593)]: request domain name >[2025/04/09 07:01:16.061522, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343593):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:01:16.064142, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2343593)] Handling async request: DOMAIN_INFO >[2025/04/09 07:01:16.064208, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2343593]: domain_info [ADPROTOCOLX] >[2025/04/09 07:01:16.064257, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2343593):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:01:16.064310, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343593):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:01:16.066370, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2343593)] Handling async request: PING_DC >[2025/04/09 07:01:16.066478, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:01:16.069055, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:01:16.069134, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2343593):PING_DC]: NT_STATUS_OK >[2025/04/09 07:01:16.069196, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343593):PING_DC]: delivered response to client >[2025/04/09 07:01:16.070506, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:01:19.812649, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:01:19.813050, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:01:19.813096, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:01:19.813143, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:01:19.813163, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:01:19.813185, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:01:31.027064, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:01:31.027243, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:31.027271, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343793)]: request interface version (version = 32) >[2025/04/09 07:01:31.027327, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343793):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:31.033580, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:01:31.033623, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2343793)]: ping >[2025/04/09 07:01:31.033671, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343793):PING]: delivered response to client >[2025/04/09 07:01:31.037187, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:01:31.060501, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:01:31.060600, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:31.060625, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343804)]: request interface version (version = 32) >[2025/04/09 07:01:31.060669, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343804):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:31.060768, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:31.060792, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2343804)]: request interface version (version = 32) >[2025/04/09 07:01:31.060835, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343804):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:31.060932, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:01:31.061003, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2343804)]: request misc info >[2025/04/09 07:01:31.061070, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343804):INFO]: delivered response to client >[2025/04/09 07:01:31.061165, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:01:31.061189, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2343804)]: request netbios name >[2025/04/09 07:01:31.061238, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343804):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:01:31.061326, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:01:31.061350, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2343804)]: request domain name >[2025/04/09 07:01:31.061387, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343804):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:01:31.061486, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2343804)] Handling async request: DOMAIN_INFO >[2025/04/09 07:01:31.061512, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2343804]: domain_info [ADPROTOCOLX] >[2025/04/09 07:01:31.061557, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2343804):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:01:31.061616, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343804):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:01:31.061727, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2343804)] Handling async request: PING_DC >[2025/04/09 07:01:31.061788, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:01:31.081269, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:01:31.081351, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2343804):PING_DC]: NT_STATUS_OK >[2025/04/09 07:01:31.081400, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2343804):PING_DC]: delivered response to client >[2025/04/09 07:01:31.082799, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:01:46.000431, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:01:46.000652, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:46.000694, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2344092)]: request interface version (version = 32) >[2025/04/09 07:01:46.000743, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344092):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:46.000861, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:01:46.000886, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2344092)]: ping >[2025/04/09 07:01:46.000932, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344092):PING]: delivered response to client >[2025/04/09 07:01:46.002072, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:01:46.021041, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:01:46.021886, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:46.021920, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2344098)]: request interface version (version = 32) >[2025/04/09 07:01:46.022021, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344098):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:46.022121, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:01:46.022146, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2344098)]: request interface version (version = 32) >[2025/04/09 07:01:46.022185, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344098):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:01:46.022274, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:01:46.022298, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2344098)]: request misc info >[2025/04/09 07:01:46.022336, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344098):INFO]: delivered response to client >[2025/04/09 07:01:46.022430, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:01:46.022453, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2344098)]: request netbios name >[2025/04/09 07:01:46.022498, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344098):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:01:46.022585, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:01:46.022608, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2344098)]: request domain name >[2025/04/09 07:01:46.022646, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344098):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:01:46.022770, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2344098)] Handling async request: DOMAIN_INFO >[2025/04/09 07:01:46.022796, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2344098]: domain_info [ADPROTOCOLX] >[2025/04/09 07:01:46.022826, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2344098):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:01:46.022878, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344098):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:01:46.022991, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2344098)] Handling async request: PING_DC >[2025/04/09 07:01:46.023044, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:01:46.025887, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:01:46.025986, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2344098):PING_DC]: NT_STATUS_OK >[2025/04/09 07:01:46.026038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344098):PING_DC]: delivered response to client >[2025/04/09 07:01:46.029272, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:01:49.817251, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:01:49.817439, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:01:49.817471, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:01:49.817494, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:01:49.817512, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:01:49.817542, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:02:00.993848, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:02:00.994076, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:00.994108, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2344382)]: request interface version (version = 32) >[2025/04/09 07:02:00.994178, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344382):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:00.994944, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:02:00.994988, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2344382)]: ping >[2025/04/09 07:02:00.995032, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344382):PING]: delivered response to client >[2025/04/09 07:02:00.996256, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:02:01.033511, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:02:01.033615, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:01.033640, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2344392)]: request interface version (version = 32) >[2025/04/09 07:02:01.033685, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344392):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:01.033942, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:01.034022, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2344392)]: request interface version (version = 32) >[2025/04/09 07:02:01.034072, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344392):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:01.034164, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:02:01.034187, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2344392)]: request misc info >[2025/04/09 07:02:01.034235, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344392):INFO]: delivered response to client >[2025/04/09 07:02:01.034340, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:02:01.034368, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2344392)]: request netbios name >[2025/04/09 07:02:01.034414, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344392):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:02:01.034511, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:02:01.034534, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2344392)]: request domain name >[2025/04/09 07:02:01.034571, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344392):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:02:01.034659, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2344392)] Handling async request: DOMAIN_INFO >[2025/04/09 07:02:01.034684, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2344392]: domain_info [ADPROTOCOLX] >[2025/04/09 07:02:01.034738, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2344392):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:02:01.034782, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344392):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:02:01.034875, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2344392)] Handling async request: PING_DC >[2025/04/09 07:02:01.034945, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:02:01.045531, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:02:01.045628, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2344392):PING_DC]: NT_STATUS_OK >[2025/04/09 07:02:01.045683, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2344392):PING_DC]: delivered response to client >[2025/04/09 07:02:01.047061, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:02:19.403105, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:02:19.403299, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:19.403344, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345131)]: request interface version (version = 32) >[2025/04/09 07:02:19.403411, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345131):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:19.403544, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:02:19.403570, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2345131)]: ping >[2025/04/09 07:02:19.403612, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345131):PING]: delivered response to client >[2025/04/09 07:02:19.404275, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:02:19.422169, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:02:19.422254, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:19.422279, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345133)]: request interface version (version = 32) >[2025/04/09 07:02:19.422327, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345133):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:19.422426, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:19.422455, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345133)]: request interface version (version = 32) >[2025/04/09 07:02:19.422492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345133):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:19.422589, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:02:19.422612, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2345133)]: request misc info >[2025/04/09 07:02:19.422662, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345133):INFO]: delivered response to client >[2025/04/09 07:02:19.422751, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:02:19.422775, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2345133)]: request netbios name >[2025/04/09 07:02:19.422813, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345133):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:02:19.422901, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:02:19.422924, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2345133)]: request domain name >[2025/04/09 07:02:19.422978, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345133):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:02:19.423074, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2345133)] Handling async request: DOMAIN_INFO >[2025/04/09 07:02:19.423100, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2345133]: domain_info [ADPROTOCOLX] >[2025/04/09 07:02:19.423143, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2345133):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:02:19.423195, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345133):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:02:19.423310, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2345133)] Handling async request: PING_DC >[2025/04/09 07:02:19.423362, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:02:19.426015, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:02:19.426096, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2345133):PING_DC]: NT_STATUS_OK >[2025/04/09 07:02:19.426145, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345133):PING_DC]: delivered response to client >[2025/04/09 07:02:19.426778, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:02:19.818313, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:02:19.818421, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:02:19.818445, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:02:19.818474, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:02:19.818492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:02:19.818514, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:02:31.012970, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:02:31.013132, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:31.013165, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345184)]: request interface version (version = 32) >[2025/04/09 07:02:31.013234, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345184):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:31.013342, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:02:31.013366, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2345184)]: ping >[2025/04/09 07:02:31.013411, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345184):PING]: delivered response to client >[2025/04/09 07:02:31.017261, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:02:31.047502, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:02:31.047620, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:31.047647, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345196)]: request interface version (version = 32) >[2025/04/09 07:02:31.047703, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345196):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:31.054113, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:31.054148, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345196)]: request interface version (version = 32) >[2025/04/09 07:02:31.054197, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345196):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:31.057071, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:02:31.057110, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2345196)]: request misc info >[2025/04/09 07:02:31.057161, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345196):INFO]: delivered response to client >[2025/04/09 07:02:31.058383, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:02:31.058437, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2345196)]: request netbios name >[2025/04/09 07:02:31.058487, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345196):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:02:31.058585, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:02:31.058609, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2345196)]: request domain name >[2025/04/09 07:02:31.058649, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345196):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:02:31.058742, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2345196)] Handling async request: DOMAIN_INFO >[2025/04/09 07:02:31.058775, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2345196]: domain_info [ADPROTOCOLX] >[2025/04/09 07:02:31.058825, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2345196):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:02:31.058871, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345196):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:02:31.059011, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2345196)] Handling async request: PING_DC >[2025/04/09 07:02:31.059105, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:02:31.061833, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:02:31.061922, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2345196):PING_DC]: NT_STATUS_OK >[2025/04/09 07:02:31.061990, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345196):PING_DC]: delivered response to client >[2025/04/09 07:02:31.064268, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:02:46.004485, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:02:46.009358, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:46.009392, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345498)]: request interface version (version = 32) >[2025/04/09 07:02:46.009448, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345498):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:46.009560, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:02:46.009585, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2345498)]: ping >[2025/04/09 07:02:46.009625, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345498):PING]: delivered response to client >[2025/04/09 07:02:46.010853, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:02:46.037081, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:02:46.037196, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:46.037232, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345509)]: request interface version (version = 32) >[2025/04/09 07:02:46.037280, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345509):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:46.039721, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:02:46.039757, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345509)]: request interface version (version = 32) >[2025/04/09 07:02:46.039807, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345509):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:02:46.040026, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:02:46.040056, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2345509)]: request misc info >[2025/04/09 07:02:46.040099, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345509):INFO]: delivered response to client >[2025/04/09 07:02:46.040203, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:02:46.040231, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2345509)]: request netbios name >[2025/04/09 07:02:46.040289, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345509):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:02:46.040707, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:02:46.040733, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2345509)]: request domain name >[2025/04/09 07:02:46.040773, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345509):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:02:46.040865, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2345509)] Handling async request: DOMAIN_INFO >[2025/04/09 07:02:46.040891, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2345509]: domain_info [ADPROTOCOLX] >[2025/04/09 07:02:46.040921, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2345509):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:02:46.041005, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345509):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:02:46.041111, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2345509)] Handling async request: PING_DC >[2025/04/09 07:02:46.041154, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:02:46.043486, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:02:46.043562, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2345509):PING_DC]: NT_STATUS_OK >[2025/04/09 07:02:46.043607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345509):PING_DC]: delivered response to client >[2025/04/09 07:02:46.044360, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:02:49.819160, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:02:49.819276, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:02:49.819310, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:02:49.819335, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:02:49.819353, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:02:49.819376, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:03:01.019135, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:03:01.019369, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:01.019405, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345797)]: request interface version (version = 32) >[2025/04/09 07:03:01.019462, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345797):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:01.019676, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:03:01.019703, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2345797)]: ping >[2025/04/09 07:03:01.019745, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345797):PING]: delivered response to client >[2025/04/09 07:03:01.020949, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:03:01.063597, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:03:01.063759, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:01.063799, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345810)]: request interface version (version = 32) >[2025/04/09 07:03:01.063845, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345810):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:01.064001, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:01.064031, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2345810)]: request interface version (version = 32) >[2025/04/09 07:03:01.064073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345810):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:01.064184, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:03:01.064209, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2345810)]: request misc info >[2025/04/09 07:03:01.064275, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345810):INFO]: delivered response to client >[2025/04/09 07:03:01.064399, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:03:01.064437, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2345810)]: request netbios name >[2025/04/09 07:03:01.064478, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345810):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:03:01.064595, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:03:01.064618, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2345810)]: request domain name >[2025/04/09 07:03:01.064656, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345810):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:03:01.064753, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2345810)] Handling async request: DOMAIN_INFO >[2025/04/09 07:03:01.064778, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2345810]: domain_info [ADPROTOCOLX] >[2025/04/09 07:03:01.064808, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2345810):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:03:01.064865, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345810):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:03:01.064991, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2345810)] Handling async request: PING_DC >[2025/04/09 07:03:01.065053, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:03:01.067566, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:03:01.067638, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2345810):PING_DC]: NT_STATUS_OK >[2025/04/09 07:03:01.067691, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2345810):PING_DC]: delivered response to client >[2025/04/09 07:03:01.070723, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:03:16.023170, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:03:16.023332, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:16.023359, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346115)]: request interface version (version = 32) >[2025/04/09 07:03:16.023420, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346115):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:16.025455, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:03:16.025488, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2346115)]: ping >[2025/04/09 07:03:16.025555, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346115):PING]: delivered response to client >[2025/04/09 07:03:16.027004, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:03:16.045299, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:03:16.045771, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:16.045836, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346125)]: request interface version (version = 32) >[2025/04/09 07:03:16.045901, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346125):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:16.047331, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:16.047376, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346125)]: request interface version (version = 32) >[2025/04/09 07:03:16.047433, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346125):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:16.047530, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:03:16.047555, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2346125)]: request misc info >[2025/04/09 07:03:16.047595, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346125):INFO]: delivered response to client >[2025/04/09 07:03:16.047688, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:03:16.047713, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2346125)]: request netbios name >[2025/04/09 07:03:16.047764, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346125):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:03:16.047858, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:03:16.047882, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2346125)]: request domain name >[2025/04/09 07:03:16.047928, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346125):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:03:16.048036, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2346125)] Handling async request: DOMAIN_INFO >[2025/04/09 07:03:16.048075, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2346125]: domain_info [ADPROTOCOLX] >[2025/04/09 07:03:16.048126, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2346125):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:03:16.048172, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346125):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:03:16.048305, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2346125)] Handling async request: PING_DC >[2025/04/09 07:03:16.048345, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:03:16.050857, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:03:16.050936, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2346125):PING_DC]: NT_STATUS_OK >[2025/04/09 07:03:16.051013, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346125):PING_DC]: delivered response to client >[2025/04/09 07:03:16.052242, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:03:19.824201, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:03:19.824571, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:03:19.824606, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:03:19.824638, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:03:19.824657, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:03:19.824680, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:03:31.036343, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:03:31.036588, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:31.036625, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346558)]: request interface version (version = 32) >[2025/04/09 07:03:31.036688, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346558):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:31.039635, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:03:31.039669, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2346558)]: ping >[2025/04/09 07:03:31.039719, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346558):PING]: delivered response to client >[2025/04/09 07:03:31.047634, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:03:31.073228, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:03:31.073341, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:31.073368, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346571)]: request interface version (version = 32) >[2025/04/09 07:03:31.073421, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346571):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:31.083751, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:31.083788, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346571)]: request interface version (version = 32) >[2025/04/09 07:03:31.083837, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346571):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:31.087407, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:03:31.087454, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2346571)]: request misc info >[2025/04/09 07:03:31.087537, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346571):INFO]: delivered response to client >[2025/04/09 07:03:31.088631, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:03:31.088679, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2346571)]: request netbios name >[2025/04/09 07:03:31.088727, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346571):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:03:31.089224, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:03:31.089256, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2346571)]: request domain name >[2025/04/09 07:03:31.089302, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346571):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:03:31.089403, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2346571)] Handling async request: DOMAIN_INFO >[2025/04/09 07:03:31.089443, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2346571]: domain_info [ADPROTOCOLX] >[2025/04/09 07:03:31.089522, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2346571):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:03:31.089583, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346571):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:03:31.089705, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2346571)] Handling async request: PING_DC >[2025/04/09 07:03:31.089765, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:03:31.095900, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:03:31.096034, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2346571):PING_DC]: NT_STATUS_OK >[2025/04/09 07:03:31.096089, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346571):PING_DC]: delivered response to client >[2025/04/09 07:03:31.098284, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:03:46.039282, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:03:46.039443, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:46.039482, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346870)]: request interface version (version = 32) >[2025/04/09 07:03:46.039543, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346870):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:46.040172, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:03:46.040203, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2346870)]: ping >[2025/04/09 07:03:46.040245, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346870):PING]: delivered response to client >[2025/04/09 07:03:46.041572, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:03:46.062044, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:03:46.062148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:46.062180, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346881)]: request interface version (version = 32) >[2025/04/09 07:03:46.062224, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346881):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:46.062319, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:03:46.062343, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2346881)]: request interface version (version = 32) >[2025/04/09 07:03:46.062381, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346881):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:03:46.062527, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:03:46.062551, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2346881)]: request misc info >[2025/04/09 07:03:46.062598, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346881):INFO]: delivered response to client >[2025/04/09 07:03:46.062715, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:03:46.062758, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2346881)]: request netbios name >[2025/04/09 07:03:46.062808, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346881):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:03:46.062922, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:03:46.062947, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2346881)]: request domain name >[2025/04/09 07:03:46.063035, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346881):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:03:46.063150, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2346881)] Handling async request: DOMAIN_INFO >[2025/04/09 07:03:46.063183, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2346881]: domain_info [ADPROTOCOLX] >[2025/04/09 07:03:46.063233, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2346881):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:03:46.063302, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346881):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:03:46.063424, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2346881)] Handling async request: PING_DC >[2025/04/09 07:03:46.063494, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:03:46.068141, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:03:46.068217, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2346881):PING_DC]: NT_STATUS_OK >[2025/04/09 07:03:46.068266, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2346881):PING_DC]: delivered response to client >[2025/04/09 07:03:46.069874, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:03:49.828775, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:03:49.829014, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:03:49.829053, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:03:49.829080, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:03:49.829098, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:03:49.829121, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:04:01.036649, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:04:01.036783, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:01.036820, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347163)]: request interface version (version = 32) >[2025/04/09 07:04:01.036883, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347163):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:01.037137, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:04:01.037183, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2347163)]: ping >[2025/04/09 07:04:01.037226, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347163):PING]: delivered response to client >[2025/04/09 07:04:01.042439, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:04:01.077092, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:04:01.077201, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:01.077227, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347181)]: request interface version (version = 32) >[2025/04/09 07:04:01.077274, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347181):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:01.077993, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:01.078028, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347181)]: request interface version (version = 32) >[2025/04/09 07:04:01.078077, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347181):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:01.078175, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:04:01.078199, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2347181)]: request misc info >[2025/04/09 07:04:01.078239, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347181):INFO]: delivered response to client >[2025/04/09 07:04:01.078330, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:04:01.078362, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2347181)]: request netbios name >[2025/04/09 07:04:01.078412, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347181):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:04:01.078512, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:04:01.078542, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2347181)]: request domain name >[2025/04/09 07:04:01.078581, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347181):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:04:01.079803, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2347181)] Handling async request: DOMAIN_INFO >[2025/04/09 07:04:01.079842, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2347181]: domain_info [ADPROTOCOLX] >[2025/04/09 07:04:01.079874, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2347181):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:04:01.079969, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347181):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:04:01.081620, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2347181)] Handling async request: PING_DC >[2025/04/09 07:04:01.081695, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:04:01.084297, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:04:01.084361, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2347181):PING_DC]: NT_STATUS_OK >[2025/04/09 07:04:01.084408, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347181):PING_DC]: delivered response to client >[2025/04/09 07:04:01.088890, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:04:16.039820, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:04:16.040039, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:16.040077, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347480)]: request interface version (version = 32) >[2025/04/09 07:04:16.040135, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347480):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:16.040288, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:04:16.040314, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2347480)]: ping >[2025/04/09 07:04:16.040354, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347480):PING]: delivered response to client >[2025/04/09 07:04:16.041584, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:04:16.060626, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:04:16.060704, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:16.060731, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347490)]: request interface version (version = 32) >[2025/04/09 07:04:16.060775, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347490):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:16.060871, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:16.060897, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347490)]: request interface version (version = 32) >[2025/04/09 07:04:16.060939, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347490):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:16.062108, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:04:16.062138, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2347490)]: request misc info >[2025/04/09 07:04:16.062212, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347490):INFO]: delivered response to client >[2025/04/09 07:04:16.062311, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:04:16.062336, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2347490)]: request netbios name >[2025/04/09 07:04:16.062376, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347490):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:04:16.062467, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:04:16.062503, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2347490)]: request domain name >[2025/04/09 07:04:16.062543, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347490):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:04:16.062646, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2347490)] Handling async request: DOMAIN_INFO >[2025/04/09 07:04:16.062673, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2347490]: domain_info [ADPROTOCOLX] >[2025/04/09 07:04:16.062712, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2347490):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:04:16.062769, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347490):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:04:16.062867, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2347490)] Handling async request: PING_DC >[2025/04/09 07:04:16.062926, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:04:16.066001, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:04:16.066081, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2347490):PING_DC]: NT_STATUS_OK >[2025/04/09 07:04:16.066128, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347490):PING_DC]: delivered response to client >[2025/04/09 07:04:16.068515, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:04:19.831560, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:04:19.831696, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:04:19.831726, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:04:19.831749, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:04:19.831766, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:04:19.831796, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:04:31.057450, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:04:31.057607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:31.057644, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347933)]: request interface version (version = 32) >[2025/04/09 07:04:31.057724, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347933):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:31.058057, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:04:31.058090, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2347933)]: ping >[2025/04/09 07:04:31.058136, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347933):PING]: delivered response to client >[2025/04/09 07:04:31.059514, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:04:31.080485, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:04:31.080588, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:31.080616, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347943)]: request interface version (version = 32) >[2025/04/09 07:04:31.080664, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347943):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:31.081174, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:31.081208, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2347943)]: request interface version (version = 32) >[2025/04/09 07:04:31.081254, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347943):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:31.082914, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:04:31.082950, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2347943)]: request misc info >[2025/04/09 07:04:31.083026, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347943):INFO]: delivered response to client >[2025/04/09 07:04:31.083132, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:04:31.083158, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2347943)]: request netbios name >[2025/04/09 07:04:31.083211, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347943):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:04:31.083312, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:04:31.083343, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2347943)]: request domain name >[2025/04/09 07:04:31.083386, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347943):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:04:31.083504, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2347943)] Handling async request: DOMAIN_INFO >[2025/04/09 07:04:31.083532, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2347943]: domain_info [ADPROTOCOLX] >[2025/04/09 07:04:31.083576, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2347943):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:04:31.083625, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347943):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:04:31.083728, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2347943)] Handling async request: PING_DC >[2025/04/09 07:04:31.083766, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:04:31.086285, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:04:31.086371, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2347943):PING_DC]: NT_STATUS_OK >[2025/04/09 07:04:31.086423, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2347943):PING_DC]: delivered response to client >[2025/04/09 07:04:31.087840, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:04:49.405905, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:04:49.406118, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:49.406145, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348339)]: request interface version (version = 32) >[2025/04/09 07:04:49.406206, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348339):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:49.406340, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:04:49.406410, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2348339)]: ping >[2025/04/09 07:04:49.406472, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348339):PING]: delivered response to client >[2025/04/09 07:04:49.406553, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:04:49.424930, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:04:49.425037, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:49.425062, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348341)]: request interface version (version = 32) >[2025/04/09 07:04:49.425111, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348341):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:49.425174, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:04:49.425196, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348341)]: request interface version (version = 32) >[2025/04/09 07:04:49.425263, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348341):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:04:49.425328, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:04:49.425368, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2348341)]: request misc info >[2025/04/09 07:04:49.425427, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348341):INFO]: delivered response to client >[2025/04/09 07:04:49.425492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:04:49.425514, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2348341)]: request netbios name >[2025/04/09 07:04:49.425558, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348341):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:04:49.425616, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:04:49.425638, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2348341)]: request domain name >[2025/04/09 07:04:49.425678, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348341):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:04:49.425770, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2348341)] Handling async request: DOMAIN_INFO >[2025/04/09 07:04:49.425796, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2348341]: domain_info [ADPROTOCOLX] >[2025/04/09 07:04:49.425870, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2348341):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:04:49.425925, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348341):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:04:49.426006, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2348341)] Handling async request: PING_DC >[2025/04/09 07:04:49.426064, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:04:49.428632, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:04:49.428703, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2348341):PING_DC]: NT_STATUS_OK >[2025/04/09 07:04:49.428762, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348341):PING_DC]: delivered response to client >[2025/04/09 07:04:49.428879, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:04:49.832413, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:04:49.832499, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:04:49.832523, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:04:49.832547, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:04:49.832565, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:04:49.832594, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:05:01.074062, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:05:01.074357, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:01.074412, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348585)]: request interface version (version = 32) >[2025/04/09 07:05:01.074481, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348585):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:01.074579, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:05:01.074607, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2348585)]: ping >[2025/04/09 07:05:01.074646, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348585):PING]: delivered response to client >[2025/04/09 07:05:01.076195, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:05:01.105066, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:05:01.105220, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:01.105253, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348595)]: request interface version (version = 32) >[2025/04/09 07:05:01.105312, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348595):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:01.107700, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:01.107739, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348595)]: request interface version (version = 32) >[2025/04/09 07:05:01.107792, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348595):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:01.111691, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:05:01.111728, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2348595)]: request misc info >[2025/04/09 07:05:01.111781, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348595):INFO]: delivered response to client >[2025/04/09 07:05:01.112717, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:05:01.112775, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2348595)]: request netbios name >[2025/04/09 07:05:01.112834, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348595):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:05:01.115299, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:05:01.115341, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2348595)]: request domain name >[2025/04/09 07:05:01.115398, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348595):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:05:01.116091, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2348595)] Handling async request: DOMAIN_INFO >[2025/04/09 07:05:01.116133, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2348595]: domain_info [ADPROTOCOLX] >[2025/04/09 07:05:01.116181, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2348595):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:05:01.116237, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348595):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:05:01.117489, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2348595)] Handling async request: PING_DC >[2025/04/09 07:05:01.117600, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:05:01.122851, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:05:01.122947, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2348595):PING_DC]: NT_STATUS_OK >[2025/04/09 07:05:01.123028, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348595):PING_DC]: delivered response to client >[2025/04/09 07:05:01.126409, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:05:16.044578, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:05:16.044783, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:16.044811, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348887)]: request interface version (version = 32) >[2025/04/09 07:05:16.044869, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348887):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:16.045010, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:05:16.045039, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2348887)]: ping >[2025/04/09 07:05:16.045080, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348887):PING]: delivered response to client >[2025/04/09 07:05:16.047999, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:05:16.066791, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:05:16.066875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:16.066901, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348896)]: request interface version (version = 32) >[2025/04/09 07:05:16.066949, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348896):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:16.067433, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:16.067461, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2348896)]: request interface version (version = 32) >[2025/04/09 07:05:16.067508, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348896):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:16.067603, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:05:16.067627, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2348896)]: request misc info >[2025/04/09 07:05:16.067667, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348896):INFO]: delivered response to client >[2025/04/09 07:05:16.067759, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:05:16.067784, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2348896)]: request netbios name >[2025/04/09 07:05:16.067836, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348896):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:05:16.067930, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:05:16.067981, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2348896)]: request domain name >[2025/04/09 07:05:16.068030, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348896):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:05:16.068125, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2348896)] Handling async request: DOMAIN_INFO >[2025/04/09 07:05:16.068152, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2348896]: domain_info [ADPROTOCOLX] >[2025/04/09 07:05:16.068193, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2348896):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:05:16.068250, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348896):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:05:16.068349, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2348896)] Handling async request: PING_DC >[2025/04/09 07:05:16.068401, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:05:16.070869, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:05:16.070934, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2348896):PING_DC]: NT_STATUS_OK >[2025/04/09 07:05:16.070991, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2348896):PING_DC]: delivered response to client >[2025/04/09 07:05:16.072218, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:05:19.837119, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:05:19.837330, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:05:19.837376, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:05:19.837401, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:05:19.837418, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:05:19.837456, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:05:31.048535, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:05:31.048705, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:31.048738, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349332)]: request interface version (version = 32) >[2025/04/09 07:05:31.048794, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349332):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:31.048944, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:05:31.049002, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2349332)]: ping >[2025/04/09 07:05:31.049046, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349332):PING]: delivered response to client >[2025/04/09 07:05:31.050266, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:05:31.087720, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:05:31.087851, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:31.087877, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349339)]: request interface version (version = 32) >[2025/04/09 07:05:31.087926, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349339):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:31.089721, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:31.089755, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349339)]: request interface version (version = 32) >[2025/04/09 07:05:31.089815, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349339):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:31.093455, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:05:31.093501, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2349339)]: request misc info >[2025/04/09 07:05:31.093566, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349339):INFO]: delivered response to client >[2025/04/09 07:05:31.095198, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:05:31.095231, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2349339)]: request netbios name >[2025/04/09 07:05:31.095287, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349339):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:05:31.096137, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:05:31.096169, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2349339)]: request domain name >[2025/04/09 07:05:31.096215, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349339):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:05:31.100074, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2349339)] Handling async request: DOMAIN_INFO >[2025/04/09 07:05:31.100116, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2349339]: domain_info [ADPROTOCOLX] >[2025/04/09 07:05:31.100158, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2349339):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:05:31.100226, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349339):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:05:31.103302, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2349339)] Handling async request: PING_DC >[2025/04/09 07:05:31.103379, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:05:31.112221, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:05:31.112295, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2349339):PING_DC]: NT_STATUS_OK >[2025/04/09 07:05:31.112347, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349339):PING_DC]: delivered response to client >[2025/04/09 07:05:31.115305, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:05:46.057154, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:05:46.058353, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:46.058396, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349637)]: request interface version (version = 32) >[2025/04/09 07:05:46.058463, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349637):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:46.058607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:05:46.058637, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2349637)]: ping >[2025/04/09 07:05:46.058676, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349637):PING]: delivered response to client >[2025/04/09 07:05:46.060422, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:05:46.080211, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:05:46.080304, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:46.080329, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349652)]: request interface version (version = 32) >[2025/04/09 07:05:46.080372, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349652):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:46.080478, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:05:46.080502, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349652)]: request interface version (version = 32) >[2025/04/09 07:05:46.080541, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349652):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:05:46.080636, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:05:46.080663, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2349652)]: request misc info >[2025/04/09 07:05:46.080712, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349652):INFO]: delivered response to client >[2025/04/09 07:05:46.080808, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:05:46.080831, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2349652)]: request netbios name >[2025/04/09 07:05:46.080874, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349652):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:05:46.080986, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:05:46.081014, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2349652)]: request domain name >[2025/04/09 07:05:46.081053, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349652):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:05:46.081143, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2349652)] Handling async request: DOMAIN_INFO >[2025/04/09 07:05:46.081177, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2349652]: domain_info [ADPROTOCOLX] >[2025/04/09 07:05:46.081223, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2349652):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:05:46.081268, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349652):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:05:46.081373, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2349652)] Handling async request: PING_DC >[2025/04/09 07:05:46.081422, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:05:46.084320, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:05:46.084394, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2349652):PING_DC]: NT_STATUS_OK >[2025/04/09 07:05:46.084450, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349652):PING_DC]: delivered response to client >[2025/04/09 07:05:46.085605, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:05:49.837685, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:05:49.837873, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:05:49.837898, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:05:49.837933, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:05:49.837987, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:05:49.838038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:06:01.074363, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:06:01.074538, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:06:01.074565, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349936)]: request interface version (version = 32) >[2025/04/09 07:06:01.074615, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349936):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:06:01.075135, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:06:01.075170, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2349936)]: ping >[2025/04/09 07:06:01.075219, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349936):PING]: delivered response to client >[2025/04/09 07:06:01.078007, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:06:01.095392, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:06:01.095476, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:06:01.095504, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349945)]: request interface version (version = 32) >[2025/04/09 07:06:01.095557, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349945):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:06:01.096428, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:06:01.096457, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2349945)]: request interface version (version = 32) >[2025/04/09 07:06:01.096506, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349945):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:06:01.100029, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:06:01.100068, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2349945)]: request misc info >[2025/04/09 07:06:01.100129, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349945):INFO]: delivered response to client >[2025/04/09 07:06:01.103782, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:06:01.103815, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2349945)]: request netbios name >[2025/04/09 07:06:01.103860, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349945):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:06:01.104001, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:06:01.104031, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2349945)]: request domain name >[2025/04/09 07:06:01.104073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349945):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:06:01.104178, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2349945)] Handling async request: DOMAIN_INFO >[2025/04/09 07:06:01.104204, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2349945]: domain_info [ADPROTOCOLX] >[2025/04/09 07:06:01.104257, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2349945):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:06:01.104306, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349945):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:06:01.104402, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2349945)] Handling async request: PING_DC >[2025/04/09 07:06:01.104467, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:06:01.109778, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:06:01.109875, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2349945):PING_DC]: NT_STATUS_OK >[2025/04/09 07:06:01.109940, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2349945):PING_DC]: delivered response to client >[2025/04/09 07:06:01.110509, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:06:16.064338, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:06:16.064479, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:06:16.064519, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2350257)]: request interface version (version = 32) >[2025/04/09 07:06:16.064566, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350257):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:06:16.064673, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:06:16.064697, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2350257)]: ping >[2025/04/09 07:06:16.064735, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350257):PING]: delivered response to client >[2025/04/09 07:06:16.068927, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:06:16.086258, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:06:16.086344, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:06:16.086370, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2350268)]: request interface version (version = 32) >[2025/04/09 07:06:16.086414, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350268):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:06:16.086511, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:06:16.086536, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2350268)]: request interface version (version = 32) >[2025/04/09 07:06:16.086584, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350268):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:06:16.086676, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:06:16.086700, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2350268)]: request misc info >[2025/04/09 07:06:16.086741, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350268):INFO]: delivered response to client >[2025/04/09 07:06:16.086840, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:06:16.086864, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2350268)]: request netbios name >[2025/04/09 07:06:16.086903, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350268):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:06:16.087022, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:06:16.087053, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2350268)]: request domain name >[2025/04/09 07:06:16.087093, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350268):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:06:16.087196, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2350268)] Handling async request: DOMAIN_INFO >[2025/04/09 07:06:16.087223, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2350268]: domain_info [ADPROTOCOLX] >[2025/04/09 07:06:16.087269, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2350268):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:06:16.087323, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350268):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:06:16.087432, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2350268)] Handling async request: PING_DC >[2025/04/09 07:06:16.087493, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:06:16.090725, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:06:16.090797, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2350268):PING_DC]: NT_STATUS_OK >[2025/04/09 07:06:16.090845, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2350268):PING_DC]: delivered response to client >[2025/04/09 07:06:16.093726, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:06:19.757605, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) > msg_ctdb_ref_destructor: refs=(nil) >[2025/04/09 07:06:19.757870, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) > msg_dgm_ref_destructor: refs=0x56144d5eb480 >[2025/04/09 07:06:19.758739, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) > messaging_dgm_ref: messaging_dgm_init returned Success >[2025/04/09 07:06:19.758851, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) > messaging_dgm_ref: unique = 12563169457903413366 >[2025/04/09 07:06:19.758996, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 07:06:19.759229, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 07:06:19.759477, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=6817993607967696722 >[2025/04/09 07:06:19.759757, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2350317 >[2025/04/09 07:06:19.760006, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 >[2025/04/09 07:06:19.760196, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=12563169457903413366 >[2025/04/09 07:06:19.760330, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) > vnn pid 2350317 = 1 >[2025/04/09 07:06:19.760363, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) > messaging_ctdb_ref: messaging_ctdb_init returned Success >[2025/04/09 07:06:19.760458, 5, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) > register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE >[2025/04/09 07:06:19.760576, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 07:06:19.760775, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 07:06:19.760986, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=14545731037082040223 >[2025/04/09 07:06:19.761333, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.761542, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1835402) returned ok >[2025/04/09 07:06:19.761600, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.761752, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1835459) returned ok >[2025/04/09 07:06:19.761788, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.761882, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1835461) returned ok >[2025/04/09 07:06:19.761934, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.762075, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1878741) returned ok >[2025/04/09 07:06:19.762122, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.762261, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1881876) returned ok >[2025/04/09 07:06:19.762311, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.762437, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162289) returned ok >[2025/04/09 07:06:19.762484, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.762598, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162323) returned ok >[2025/04/09 07:06:19.762640, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.762768, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174496) returned ok >[2025/04/09 07:06:19.762802, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.762890, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174501) returned ok >[2025/04/09 07:06:19.762936, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.763041, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174507) returned ok >[2025/04/09 07:06:19.763087, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.763183, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174506) returned ok >[2025/04/09 07:06:19.763226, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.763339, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174504) returned ok >[2025/04/09 07:06:19.763380, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.763471, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184838) returned ok >[2025/04/09 07:06:19.763506, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.763628, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184863) returned ok >[2025/04/09 07:06:19.763669, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.763765, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184862) returned ok >[2025/04/09 07:06:19.763804, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.763912, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184857) returned ok >[2025/04/09 07:06:19.763969, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.764094, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184926) returned ok >[2025/04/09 07:06:19.764138, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329712) returned Resource temporarily unavailable >[2025/04/09 07:06:19.764181, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329718) returned Resource temporarily unavailable >[2025/04/09 07:06:19.764223, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.764353, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329746) returned ok >[2025/04/09 07:06:19.764402, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.764475, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329744) returned ok >[2025/04/09 07:06:19.764508, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.764592, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329748) returned ok >[2025/04/09 07:06:19.764628, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329757) returned Resource temporarily unavailable >[2025/04/09 07:06:19.764673, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329766) returned Resource temporarily unavailable >[2025/04/09 07:06:19.764707, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329769) returned Resource temporarily unavailable >[2025/04/09 07:06:19.764751, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329771) returned Resource temporarily unavailable >[2025/04/09 07:06:19.764783, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.764864, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1835405) returned ok >[2025/04/09 07:06:19.764898, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765017, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1835458) returned ok >[2025/04/09 07:06:19.765060, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765131, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1835460) returned ok >[2025/04/09 07:06:19.765179, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765299, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1881016) returned ok >[2025/04/09 07:06:19.765333, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765409, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162247) returned ok >[2025/04/09 07:06:19.765442, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765526, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162266) returned ok >[2025/04/09 07:06:19.765560, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765629, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162283) returned ok >[2025/04/09 07:06:19.765662, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765729, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162287) returned ok >[2025/04/09 07:06:19.765764, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765838, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162288) returned ok >[2025/04/09 07:06:19.765872, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.765943, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162284) returned ok >[2025/04/09 07:06:19.766004, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766066, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162286) returned ok >[2025/04/09 07:06:19.766097, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766181, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162282) returned ok >[2025/04/09 07:06:19.766214, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766317, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162285) returned ok >[2025/04/09 07:06:19.766357, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766435, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2162316) returned ok >[2025/04/09 07:06:19.766474, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766563, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174486) returned ok >[2025/04/09 07:06:19.766603, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766672, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174508) returned ok >[2025/04/09 07:06:19.766705, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766770, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174502) returned ok >[2025/04/09 07:06:19.766810, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766871, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174503) returned ok >[2025/04/09 07:06:19.766911, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.766994, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174505) returned ok >[2025/04/09 07:06:19.767038, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.767157, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174542) returned ok >[2025/04/09 07:06:19.767199, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.767285, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184854) returned ok >[2025/04/09 07:06:19.767318, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.767400, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184864) returned ok >[2025/04/09 07:06:19.767434, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.767511, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184858) returned ok >[2025/04/09 07:06:19.767544, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.767610, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184861) returned ok >[2025/04/09 07:06:19.767649, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.767728, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184856) returned ok >[2025/04/09 07:06:19.767761, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.767836, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184902) returned ok >[2025/04/09 07:06:19.767881, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329715) returned Resource temporarily unavailable >[2025/04/09 07:06:19.767914, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.768015, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329720) returned ok >[2025/04/09 07:06:19.768051, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.768122, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329743) returned ok >[2025/04/09 07:06:19.768155, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.768216, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329745) returned ok >[2025/04/09 07:06:19.768266, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.768357, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329747) returned ok >[2025/04/09 07:06:19.768391, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.768470, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329742) returned ok >[2025/04/09 07:06:19.768507, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329767) returned Resource temporarily unavailable >[2025/04/09 07:06:19.768549, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.768618, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329768) returned ok >[2025/04/09 07:06:19.768653, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2340366) returned Resource temporarily unavailable >[2025/04/09 07:06:19.768684, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.768791, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1835408) returned ok >[2025/04/09 07:06:19.768832, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.768905, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(1835700) returned ok >[2025/04/09 07:06:19.768939, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.769104, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2174557) returned ok >[2025/04/09 07:06:19.769138, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.769198, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2184860) returned ok >[2025/04/09 07:06:19.769383, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.769556, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2185109) returned ok >[2025/04/09 07:06:19.769639, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.769710, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329735) returned ok >[2025/04/09 07:06:19.769744, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) > messaging_dgm_cleanup: Cleaning up : Success >[2025/04/09 07:06:19.769802, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) > messaging_dgm_cleanup(2329764) returned ok >[2025/04/09 07:06:19.769832, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:1428(mess_parent_dgm_cleanup) > messaging_dgm_wipe returned ok >[2025/04/09 07:06:19.769927, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) > msg_ctdb_ref_destructor: refs=(nil) >[2025/04/09 07:06:19.769989, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) > msg_dgm_ref_destructor: refs=0x56144d5eb480 >[2025/04/09 07:06:19.771283, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:851(winbind_child_died) > Already reaped child 2350317 died >[2025/04/09 07:06:19.838537, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:06:19.838634, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:06:19.838671, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:06:19.838696, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:06:19.838714, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:06:19.838736, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. > >Logs name: log.wb-ADPROTOCOLX.scenario1 >======================== >[2025/04/09 06:57:16.574947, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:57:16.575108, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:57:16.575399, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:57:16.575667, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:57:16.575836, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000040 (64) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:57:16.576087, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:57:16.576254, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:57:16.576296, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:57:16.577124, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:57:16.577222, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000040 (64) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] A2 0E 4F A7 39 DD 67 8E F9 F7 FD D2 94 38 C2 25 ..O.9.g. .....8.% > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] DB CE 0E 42 3D 65 96 66 67 E7 61 7D FF AF 1F 11 ...B=e.f g.a}.... > [0030] 6D 69 66 65 69 72 69 67 85 D7 13 E6 80 AD 67 53 mifeirig ......gS > [0040] F3 C2 25 52 C4 89 CA 6C D0 B7 65 FA 52 92 72 2E ..%R...l ..e.R.r. >[2025/04/09 06:57:16.577511, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:57:16.577542, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:57:16.577560, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:57:16.577592, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:57:16.577621, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:57:16.577670, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:57:16.577707, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:57:16.577846, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:57:16.577884, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:57:16.578004, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:57:16.578034, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:57:31.033937, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:57:31.033998, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:57:31.034101, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:57:31.034202, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:57:31.034317, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000041 (65) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:57:31.034539, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:57:31.034703, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:57:31.034748, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:57:31.035581, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:57:31.035649, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000041 (65) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 09 A8 E4 18 60 E5 60 A6 F0 28 A9 AF 1A F1 9A 39 ....`.`. .(.....9 > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] AD 5A AB 80 63 C3 76 15 0D D0 47 B6 0C CC F7 0E .Z..c.v. ..G..... > [0030] 41 85 1D 68 32 83 09 A5 00 00 00 00 00 00 00 00 A..h2... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:57:31.035957, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:57:31.035998, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:57:31.036031, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:57:31.036065, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:57:31.036103, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:57:31.036126, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:57:31.036154, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:57:31.036231, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:57:31.036262, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:57:31.036335, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:57:31.036355, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:57:45.982717, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:57:45.982855, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:57:45.983016, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:57:45.983167, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:57:45.983277, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000042 (66) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:57:45.983469, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:57:45.983587, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:57:45.983624, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:57:46.001647, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:57:46.001750, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000042 (66) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 13 2D A7 D8 C8 38 93 3D FA 92 4A 01 FF 96 78 1C .-...8.= ..J...x. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] CC 8A C2 4A 8C 5D BA E9 E6 9D 91 FA 96 84 FC E4 ...J.].. ........ > [0030] 8B 3E 80 24 61 A8 87 7F 00 00 00 00 00 00 00 00 .>.$a... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:57:46.002074, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:57:46.002101, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:57:46.002121, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:57:46.002172, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:57:46.002194, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:57:46.002215, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:57:46.002261, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:57:46.002359, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:57:46.002385, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:57:46.002453, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:57:46.002474, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:57:58.086024, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:57:58.086083, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:57:58.086193, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:57:58.086313, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:57:58.086403, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000043 (67) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:57:58.086602, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:57:58.086718, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:57:58.086758, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:57:58.087429, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:57:58.087503, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000043 (67) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 45 B7 59 6B C2 78 0E 56 BD 26 38 6F 25 11 17 25 E.Yk.x.V .&8o%..% > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 60 25 06 63 66 3D 08 FA D5 4D FB 69 4A B4 72 0C `%.cf=.. .M.iJ.r. > [0030] 61 65 A7 B7 B4 AA 6D 3D 00 00 00 00 00 00 00 00 ae....m= ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:57:58.087793, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:57:58.087815, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:57:58.087834, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:57:58.087866, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:57:58.087904, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:57:58.087946, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:57:58.088010, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:57:58.088103, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:57:58.088125, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:57:58.088184, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:57:58.088203, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:57:58.099718, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 06:57:58.099755, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:57:58.099776, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 06:57:58.099843, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:57:58.099974, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:57:58.100033, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 06:57:58.100064, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 06:57:58.100083, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 06:57:58.100120, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 06:57:58.100154, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 06:57:58.100206, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 06:57:58.100284, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 06:57:58.100557, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000044 (68) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000048 (72) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:57:58.100756, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:57:58.100844, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:57:58.100899, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:57:58.101656, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 06:57:58.101756, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x00000044 (68) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] 69 81 7A CB 7C 7B DA 51 FA D5 1E 2D 8D D4 AD 64 i.z.|{.Q ...-...d > [0010] 8B 58 F6 6A 91 15 1A B3 BD FC CB 5F 59 00 A8 DC .X.j.... ..._Y... > [0020] 4D BB 14 CD 77 79 36 46 2A 6D 05 DD EF C8 8D 4A M...wy6F *m.....J > [0030] 9D 75 27 E7 4E 39 D0 37 68 32 E2 BE AF 75 53 1E .u'.N9.7 h2...uS. > [0040] 05 EF DF 86 99 11 B7 9E 21 E5 C1 7C F0 B0 59 9D ........ !..|..Y. > [0050] C6 00 89 94 E2 0E 22 4F 51 54 3C 2E C2 08 0B 43 ......"O QT<....C > [0060] DC 97 89 2C 25 40 C3 62 A1 0B 39 82 5C C7 85 D4 ...,%@.b ..9.\... > [0070] DA 09 D7 5C C2 B8 39 04 92 EA BC 83 1F 48 46 0C ...\..9. .....HF. > [0080] 71 D6 F2 12 E8 F8 E0 7A 1B FA DC B6 80 F0 70 E5 q......z ......p. > [0090] 38 D7 B4 FD 3E 20 9F 22 64 E5 9F 90 AC 18 7A 67 8...> ." d.....zg > [00A0] 37 FD 90 22 6C 1D 6A AF EB 15 07 2F 74 35 21 3F 7.."l.j. .../t5!? > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] 19 97 22 DA 02 C5 1B 4F 84 71 DD 8A 5A 7B 6F D7 .."....O .q..Z{o. > [00D0] AC 80 E5 7A 94 D7 00 DA 00 00 00 00 00 00 00 00 ...z.... ........ > [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:57:58.102255, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:57:58.102279, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 06:57:58.102298, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:57:58.102331, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 06:57:58.102352, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 06:57:58.102371, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. >[2025/04/09 06:57:58.102442, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 06:57:58.102742, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 06:57:58.102768, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 06:57:58.102821, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:02:58 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 06:57:58.102909, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:02:58 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 06:57:58.102958, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 06:57:58.103110, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:57:58.103132, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 06:58:01.031736, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:01.031796, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:58:01.031917, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:01.032048, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:58:01.032175, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000045 (69) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:01.032391, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:01.032498, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:01.032526, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:58:01.034187, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:58:01.034281, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000045 (69) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 66 E5 7C 75 42 50 7E CB 0B 5A D0 BC A9 07 09 64 f.|uBP~. .Z.....d > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] FE B1 42 87 CB 71 E9 28 41 C2 2A 8C 3B 5C 3F 9F ..B..q.( A.*.;\?. > [0030] 25 AE 6A B1 CE EB 0E 7C 1B 83 59 AA 26 64 DD 6F %.j....| ..Y.&d.o > [0040] BA 85 47 BF BF AB FD BC 95 7D DF 90 E6 50 B5 D4 ..G..... .}...P.. >[2025/04/09 06:58:01.034570, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:58:01.034595, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:58:01.034615, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:58:01.034649, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:58:01.034679, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:01.034702, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:58:01.034732, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:58:01.034809, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:58:01.034832, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:01.034892, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:58:01.034913, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:58:03.537580, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:03.537650, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:58:03.537781, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:03.537899, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:58:03.538027, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000046 (70) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:03.538399, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:03.538511, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:03.538550, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:58:03.539548, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:58:03.539624, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000046 (70) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] DD E1 99 23 22 96 C0 12 00 54 35 61 FB 2F B3 8D ...#"... .T5a./.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] BA A6 60 96 4D DA 5F D7 87 65 0C A5 0E 0D B2 C7 ..`.M._. .e...... > [0030] DD 93 ED A7 EC F5 24 41 EA E2 52 5E 69 EB 30 A9 ......$A ..R^i.0. > [0040] 7F DA AD 9B 2B 68 6E 25 5A FC D5 0F 5E 89 CF CD ....+hn% Z...^... >[2025/04/09 06:58:03.540046, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:58:03.540133, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:58:03.540172, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:58:03.540206, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:58:03.540241, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:03.540261, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:58:03.540290, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:58:03.540367, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:58:03.540390, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:03.540472, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:58:03.540496, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:58:03.548639, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 06:58:03.548680, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:03.548701, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 06:58:03.548739, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:03.548807, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:03.548865, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 06:58:03.548890, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 06:58:03.548908, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 06:58:03.548927, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 06:58:03.548946, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 06:58:03.549033, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 06:58:03.549085, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 06:58:03.549275, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000047 (71) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000048 (72) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:03.549467, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:03.549544, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:03.549570, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:58:03.550237, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 06:58:03.550300, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x00000047 (71) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] 3E A4 FB 95 EF 6C 2C 4C 88 BF F7 B6 7E 53 6A CA >....l,L ....~Sj. > [0010] 2A C5 2F D7 95 CA 6D 07 74 6C C8 D1 17 BC 2E 16 *./...m. tl...... > [0020] FF A7 FA 15 77 5E 03 D4 D6 7B B2 B1 7B 7A B5 48 ....w^.. .{..{z.H > [0030] B5 AA 36 60 0B E7 0A 77 37 66 14 BD 6B D7 8F 24 ..6`...w 7f..k..$ > [0040] 5C 1A A6 A1 07 88 7B 02 5A DF F1 0A F3 5E 1C B3 \.....{. Z....^.. > [0050] 50 B4 CC 70 39 1C 7F 84 02 68 65 F9 2B D4 AB AE P..p9... .he.+... > [0060] 8E E8 58 4D DA 24 CA 01 59 41 5E 93 28 6E E3 DF ..XM.$.. YA^.(n.. > [0070] A7 8A 57 BF 82 61 48 10 98 84 2A 38 FF 42 DF 91 ..W..aH. ..*8.B.. > [0080] 04 E9 A1 58 0C 2A FC 01 68 D9 04 30 15 FB F1 05 ...X.*.. h..0.... > [0090] 69 05 41 13 47 71 8F A1 A7 6D B1 54 33 C9 B3 F1 i.A.Gq.. .m.T3... > [00A0] DE 3C FD D0 81 49 DB 22 AE EC 75 B9 6C 34 1A EB .<...I." ..u.l4.. > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] C0 87 87 DD 89 80 91 58 46 EF 6B 27 24 49 D2 FE .......X F.k'$I.. > [00D0] DE CF 0D 1E 9E 8C F4 14 00 00 00 00 00 00 00 00 ........ ........ > [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:58:03.550716, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:58:03.550739, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 06:58:03.550757, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:58:03.550790, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 06:58:03.550812, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:03.550831, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. >[2025/04/09 06:58:03.550908, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 06:58:03.551246, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 06:58:03.551272, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 06:58:03.551298, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:03:03 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 06:58:03.551338, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:03:03 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 06:58:03.551372, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 06:58:03.551476, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:58:03.551497, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 06:58:09.014566, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:09.014645, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:58:09.014755, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:09.014876, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:58:09.015008, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000048 (72) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:09.015236, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:09.015351, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:09.015389, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:58:09.016785, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:58:09.016882, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000048 (72) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 77 5C A4 2F F4 DE 5D 39 07 8F 2D EA FC 6F EF 4B w\./..]9 ..-..o.K > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] C2 9C 67 8E 0E 7D ED DC A2 C4 EF 73 0E C1 72 34 ..g..}.. ...s..r4 > [0030] C0 62 CC FD D0 C4 DB 91 00 00 00 00 00 00 00 00 .b...... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:58:09.017200, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:58:09.017226, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:58:09.017251, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:58:09.017287, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:58:09.017322, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:09.017343, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:58:09.017385, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:58:09.017505, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:58:09.017529, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:09.017600, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:58:09.017621, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:58:09.028229, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 06:58:09.028282, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:09.028314, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 06:58:09.028370, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 06:58:09.028447, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:09.028476, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 06:58:09.028497, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 06:58:09.028522, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 06:58:09.028543, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 06:58:09.028565, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 06:58:09.028589, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 06:58:09.028630, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 06:58:09.028821, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000049 (73) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000048 (72) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:09.029046, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:09.029144, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:09.029181, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:58:09.030385, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 06:58:09.030447, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x00000049 (73) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] FC 37 37 3F 09 CD 75 92 4D FC E3 2E FB 01 73 D9 .77?..u. M.....s. > [0010] E6 8A 53 29 B8 55 36 5E 1E 30 D0 E1 B3 0A 22 61 ..S).U6^ .0...."a > [0020] 5B 4B C8 73 A4 D5 33 80 BF C7 E1 FF F4 12 A3 DA [K.s..3. ........ > [0030] FC 7A 1F 17 D3 B2 E5 8C 29 8A 44 3D 38 BE CA 97 .z...... ).D=8... > [0040] 9F 58 9D 49 D7 B5 9E 86 E4 0B 46 B6 61 4F 8A F3 .X.I.... ..F.aO.. > [0050] 9F E0 B0 83 18 96 4F 71 AD DD 48 B7 AB 33 41 EA ......Oq ..H..3A. > [0060] 01 8B 9E 51 50 9B BA 73 49 B5 48 B0 4E FF 84 3F ...QP..s I.H.N..? > [0070] 78 AC E2 AF 4B 2C 05 6F 44 A9 87 E1 95 B6 88 F3 x...K,.o D....... > [0080] 1B 98 76 BD 4F 35 BE 06 AC 4B 1D 09 95 9B 26 BC ..v.O5.. .K....&. > [0090] 5E 55 24 F4 AE FB 5C C9 FE EF BD B5 C8 7D 66 40 ^U$...\. .....}f@ > [00A0] 36 E1 DF E9 50 E9 39 FC 73 C9 1E D6 14 9A 98 64 6...P.9. s......d > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] 94 88 25 D9 70 52 A6 D8 42 A1 4A F5 D2 18 C8 21 ..%.pR.. B.J....! > [00D0] AA BB 5E D9 C0 B5 A3 6C 00 00 00 00 00 00 00 00 ..^....l ........ > [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:58:09.030876, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:58:09.030899, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 06:58:09.030923, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:58:09.030981, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 06:58:09.031011, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:09.031039, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. >[2025/04/09 06:58:09.031107, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 06:58:09.031380, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 06:58:09.031413, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 06:58:09.031441, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:03:09 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 06:58:09.031505, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:03:09 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 06:58:09.031547, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 06:58:09.031655, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:58:09.031678, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 06:58:14.517859, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:14.517912, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:58:14.518028, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:14.518112, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:58:14.518228, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000004a (74) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:14.518429, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:14.518555, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:14.518594, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:58:14.519329, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:58:14.519410, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000004a (74) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] F6 21 3D 34 BC 03 E4 45 A3 92 34 E1 05 31 BD EC .!=4...E ..4..1.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 36 41 A1 56 E5 B0 A2 AB 52 C3 E8 3E 8C 78 C2 D9 6A.V.... R..>.x.. > [0030] 11 75 EC 6C 07 A1 6E 2E 83 19 B5 DB EF 9C CC 36 .u.l..n. .......6 > [0040] 01 00 00 00 03 00 03 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:58:14.519674, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:58:14.519698, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:58:14.519717, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:58:14.519750, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:58:14.519773, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:14.519802, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:58:14.519835, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:58:14.519916, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:58:14.519950, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:14.520078, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:58:14.520101, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:58:16.012779, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:16.012828, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:58:16.012907, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:16.013028, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:58:16.013115, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000004b (75) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:16.013314, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:16.013424, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:16.013463, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:58:16.014007, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:58:16.014085, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000004b (75) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] AF 6B D4 AF F1 78 78 0A 07 C3 48 8E ED 95 5A 1D .k...xx. ..H...Z. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 06 5E B7 D8 5E D4 A9 38 F1 89 9F BD 05 64 44 E1 .^..^..8 .....dD. > [0030] CF A9 B9 C0 6A F8 39 8C 83 19 B5 DB EF 9C CC 36 ....j.9. .......6 > [0040] 01 00 00 00 03 00 03 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:58:16.014362, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:58:16.014388, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:58:16.014407, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:58:16.014440, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:58:16.014461, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:16.014481, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 06:58:16.014508, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:58:16.014578, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:58:16.014614, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:16.014685, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:58:16.014707, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:58:31.010122, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:31.010168, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:58:31.010251, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:31.010358, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:58:31.010470, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000004c (76) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:31.010677, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:31.010898, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:31.010933, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:58:34.734924, 4, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:58:34.735145, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:58:34.735344, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:58:34.735588, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:58:34.735696, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 06:58:34.735925, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000008 (8) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000088 (136) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:34.736150, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:34.736252, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 06:58:34.736308, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 232 >[2025/04/09 06:58:41.021121, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) > cli_api_pipe failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 06:58:41.021304, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 10000 (ms) to 1000 (ms). >[2025/04/09 06:58:41.021445, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 1000 (ms) to 500 (ms). >[2025/04/09 06:58:41.021510, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 500 (ms) to 500 (ms). >[2025/04/09 06:58:41.021720, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 06:58:41.522545, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1946(connection_ok) > connection_ok: Connection to windc1.adprotocolx.com for domain ADPROTOCOLX is not connected >[2025/04/09 06:58:41.522655, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1760(cm_open_connection) > Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. >[2025/04/09 06:58:41.522694, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1767(cm_open_connection) > Attempt 0/3: DC 'windc1.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 06:58:41.522716, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1528(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 06:58:41.522778, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc1.adprotocolx.com" for "ADPROTOCOLX" domain >[2025/04/09 06:58:41.522824, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com >[2025/04/09 06:58:41.522859, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1439(connect_preferred_dc) > connect_preferred_dc: saf_servername is 'windc1.adprotocolx.com' for domain ADPROTOCOLX >[2025/04/09 06:58:41.522905, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 06:58:41.522942, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 06:58:41.523014, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc1.adprotocolx.com#20 found. >[2025/04/09 06:58:41.523054, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:41.523087, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. >[2025/04/09 06:58:41.523149, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.92'. >[2025/04/09 06:58:41.523191, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: adprotocolx.com) >[2025/04/09 06:58:44.746703, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) > cli_api_pipe failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 06:58:44.746904, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 10000 (ms) to 1000 (ms). >[2025/04/09 06:58:44.747040, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 1000 (ms) to 500 (ms). >[2025/04/09 06:58:44.747136, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 500 (ms) to 500 (ms). >[2025/04/09 06:58:44.747788, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 06:58:45.248606, 3, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1946(connection_ok) > connection_ok: Connection to windc1.adprotocolx.com for domain ADPROTOCOLX is not connected >[2025/04/09 06:58:45.248690, 3, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1760(cm_open_connection) > Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. >[2025/04/09 06:58:45.248717, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1767(cm_open_connection) > Attempt 0/3: DC 'windc1.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 06:58:45.248746, 3, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1528(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 06:58:45.248810, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc1.adprotocolx.com" for "ADPROTOCOLX" domain >[2025/04/09 06:58:45.248847, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com >[2025/04/09 06:58:45.248867, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1439(connect_preferred_dc) > connect_preferred_dc: saf_servername is 'windc1.adprotocolx.com' for domain ADPROTOCOLX >[2025/04/09 06:58:45.248905, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 06:58:45.248929, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 06:58:45.248987, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc1.adprotocolx.com#20 found. >[2025/04/09 06:58:45.249030, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:45.249060, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. >[2025/04/09 06:58:45.249094, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.92'. >[2025/04/09 06:58:45.249119, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: adprotocolx.com) >[2025/04/09 06:58:47.525918, 2, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/cldap.c:417(ads_cldap_netlogon) > ads_cldap_netlogon: did not get a reply >[2025/04/09 06:58:47.526022, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:387(ads_try_connect) > ads_try_connect: ads_cldap_netlogon_5(10.28.1.92, adprotocolx.com) failed. >[2025/04/09 06:58:47.526076, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com] and timeout=[Wed Apr 9 06:59:47 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 06:58:47.526149, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX (windc1.adprotocolx.com) to failed conn cache >[2025/04/09 06:58:47.526179, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) >[2025/04/09 06:58:47.526204, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) >[2025/04/09 06:58:47.526229, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [ADPROTOCOLX] >[2025/04/09 06:58:47.526251, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com] and timeout=[Wed Apr 9 06:59:47 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 06:58:47.526286, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain adprotocolx.com (windc1.adprotocolx.com) to failed conn cache >[2025/04/09 06:58:47.526326, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 06:58:47.526351, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 06:58:47.526377, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [adprotocolx.com] >[2025/04/09 06:58:47.526399, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1539(find_dc) > Retrieving a list of IP addresses for DCs. >[2025/04/09 06:58:47.526446, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 06:58:47.526470, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) > ads_dc_name: domain=ADPROTOCOLX >[2025/04/09 06:58:47.526501, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 06:58:47.526526, 6, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) > resolve_and_ping_dns: (cldap) looking for realm 'adprotocolx.com' >[2025/04/09 06:58:47.526551, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) >[2025/04/09 06:58:47.526584, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:47.526610, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:47.526630, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) >[2025/04/09 06:58:47.526655, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 06:58:47.526714, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:47.526740, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:47.526776, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:47.526799, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:47.526821, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:47.526843, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:47.526865, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:47.526892, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:47.526912, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:47.526931, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:47.526948, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:47.527003, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:47.527032, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:47.527056, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:47.527080, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:47.527104, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:47.527129, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:47.527151, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) > cldap_ping_list: Try to create 6 netlogon connections for domain 'adprotocolx.com' (provided count of addresses was 6). >[2025/04/09 06:58:47.729092, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:47.729609, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 06:58:47.729640, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480472 seconds ahead) >[2025/04/09 06:58:47.729693, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 06:58:47.729727, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480472 seconds ahead) >[2025/04/09 06:58:47.729774, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) > cldap_ping_list: realm[adprotocolx.com]: selected 10.28.1.93 => windc2.adprotocolx.com >[2025/04/09 06:58:47.729795, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) > cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:47.730175, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 06:58:47.730217, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 06:58:47.730243, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 06:58:47.730299, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX >[2025/04/09 06:58:47.730347, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:47.730374, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:47.730406, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) >[2025/04/09 06:58:47.730429, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 06:58:47.730474, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 06:58:47.730579, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 06:58:47.730605, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:47.730701, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 98 0E 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 06:58:48.731892, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 06:58:48.732056, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 06:58:48.732086, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:48.732210, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] CD 71 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .q...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 06:58:48.732338, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 06:58:48.732757, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] CD 71 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .q...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... > [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. > [0120] D7 81 C8 0F 00 ..... >[2025/04/09 06:58:48.733188, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 06:58:48.733220, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 06:58:48.733240, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:48.733261, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 06:58:48.733281, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 06:58:48.733300, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:48.733331, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:48.733381, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:48.733416, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:48.733441, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:48.733465, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:48.733488, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:48.733511, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:48.733534, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:48.733554, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:48.733574, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:48.733593, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:48.733617, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 06:58:48.733643, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:48.733666, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:48.733686, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) >[2025/04/09 06:58:48.733709, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 06:58:48.733740, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 06:58:48.733810, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 06:58:48.733833, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:48.733898, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] BF 5B 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .[...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 06:58:49.735121, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 06:58:49.735197, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 06:58:49.735222, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:49.735330, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 21 F3 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 !....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 06:58:49.735427, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 06:58:49.735985, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 21 F3 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 !....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s > [0100] D0 D7 81 C8 0F 00 ...... >[2025/04/09 06:58:49.736334, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 06:58:49.736364, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 06:58:49.736384, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:49.736404, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 06:58:49.736422, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 06:58:49.736451, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:49.736474, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:49.736521, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:49.736554, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:49.736578, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:49.736600, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:49.736622, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:49.736643, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:49.736665, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:49.736684, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:49.736703, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:49.736720, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:49.736763, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 06:58:49.736790, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 06:58:49.938692, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:51.251783, 2, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/cldap.c:417(ads_cldap_netlogon) > ads_cldap_netlogon: did not get a reply >[2025/04/09 06:58:51.251862, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:387(ads_try_connect) > ads_try_connect: ads_cldap_netlogon_5(10.28.1.92, adprotocolx.com) failed. >[2025/04/09 06:58:51.251912, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com] and timeout=[Wed Apr 9 06:59:51 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 06:58:51.252016, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX (windc1.adprotocolx.com) to failed conn cache >[2025/04/09 06:58:51.252055, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) >[2025/04/09 06:58:51.252082, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) >[2025/04/09 06:58:51.252105, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com] and timeout=[Wed Apr 9 06:59:51 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 06:58:51.252138, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain adprotocolx.com (windc1.adprotocolx.com) to failed conn cache >[2025/04/09 06:58:51.252161, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 06:58:51.252182, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 06:58:51.252217, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1539(find_dc) > Retrieving a list of IP addresses for DCs. >[2025/04/09 06:58:51.252251, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 06:58:51.252280, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) > ads_dc_name: domain=ADPROTOCOLX >[2025/04/09 06:58:51.252305, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 06:58:51.252326, 6, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) > resolve_and_ping_dns: (cldap) looking for realm 'adprotocolx.com' >[2025/04/09 06:58:51.252344, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) >[2025/04/09 06:58:51.252369, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:51.252410, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:51.252432, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) >[2025/04/09 06:58:51.252458, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 06:58:51.252504, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:51.252527, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:51.252553, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:51.252577, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:51.252601, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:51.252623, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:51.252645, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:51.252668, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:51.252687, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:51.252706, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:51.252730, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:51.252764, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:51.252806, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:51.252832, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:51.252857, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:51.252883, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:51.252909, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:51.252932, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) > cldap_ping_list: Try to create 6 netlogon connections for domain 'adprotocolx.com' (provided count of addresses was 6). >[2025/04/09 06:58:51.454618, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:51.455145, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 06:58:51.455173, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480468 seconds ahead) >[2025/04/09 06:58:51.455216, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 06:58:51.455243, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480468 seconds ahead) >[2025/04/09 06:58:51.455277, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) > cldap_ping_list: realm[adprotocolx.com]: selected 10.28.1.93 => windc2.adprotocolx.com >[2025/04/09 06:58:51.455298, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) > cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:51.455617, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 06:58:51.455655, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 06:58:51.455690, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 06:58:51.455743, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX >[2025/04/09 06:58:51.455788, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:51.455814, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:51.455833, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) >[2025/04/09 06:58:51.455855, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 06:58:51.455889, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 06:58:51.455990, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 06:58:51.456023, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:51.456094, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 9C 07 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 06:58:52.457344, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 06:58:52.457459, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 06:58:52.457501, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:52.457671, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 37 6B 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 7k...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 06:58:52.457816, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 06:58:52.459087, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 37 6B 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 7k...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 06:58:52.459502, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 06:58:52.459531, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 06:58:52.459551, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:52.459574, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 06:58:52.459604, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 06:58:52.459623, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:52.459656, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:52.459701, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:52.459736, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:52.459765, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:52.459801, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:52.459826, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:52.459847, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:52.459923, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:52.459988, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:52.460030, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:52.460050, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:52.460081, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 06:58:52.460111, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:52.460146, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:52.460168, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) >[2025/04/09 06:58:52.460190, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 06:58:52.460209, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 06:58:52.460309, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 06:58:52.460333, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:52.460401, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] E4 CB 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 06:58:52.738440, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 06:58:52.738608, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 06:58:52.738658, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) > ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 >[2025/04/09 06:58:52.738705, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 06:58:52.738729, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) >[2025/04/09 06:58:52.738753, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:52.738776, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:52.738809, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) >[2025/04/09 06:58:52.738836, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 06:58:52.738868, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:52.738888, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:52.738911, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:52.738934, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:52.738983, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:52.739027, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:52.739064, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:52.739088, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:52.739108, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:52.739139, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:52.739162, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:52.739195, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 06:58:52.739229, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 06:58:52.739252, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 06:58:52.739287, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 06:58:52.739315, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:52.739354, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:52.739376, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename NULL) >[2025/04/09 06:58:52.739410, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:52.739431, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:52.739449, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename (null)) >[2025/04/09 06:58:52.739472, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 06:58:52.739500, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:52.739520, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:52.739542, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:52.739564, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:52.739585, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:52.739606, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:52.739627, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:52.739653, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:52.739673, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:52.739691, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:52.739709, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:52.739735, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 06:58:52.739757, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 06:58:52.739779, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 06:58:52.739810, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 06:58:52.739834, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:52.739856, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:52.739876, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1543(find_dc) > Retrieved IP addresses for 6 DCs. >[2025/04/09 06:58:52.739898, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1564(find_dc) > Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). >[2025/04/09 06:58:52.739981, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 445 >[2025/04/09 06:58:52.750415, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 192.168.122.133 at port 445 >[2025/04/09 06:58:52.750514, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 445 >[2025/04/09 06:58:52.750600, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 192.168.122.206 at port 445 >[2025/04/09 06:58:52.750723, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 2001:192::656a:348:28e1:d1 at port 445 >[2025/04/09 06:58:52.750834, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 2001:192::c973:d0d7:81c8:f00 at port 445 >[2025/04/09 06:58:52.751244, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1579(find_dc) > Successfully connected to DC '10.28.1.93'. >[2025/04/09 06:58:52.751290, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. >[2025/04/09 06:58:52.751316, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.93'. >[2025/04/09 06:58:52.751340, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: adprotocolx.com) >[2025/04/09 06:58:52.752339, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:52.752713, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 06:58:52.752738, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480467 seconds ahead) >[2025/04/09 06:58:52.752785, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 06:58:52.752826, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480467 seconds ahead) >[2025/04/09 06:58:52.752868, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 06:58:52.752900, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 >[2025/04/09 06:58:52.752924, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:09:52 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 06:58:52.752987, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1134(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f1fc >[2025/04/09 06:58:52.753020, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 06:58:52.753044, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 06:58:52.753097, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX >[2025/04/09 06:58:52.753122, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:52.753144, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:52.753162, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) >[2025/04/09 06:58:52.753183, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 06:58:52.753209, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 06:58:52.753268, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 06:58:52.753291, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:52.753349, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] FB C1 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 06:58:53.461170, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 06:58:53.461231, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 06:58:53.461266, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:53.461365, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 52 86 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 R....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 06:58:53.461464, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 06:58:53.462909, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 52 86 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 R....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej > [0100] 03 48 28 E1 00 D1 .H(... >[2025/04/09 06:58:53.463278, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 06:58:53.463308, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 06:58:53.463334, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:53.463354, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 06:58:53.463373, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 06:58:53.463392, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:53.463414, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:53.463460, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:53.463509, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:53.463535, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:53.463558, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:53.463580, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:53.463602, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:53.463624, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:53.463643, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:53.463663, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:53.463681, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:53.463704, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 06:58:53.463728, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 06:58:53.565094, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:53.754043, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 06:58:53.754113, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 06:58:53.754152, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:53.754294, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 80 B1 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 06:58:53.754430, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 06:58:53.755161, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 80 B1 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... > [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. > [0120] D7 81 C8 0F 00 ..... >[2025/04/09 06:58:53.755618, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 06:58:53.755652, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 06:58:53.755673, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:53.755695, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 06:58:53.755715, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 06:58:53.755735, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:53.755759, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:53.755823, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:53.755871, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:53.755898, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:53.755922, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:53.755947, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:53.756004, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:53.756032, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:53.756053, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:53.756074, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:53.756094, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:53.756123, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 06:58:53.756152, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:53.756191, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:53.756212, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) >[2025/04/09 06:58:53.756237, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 06:58:53.756258, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 06:58:53.756451, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 06:58:53.756476, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:53.756538, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] DA 56 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .V...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 06:58:54.757754, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 06:58:54.757929, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 06:58:54.757986, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:54.758217, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 94 73 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .s...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 06:58:54.758328, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 06:58:54.758847, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 94 73 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .s...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s > [0100] D0 D7 81 C8 0F 00 ...... >[2025/04/09 06:58:54.759294, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 06:58:54.759323, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 06:58:54.759343, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:54.759363, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 06:58:54.759382, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 06:58:54.759400, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:54.759422, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:54.759475, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:54.759524, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:54.759551, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:54.759574, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:54.759597, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:54.759618, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:54.759640, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:54.759658, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:54.759677, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:54.759695, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:54.759717, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 06:58:54.759746, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 06:58:54.961494, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:56.464991, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 06:58:56.465138, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 06:58:56.465191, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) > ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 >[2025/04/09 06:58:56.465232, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 06:58:56.465260, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) >[2025/04/09 06:58:56.465285, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:56.465308, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:56.465327, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) >[2025/04/09 06:58:56.465351, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 06:58:56.465389, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:56.465409, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:56.465432, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:56.465460, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:56.465482, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:56.465514, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:56.465536, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:56.465558, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:56.465576, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:56.465595, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:56.465613, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:56.465640, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 06:58:56.465662, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 06:58:56.465687, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 06:58:56.465729, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 06:58:56.465757, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:56.465780, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:56.465801, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename NULL) >[2025/04/09 06:58:56.465823, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:56.465844, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:56.465880, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename (null)) >[2025/04/09 06:58:56.465904, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 06:58:56.465932, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:56.465974, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:56.466006, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:56.466030, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:56.466051, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:56.466072, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:56.466093, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:56.466114, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:56.466132, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:56.466151, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:56.466168, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:56.466200, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 06:58:56.466223, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 06:58:56.466249, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 06:58:56.466275, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 06:58:56.466296, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:56.466318, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:56.466337, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1543(find_dc) > Retrieved IP addresses for 6 DCs. >[2025/04/09 06:58:56.466360, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1564(find_dc) > Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). >[2025/04/09 06:58:56.466429, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 445 >[2025/04/09 06:58:56.476753, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 192.168.122.133 at port 445 >[2025/04/09 06:58:56.476841, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 445 >[2025/04/09 06:58:56.476938, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 192.168.122.206 at port 445 >[2025/04/09 06:58:56.477068, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 2001:192::656a:348:28e1:d1 at port 445 >[2025/04/09 06:58:56.477187, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 2001:192::c973:d0d7:81c8:f00 at port 445 >[2025/04/09 06:58:56.477677, 3, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1579(find_dc) > Successfully connected to DC '10.28.1.93'. >[2025/04/09 06:58:56.477713, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. >[2025/04/09 06:58:56.477751, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.93'. >[2025/04/09 06:58:56.477776, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: adprotocolx.com) >[2025/04/09 06:58:56.478534, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:58:56.478897, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 06:58:56.478923, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480463 seconds ahead) >[2025/04/09 06:58:56.478993, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 06:58:56.479016, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480463 seconds ahead) >[2025/04/09 06:58:56.479055, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 06:58:56.479078, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 >[2025/04/09 06:58:56.479102, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:09:56 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 06:58:56.479146, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1134(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f1fc >[2025/04/09 06:58:56.479167, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 06:58:56.479188, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 06:58:56.479230, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX >[2025/04/09 06:58:56.479255, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:56.479277, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:56.479296, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) >[2025/04/09 06:58:56.479316, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 06:58:56.479334, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 06:58:56.479386, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 06:58:56.479408, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:56.479467, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 05 D9 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 06:58:57.480678, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 06:58:57.480729, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 06:58:57.480752, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:57.480818, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] D1 FC 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 06:58:57.480943, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 06:58:57.481381, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] D1 FC 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 06:58:57.481709, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 06:58:57.481736, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 06:58:57.481756, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:57.481775, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 06:58:57.481793, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 06:58:57.481811, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:57.481831, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:57.481887, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:57.481914, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:57.481938, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:57.481993, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:57.482025, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:57.482047, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:57.482074, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:57.482092, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:57.482112, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:57.482129, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:57.482152, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 06:58:57.482174, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 06:58:57.482195, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 06:58:57.482213, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) >[2025/04/09 06:58:57.482233, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 06:58:57.482252, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 06:58:57.482304, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 06:58:57.482326, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:57.482382, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] A3 AB 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 06:58:57.761165, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 06:58:57.761328, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 06:58:57.761431, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744197237] >[2025/04/09 06:58:57.761462, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:13:57 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 06:58:57.761505, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [adprotocolx.com], server = [windc2.adprotocolx.com], expire = [1744197237] >[2025/04/09 06:58:57.761526, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:13:57 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 06:58:57.761555, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1168(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' >[2025/04/09 06:58:57.761582, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 06:58:57.761821, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). >[2025/04/09 06:58:57.761948, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 06:58:57.763470, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:857(cm_prepare_connection) > connecting to windc2.adprotocolx.com (ADPROTOCOLX, adprotocolx.com) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] >[2025/04/09 06:58:57.763530, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com >[2025/04/09 06:58:57.763683, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] >[2025/04/09 06:58:57.763772, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763669: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 06:58:57.764964, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763671: Sending unauthenticated request >[2025/04/09 06:58:57.765023, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763672: Sending request (182 bytes) to ADPROTOCOLX.COM >[2025/04/09 06:58:57.765433, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763673: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 06:58:57.766760, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763674: Received answer (219 bytes) from dgram 10.28.1.93:88 >[2025/04/09 06:58:57.766824, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763675: Response was from master KDC >[2025/04/09 06:58:57.766862, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763676: Received error from KDC: -1765328359/Additional pre-authentication required >[2025/04/09 06:58:57.766925, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763679: Preauthenticating using KDC method data >[2025/04/09 06:58:57.766980, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763680: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) >[2025/04/09 06:58:57.767025, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763681: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 06:58:57.770788, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763682: AS key obtained for encrypted timestamp: aes256-cts/C8D8 >[2025/04/09 06:58:57.770890, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763684: Encrypted timestamp (for 1744207136.378782): plain 301AA011180F32303235303430393133353835365AA105020305C79E, encrypted D7CD39E93E3FB8AE451F7A4F243301386C5E0FD84D4B4A8FD826AA68D0DA78EB2E3FE8ECBA5D8E4B6387C211BC6C80E3828BF6D782249E5B >[2025/04/09 06:58:57.770926, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763685: Preauth module encrypted_timestamp (2) (real) returned: 0/Success >[2025/04/09 06:58:57.770949, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763686: Produced preauth for next request: PA-ENC-TIMESTAMP (2) >[2025/04/09 06:58:57.771009, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763687: Sending request (261 bytes) to ADPROTOCOLX.COM >[2025/04/09 06:58:57.771079, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763688: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 06:58:57.772514, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763689: Received answer (102 bytes) from dgram 10.28.1.93:88 >[2025/04/09 06:58:57.772581, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763690: Response was from master KDC >[2025/04/09 06:58:57.772617, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763691: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP >[2025/04/09 06:58:57.772657, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763692: Request or response is too big for UDP; retrying with TCP >[2025/04/09 06:58:57.772682, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763693: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) >[2025/04/09 06:58:57.772754, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763694: Initiating TCP connection to stream 10.28.1.93:88 >[2025/04/09 06:58:57.773343, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763695: Sending TCP request to stream 10.28.1.93:88 >[2025/04/09 06:58:57.774621, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763696: Received answer (1596 bytes) from stream 10.28.1.93:88 >[2025/04/09 06:58:57.774672, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763697: Terminating TCP connection to stream 10.28.1.93:88 >[2025/04/09 06:58:57.774751, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763698: Response was from master KDC >[2025/04/09 06:58:57.774802, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763699: Processing preauth types: PA-ETYPE-INFO2 (19) >[2025/04/09 06:58:57.774831, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763700: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 06:58:57.774855, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763701: Produced preauth for next request: (empty) >[2025/04/09 06:58:57.774898, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763702: AS key determined by preauth: aes256-cts/C8D8 >[2025/04/09 06:58:57.775009, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763703: Decrypted AS reply; session key is: aes256-cts/7838 >[2025/04/09 06:58:57.775073, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763704: FAST negotiation: unavailable >[2025/04/09 06:58:57.775150, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 06:58:57.775182, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763705: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 06:58:57.775225, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329718] 1744196337.763706: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect >[2025/04/09 06:58:57.775270, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos >[2025/04/09 06:58:57.775295, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) > cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO >[2025/04/09 06:58:57.775524, 5, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 06:58:57.775607, 5, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 06:58:57.779824, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x56144d5de100]: subreq: 0x56144d5d2cb0 >[2025/04/09 06:58:57.779867, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x56144d5c60d0]: subreq: 0x56144d5daa10 >[2025/04/09 06:58:57.779928, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x56144d5de100]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5d2cb0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x56144d5d2e90)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906] >[2025/04/09 06:58:57.780042, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x56144d5c60d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5daa10/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x56144d5dabf0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] >[2025/04/09 06:58:57.781971, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x56144d5de100]: subreq: 0x56144d5bfcd0 >[2025/04/09 06:58:57.782006, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x56144d5c60d0]: subreq: 0x56144d5daa10 >[2025/04/09 06:58:57.782033, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x56144d5de100]: NT_STATUS_OK tevent_req[0x56144d5bfcd0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x56144d5bfeb0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913] >[2025/04/09 06:58:57.782091, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x56144d5c60d0]: NT_STATUS_OK tevent_req[0x56144d5daa10/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x56144d5dabf0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] >[2025/04/09 06:58:57.782302, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 06:58:57.782758, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744197237] >[2025/04/09 06:58:57.782786, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:13:57 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 06:58:57.782831, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [adprotocolx.com], server = [windc2.adprotocolx.com], expire = [1744197237] >[2025/04/09 06:58:57.782853, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:13:57 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 06:58:57.782942, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) > set_domain_online: called for domain ADPROTOCOLX >[2025/04/09 06:58:57.782994, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:58:57.783113, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) > messaging_dgm_send: Sending message to 2329712 >[2025/04/09 06:58:57.783157, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403287310 seconds ahead) >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 06:58:57.783378, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=18, srvid=0 >[2025/04/09 06:58:57.783633, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=17, vnn=4026531841, opcode=4, srvid=0 >[2025/04/09 06:58:57.783754, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=18, vnn=4026531841, opcode=149, srvid=0 >[2025/04/09 06:58:57.784013, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) > db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b >[2025/04/09 06:58:57.785268, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 388c08c2e02314e8df7ed8fcdf0514ac > sequence : 0x67f652e8 (1744196328) > seed: struct netr_Credential > data : e500ac10ed03fb68 > client: struct netr_Credential > data : 733e20303d222770 > server: struct netr_Credential > data : 722081f976cb7ee8 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 06:58:57.785668, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 06:58:57.785701, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 06:58:57.785736, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:58:57.785802, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) > ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 >[2025/04/09 06:58:57.785832, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) > ctdbd_migrate: Sending ctdb packet >[2025/04/09 06:58:57.786398, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:58:57.786477, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:58:57.786511, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 06:58:57.786543, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 06:58:57.786562, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 06:58:57.786641, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 135 >[2025/04/09 06:58:57.787079, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 06:58:57.787261, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 0, auth_level 1 >[2025/04/09 06:58:57.787301, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0048 (72) > auth_length : 0x0000 (0) > call_id : 0x0000004d (77) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa > if_version : 0x00000003 (3) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 06:58:57.787555, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:58:57.787578, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 72 >[2025/04/09 06:58:57.787833, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 44 >[2025/04/09 06:58:57.787933, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x003c (60) > auth_length : 0x0000 (0) > call_id : 0x0000004d (77) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00001094 (4244) > secondary_address_size : 0x0004 (4) > secondary_address : '135' > _pad1 : DATA_BLOB length=2 > [0000] AA 12 .. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 06:58:57.788248, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:57.788286, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 60 bytes. >[2025/04/09 06:58:57.788311, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 06:58:57.788384, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > in: struct epm_Map > object : NULL > map_tower : * > map_tower: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 0.0.0.0 > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 00000000-0000-0000-0000-000000000000 > max_towers : 0x00000001 (1) >[2025/04/09 06:58:57.788929, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x0000004e (78) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000074 (116) > context_id : 0x0000 (0) > opnum : 0x0003 (3) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:57.789150, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:58:57.789174, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 140 >[2025/04/09 06:58:57.789698, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 136 >[2025/04/09 06:58:57.789748, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0098 (152) > auth_length : 0x0000 (0) > call_id : 0x0000004e (78) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000080 (128) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=128 > [0000] 00 00 00 00 0C 91 D0 17 86 34 09 4E B9 12 18 6B ........ .4.N...k > [0010] 1A B9 1D AA 01 00 00 00 01 00 00 00 00 00 00 00 ........ ........ > [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... > [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... > [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] > [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. > [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ > [0070] C2 0C 01 00 09 04 00 0A 1C 01 5D 00 00 00 00 00 ........ ..]..... >[2025/04/09 06:58:57.790100, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 152, data_len 128 >[2025/04/09 06:58:57.790123, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:57.790142, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 128 bytes. >[2025/04/09 06:58:57.790192, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > out: struct epm_Map > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 17d0910c-3486-4e09-b912-186b1ab91daa > num_towers : * > num_towers : 0x00000001 (1) > towers: ARRAY(1) > towers: struct epm_twr_p_t > twr : * > twr: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0xc20c (49676) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 10.28.1.93 > result : 0x00000000 (0) >[2025/04/09 06:58:57.790755, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 49676 >[2025/04/09 06:58:57.791368, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 06:58:57.791418, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 388c08c2e02314e8df7ed8fcdf0514ac > sequence : 0x67f652e8 (1744196328) > seed: struct netr_Credential > data : e500ac10ed03fb68 > client: struct netr_Credential > data : 733e20303d222770 > server: struct netr_Credential > data : 722081f976cb7ee8 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 06:58:57.791824, 5, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 06:58:57.791867, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 06:58:57.791904, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 06:58:57.791968, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x56144d5c60d0]: subreq: 0x56144d5bfcd0 >[2025/04/09 06:58:57.792004, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x56144d5c60d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5bfcd0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x56144d5bfeb0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 06:58:57.792038, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 06:58:57.792132, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x0000004f (79) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 06:58:57.792425, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:58:57.792448, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 111 >[2025/04/09 06:58:57.792902, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 64 >[2025/04/09 06:58:57.792989, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0050 (80) > auth_length : 0x000c (12) > call_id : 0x0000004f (79) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b5c (2908) > secondary_address_size : 0x0006 (6) > secondary_address : '49676' > _pad1 : DATA_BLOB length=0 > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 06:58:57.793297, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:57.793320, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 80 bytes. >[2025/04/09 06:58:57.793342, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 06:58:57.793364, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 06:58:57.793400, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x56144d5c60d0]: subreq: 0x56144d5bfcd0 >[2025/04/09 06:58:57.793427, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x56144d5c60d0]: NT_STATUS_OK tevent_req[0x56144d5bfcd0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x56144d5bfeb0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 06:58:57.793466, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 06:58:57.793487, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 06:58:57.793514, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:58:57.793538, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 06:58:57.793561, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=21, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 06:58:57.793597, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:58:57.793644, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 06:58:57.793663, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 06:58:57.793681, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 06:58:57.793726, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:58:57.793812, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 06:58:57.794051, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000050 (80) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000088 (136) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:58:57.794233, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:58:57.794323, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:58:57.794348, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 232 >[2025/04/09 06:58:57.794938, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:58:57.795033, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000050 (80) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 9E C9 A3 FF 6C 04 78 86 0F A1 6A 2E 9E DD 06 84 ....l.x. ..j..... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 7A A1 07 91 8A 6E EC A0 A9 22 F3 82 2D B0 17 D2 z....n.. ."..-... > [0030] 9C 9B 9E 3D E5 D3 27 1D 7C 3A 93 EA E8 67 33 5D ...=..'. |:...g3] > [0040] F5 AA 5E DD 6A 03 2C 90 00 00 00 00 00 00 00 00 ..^.j.,. ........ >[2025/04/09 06:58:57.795305, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:58:57.795329, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:58:57.795348, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:58:57.795381, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:58:57.795403, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:58:57.795422, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 06:58:57.795463, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:58:57.795562, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:58:57.795594, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:58:57.795681, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:58:57.795704, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:58:58.483029, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 06:58:58.483135, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 06:58:58.483159, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 06:58:58.483296, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 5D 37 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ]7...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 06:58:58.483396, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 06:58:58.483926, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 5D 37 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ]7...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej > [0100] 03 48 28 E1 00 D1 .H(... >[2025/04/09 06:58:58.484312, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 06:58:58.484342, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 06:58:58.484366, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:58.484385, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 06:58:58.484403, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 06:58:58.484421, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:58.484442, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:58.484486, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 06:58:58.484521, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 06:58:58.484553, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 06:58:58.484581, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 06:58:58.484604, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 06:58:58.484627, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 06:58:58.484649, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:58.484667, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 06:58:58.484686, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 06:58:58.484703, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 06:58:58.484726, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 06:58:58.484749, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 06:58:58.585861, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 06:59:01.485911, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 06:59:01.486132, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 06:59:01.486204, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744197241] >[2025/04/09 06:59:01.486237, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:14:01 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 06:59:01.486290, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [adprotocolx.com], server = [windc2.adprotocolx.com], expire = [1744197241] >[2025/04/09 06:59:01.486313, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:14:01 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 06:59:01.486344, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1168(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' >[2025/04/09 06:59:01.486376, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 06:59:01.486608, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). >[2025/04/09 06:59:01.486711, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 06:59:01.488023, 5, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:857(cm_prepare_connection) > connecting to windc2.adprotocolx.com (ADPROTOCOLX, adprotocolx.com) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] >[2025/04/09 06:59:01.488073, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com >[2025/04/09 06:59:01.488251, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] >[2025/04/09 06:59:01.488296, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488243: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 06:59:01.488772, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488245: Sending unauthenticated request >[2025/04/09 06:59:01.488810, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488246: Sending request (182 bytes) to ADPROTOCOLX.COM >[2025/04/09 06:59:01.489071, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488247: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 06:59:01.490175, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488248: Received answer (219 bytes) from dgram 10.28.1.93:88 >[2025/04/09 06:59:01.490240, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488249: Response was from master KDC >[2025/04/09 06:59:01.490277, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488250: Received error from KDC: -1765328359/Additional pre-authentication required >[2025/04/09 06:59:01.490319, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488253: Preauthenticating using KDC method data >[2025/04/09 06:59:01.490346, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488254: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) >[2025/04/09 06:59:01.490374, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488255: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 06:59:01.494106, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488256: AS key obtained for encrypted timestamp: aes256-cts/C8D8 >[2025/04/09 06:59:01.494182, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488258: Encrypted timestamp (for 1744207140.120786): plain 301AA011180F32303235303430393133353930305AA105020301D7D2, encrypted DF630BA951B598F94E572B1F4BEFD06FD421EE65E54FB9EA7269F70B56E9B6A81FE23853EF801DB0DE7F3F34EFC0975B6953983015F28C5A >[2025/04/09 06:59:01.494231, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488259: Preauth module encrypted_timestamp (2) (real) returned: 0/Success >[2025/04/09 06:59:01.494256, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488260: Produced preauth for next request: PA-ENC-TIMESTAMP (2) >[2025/04/09 06:59:01.494305, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488261: Sending request (261 bytes) to ADPROTOCOLX.COM >[2025/04/09 06:59:01.494374, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488262: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 06:59:01.495656, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488263: Received answer (102 bytes) from dgram 10.28.1.93:88 >[2025/04/09 06:59:01.495719, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488264: Response was from master KDC >[2025/04/09 06:59:01.495755, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488265: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP >[2025/04/09 06:59:01.495780, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488266: Request or response is too big for UDP; retrying with TCP >[2025/04/09 06:59:01.495803, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488267: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) >[2025/04/09 06:59:01.495874, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488268: Initiating TCP connection to stream 10.28.1.93:88 >[2025/04/09 06:59:01.496329, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488269: Sending TCP request to stream 10.28.1.93:88 >[2025/04/09 06:59:01.497557, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488270: Received answer (1596 bytes) from stream 10.28.1.93:88 >[2025/04/09 06:59:01.497593, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488271: Terminating TCP connection to stream 10.28.1.93:88 >[2025/04/09 06:59:01.497658, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488272: Response was from master KDC >[2025/04/09 06:59:01.497715, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488273: Processing preauth types: PA-ETYPE-INFO2 (19) >[2025/04/09 06:59:01.497744, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488274: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 06:59:01.497788, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488275: Produced preauth for next request: (empty) >[2025/04/09 06:59:01.497816, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488276: AS key determined by preauth: aes256-cts/C8D8 >[2025/04/09 06:59:01.497914, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488277: Decrypted AS reply; session key is: aes256-cts/B679 >[2025/04/09 06:59:01.498005, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488278: FAST negotiation: unavailable >[2025/04/09 06:59:01.498065, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 06:59:01.498096, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488279: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 06:59:01.498136, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2329769] 1744196341.488280: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect >[2025/04/09 06:59:01.498179, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos >[2025/04/09 06:59:01.498208, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) > cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO >[2025/04/09 06:59:01.498409, 5, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 06:59:01.498479, 5, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 06:59:01.502859, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x56144d5c66d0]: subreq: 0x56144d5bd4e0 >[2025/04/09 06:59:01.502894, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x56144d5c7490]: subreq: 0x56144d5d8220 >[2025/04/09 06:59:01.502926, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x56144d5c66d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5bd4e0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x56144d5bd6c0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906] >[2025/04/09 06:59:01.503039, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x56144d5c7490]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5d8220/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x56144d5d8400)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] >[2025/04/09 06:59:01.504444, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x56144d5c66d0]: subreq: 0x56144d5c3ec0 >[2025/04/09 06:59:01.504479, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x56144d5c7490]: subreq: 0x56144d5d8220 >[2025/04/09 06:59:01.504506, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x56144d5c66d0]: NT_STATUS_OK tevent_req[0x56144d5c3ec0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x56144d5c40a0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913] >[2025/04/09 06:59:01.504546, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x56144d5c7490]: NT_STATUS_OK tevent_req[0x56144d5d8220/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x56144d5d8400)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] >[2025/04/09 06:59:01.504716, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 06:59:01.505039, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744197241] >[2025/04/09 06:59:01.505072, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:14:01 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 06:59:01.505112, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [adprotocolx.com], server = [windc2.adprotocolx.com], expire = [1744197241] >[2025/04/09 06:59:01.505134, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:14:01 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 06:59:01.505201, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) > set_domain_online: called for domain ADPROTOCOLX >[2025/04/09 06:59:01.505236, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 06:59:01.505344, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) > messaging_dgm_send: Sending message to 2329712 >[2025/04/09 06:59:01.505394, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403287306 seconds ahead) >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 06:59:01.505593, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=12, vnn=4026531841, opcode=18, srvid=0 >[2025/04/09 06:59:01.505727, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=13, vnn=4026531841, opcode=4, srvid=0 >[2025/04/09 06:59:01.505813, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=14, vnn=4026531841, opcode=149, srvid=0 >[2025/04/09 06:59:01.505910, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) > db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b >[2025/04/09 06:59:01.506024, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 388c08c2e02314e8df7ed8fcdf0514ac > sequence : 0x67f652e8 (1744196328) > seed: struct netr_Credential > data : e500ac10ed03fb68 > client: struct netr_Credential > data : 733e20303d222770 > server: struct netr_Credential > data : 722081f976cb7ee8 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 06:59:01.506357, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 06:59:01.506382, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 06:59:01.506410, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:59:01.506457, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) > ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 >[2025/04/09 06:59:01.506491, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) > ctdbd_migrate: Sending ctdb packet >[2025/04/09 06:59:01.507083, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:59:01.507123, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:59:01.507153, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 06:59:01.507173, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 06:59:01.507192, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 06:59:01.507250, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 135 >[2025/04/09 06:59:01.507642, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 06:59:01.507804, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 0, auth_level 1 >[2025/04/09 06:59:01.507840, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0048 (72) > auth_length : 0x0000 (0) > call_id : 0x00000009 (9) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa > if_version : 0x00000003 (3) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 06:59:01.508130, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:01.508155, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 72 >[2025/04/09 06:59:01.508439, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 44 >[2025/04/09 06:59:01.508524, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x003c (60) > auth_length : 0x0000 (0) > call_id : 0x00000009 (9) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00001096 (4246) > secondary_address_size : 0x0004 (4) > secondary_address : '135' > _pad1 : DATA_BLOB length=2 > [0000] A0 B4 .. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 06:59:01.508792, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:01.508815, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 60 bytes. >[2025/04/09 06:59:01.508838, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 06:59:01.508912, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > in: struct epm_Map > object : NULL > map_tower : * > map_tower: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 0.0.0.0 > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 00000000-0000-0000-0000-000000000000 > max_towers : 0x00000001 (1) >[2025/04/09 06:59:01.509421, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x0000000a (10) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000074 (116) > context_id : 0x0000 (0) > opnum : 0x0003 (3) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:59:01.509612, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:01.509635, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 140 >[2025/04/09 06:59:01.510035, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 136 >[2025/04/09 06:59:01.510088, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0098 (152) > auth_length : 0x0000 (0) > call_id : 0x0000000a (10) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000080 (128) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=128 > [0000] 00 00 00 00 7E 22 F2 60 41 07 C4 40 82 FF 06 E3 ....~".` A..@.... > [0010] C0 C3 CE E1 01 00 00 00 01 00 00 00 00 00 00 00 ........ ........ > [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... > [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... > [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] > [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. > [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ > [0070] C2 0C 01 00 09 04 00 0A 1C 01 5D 00 00 00 00 00 ........ ..]..... >[2025/04/09 06:59:01.510408, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 152, data_len 128 >[2025/04/09 06:59:01.510430, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:01.510449, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 128 bytes. >[2025/04/09 06:59:01.510484, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > out: struct epm_Map > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 60f2227e-0741-40c4-82ff-06e3c0c3cee1 > num_towers : * > num_towers : 0x00000001 (1) > towers: ARRAY(1) > towers: struct epm_twr_p_t > twr : * > twr: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0xc20c (49676) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 10.28.1.93 > result : 0x00000000 (0) >[2025/04/09 06:59:01.511058, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 49676 >[2025/04/09 06:59:01.511509, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 06:59:01.511561, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 388c08c2e02314e8df7ed8fcdf0514ac > sequence : 0x67f652e8 (1744196328) > seed: struct netr_Credential > data : e500ac10ed03fb68 > client: struct netr_Credential > data : 733e20303d222770 > server: struct netr_Credential > data : 722081f976cb7ee8 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 06:59:01.511998, 5, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 06:59:01.512048, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 06:59:01.512072, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 06:59:01.512121, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x56144d5c7490]: subreq: 0x56144d5c3ec0 >[2025/04/09 06:59:01.512152, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x56144d5c7490]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5c3ec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x56144d5c40a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 06:59:01.512186, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 06:59:01.512281, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x0000000b (11) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 06:59:01.512576, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:01.512599, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 111 >[2025/04/09 06:59:01.512883, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 64 >[2025/04/09 06:59:01.512934, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0050 (80) > auth_length : 0x000c (12) > call_id : 0x0000000b (11) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b5e (2910) > secondary_address_size : 0x0006 (6) > secondary_address : '49676' > _pad1 : DATA_BLOB length=0 > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 06:59:01.513262, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:01.513286, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 80 bytes. >[2025/04/09 06:59:01.513309, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 06:59:01.513331, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 06:59:01.513360, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x56144d5c7490]: subreq: 0x56144d5c3ec0 >[2025/04/09 06:59:01.513386, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x56144d5c7490]: NT_STATUS_OK tevent_req[0x56144d5c3ec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x56144d5c40a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 06:59:01.513425, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 06:59:01.513446, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 06:59:01.513473, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:59:01.513503, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 06:59:01.513525, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 06:59:01.513604, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 06:59:01.513637, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 06:59:01.513657, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 06:59:01.513675, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 06:59:01.513710, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:59:01.513799, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 06:59:01.514025, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000000c (12) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000088 (136) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:59:01.514211, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:59:01.514294, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:01.514325, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 232 >[2025/04/09 06:59:01.514683, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:59:01.514731, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000000c (12) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 65 DB 51 A6 0D 45 A6 A6 92 54 98 74 33 9D 1A 19 e.Q..E.. .T.t3... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 14 6A 28 FE F0 22 33 F6 70 19 A7 FC 96 4A E0 EC .j(.."3. p....J.. > [0030] 4A CD B7 16 7A 88 46 91 7C 3A 93 EA E8 67 33 5D J...z.F. |:...g3] > [0040] F5 AA 5E DD 6A 03 2C 90 00 00 00 00 00 00 00 00 ..^.j.,. ........ >[2025/04/09 06:59:01.515057, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:59:01.515080, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:59:01.515100, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:59:01.515132, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:59:01.515154, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:01.515174, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 06:59:01.515202, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:59:01.515295, 5, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:59:01.515324, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:01.515427, 4, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:59:01.515450, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 06:59:06.429590, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:59:06.429647, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:59:06.429736, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:06.429873, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:59:06.429991, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000051 (81) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:59:06.430190, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:59:06.430288, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:06.430315, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:59:06.430894, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:59:06.431002, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000051 (81) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] DD E5 C0 A7 34 D5 73 88 E9 53 90 5D A8 F9 4C 8E ....4.s. .S.]..L. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 3B 63 7A D6 D4 6D 0F 5E 67 F3 79 F3 EE 40 1C 18 ;cz..m.^ g.y..@.. > [0030] E6 5D 2F 21 44 01 DF 5F F0 B7 5A 7A 00 02 00 00 .]/!D.._ ..Zz.... > [0040] 0A 00 00 00 99 00 00 00 30 C7 7F A2 99 00 00 00 ........ 0....... >[2025/04/09 06:59:06.431313, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:59:06.431336, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:59:06.431359, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:59:06.431390, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:59:06.431419, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:06.431447, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 06:59:06.431480, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:59:06.431554, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:59:06.431576, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:06.431633, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:59:06.431653, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:59:13.094643, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:59:13.094730, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:59:13.094847, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:13.094948, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:59:13.095080, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000052 (82) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:59:13.095301, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:59:13.095407, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:13.095454, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:59:13.096388, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:59:13.096452, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000052 (82) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 54 8A F4 F0 2E 8B AB F0 B8 91 12 00 04 C2 4D 85 T....... ......M. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 8D EC 4D CE 20 6E 60 9D 84 2F D8 E3 13 5E 85 16 ..M. n`. ./...^.. > [0030] 30 27 7C D2 99 54 32 02 7C 3A 93 EA E8 67 33 5D 0'|..T2. |:...g3] > [0040] F5 AA 5E DD 6A 03 2C 90 00 00 00 00 00 00 00 00 ..^.j.,. ........ >[2025/04/09 06:59:13.096718, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:59:13.096740, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:59:13.096758, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:59:13.096789, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:59:13.096820, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:13.096848, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 06:59:13.096883, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:59:13.097001, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:59:13.097024, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:13.097083, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:59:13.097103, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:59:16.006175, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:59:16.006231, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:59:16.006284, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:16.006351, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:59:16.006426, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000053 (83) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:59:16.006618, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:59:16.006714, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:16.006741, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:59:16.007365, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:59:16.007438, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000053 (83) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 67 F5 97 48 98 2F D8 D9 A2 EC A4 D8 CC 1E 2F 9C g..H./.. ....../. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] BA 74 EE 4F E9 D7 04 FE AB 05 B7 24 54 24 BE 69 .t.O.... ...$T$.i > [0030] 9B 91 B3 C6 9B 20 A3 04 7C 3A 93 EA E8 67 33 5D ..... .. |:...g3] > [0040] F5 AA 5E DD 6A 03 2C 90 00 00 00 00 00 00 00 00 ..^.j.,. ........ >[2025/04/09 06:59:16.007719, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:59:16.007753, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:59:16.007776, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:59:16.007809, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:59:16.007837, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:16.007856, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 06:59:16.007883, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:59:16.007998, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:59:16.008022, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:16.008081, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:59:16.008101, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:59:26.032915, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:59:26.033000, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:59:26.033118, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:26.033214, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:59:26.033323, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000054 (84) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:59:26.033528, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:59:26.033654, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:26.033691, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:59:26.034312, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:59:26.034403, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000054 (84) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] B1 11 67 80 67 D7 88 89 A6 D6 56 44 B8 0A 9C 3C ..g.g... ..VD...< > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] CD 51 4C 70 FA 2A C4 C1 68 66 55 2D 22 D5 58 FC .QLp.*.. hfU-".X. > [0030] 03 E3 32 4E 33 74 8D 97 00 00 00 00 00 00 00 00 ..2N3t.. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:59:26.034690, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:59:26.034719, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:59:26.034739, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:59:26.034800, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:59:26.034825, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:26.034845, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 06:59:26.034874, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:59:26.034993, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:59:26.035020, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:26.035083, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:59:26.035104, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:59:31.044254, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:59:31.044305, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:59:31.044386, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:31.044469, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:59:31.044574, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000055 (85) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:59:31.044772, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:59:31.044896, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:31.044926, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:59:31.050237, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:59:31.050294, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000055 (85) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] FA 4B 66 F6 4D 9E 7D 72 F9 44 BE EF 09 4E 1D 4C .Kf.M.}r .D...N.L > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 02 BC D3 8C 6A A7 92 17 AF 6B 92 A8 54 25 56 25 ....j... .k..T%V% > [0030] F8 32 21 2F 3A DF 10 58 B5 5E 4C 6E 14 B7 01 08 .2!/:..X .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:59:31.050577, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:59:31.050603, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:59:31.050630, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:59:31.050666, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:59:31.050690, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:31.050719, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 06:59:31.050757, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:59:31.050829, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:59:31.050858, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:31.050944, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:59:31.050985, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 06:59:49.396501, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 06:59:49.396577, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 06:59:49.396712, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 06:59:49.396882, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 06:59:49.397037, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000056 (86) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 06:59:49.397265, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 06:59:49.397431, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 06:59:49.397468, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 06:59:49.398130, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 06:59:49.398194, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000056 (86) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 92 1F 22 4D CF 88 73 7F 35 1C 06 DF 3E 5A 3A B3 .."M..s. 5...>Z:. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 1B 31 C6 79 A2 B9 F5 F7 AD 15 2C B8 50 D2 B2 3E .1.y.... ..,.P..> > [0030] 2F 4C BD 7E 6A 40 F6 C0 B5 5E 4C 6E 14 B7 01 08 /L.~j@.. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 06:59:49.398469, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 06:59:49.398507, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 06:59:49.398525, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 06:59:49.398557, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 06:59:49.398584, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 06:59:49.398604, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 06:59:49.398636, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 06:59:49.398702, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 06:59:49.398732, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 06:59:49.398816, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 06:59:49.398838, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:00:01.050180, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:00:01.050268, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:00:01.050351, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:00:01.050447, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:00:01.050547, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000057 (87) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:00:01.050742, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:00:01.050853, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:00:01.050882, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:00:01.051800, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:00:01.051868, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000057 (87) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] E1 90 82 0C 76 AB EA 2D 20 76 E7 02 C8 1E BC 01 ....v..- v...... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] D7 D5 65 72 B2 8F 1F 61 FE 73 EC 49 C7 A8 E6 B0 ..er...a .s.I.... > [0030] 87 6B 98 35 E6 6D E7 E1 B5 5E 4C 6E 14 B7 01 08 .k.5.m.. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:00:01.052244, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:00:01.052268, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:00:01.052287, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:00:01.052320, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:00:01.052342, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:00:01.052361, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:00:01.052403, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:00:01.052480, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:00:01.052502, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:00:01.052562, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:00:01.052582, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:00:16.021291, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:00:16.021370, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:00:16.021496, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:00:16.021618, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:00:16.021742, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000058 (88) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:00:16.022007, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:00:16.022138, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:00:16.022171, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:00:16.023028, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:00:16.023095, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000058 (88) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] A9 B8 AF A6 D8 35 3C 06 BD BC 34 13 2B 65 B3 9C .....5<. ..4.+e.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 6D 1E 5A 15 A4 57 72 61 0F 31 52 5D 63 BE 53 5E m.Z..Wra .1R]c.S^ > [0030] 33 7C 61 64 3F 13 75 AA B5 5E 4C 6E 14 B7 01 08 3|ad?.u. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:00:16.023391, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:00:16.023416, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:00:16.023442, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:00:16.023480, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:00:16.023503, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:00:16.023569, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:00:16.023615, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:00:16.023725, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:00:16.023750, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:00:16.023816, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:00:16.023843, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:00:31.042611, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:00:31.042692, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:00:31.042869, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:00:31.043064, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:00:31.043184, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000059 (89) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:00:31.043392, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:00:31.043510, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:00:31.043554, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:00:31.044576, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:00:31.044646, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000059 (89) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 3A 0A 01 3E A5 C0 2E 96 5E 23 81 4B AE AA B2 6B :..>.... ^#.K...k > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 18 2A 19 5B C3 8F 6B B0 6E 3E 41 C8 80 5B 8F B9 .*.[..k. n>A..[.. > [0030] EB EE AE 65 9B E3 B4 91 B5 5E 4C 6E 14 B7 01 08 ...e.... .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:00:31.044997, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:00:31.045033, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:00:31.045056, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:00:31.045100, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:00:31.045134, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:00:31.045171, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:00:31.045202, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:00:31.045278, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:00:31.045302, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:00:31.045362, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:00:31.045382, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:00:46.020541, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:00:46.020609, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:00:46.020720, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:00:46.020817, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:00:46.020926, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000005a (90) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:00:46.021166, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:00:46.021358, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:00:46.021415, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:00:46.024981, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:00:46.025046, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000005a (90) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 2F 86 70 0F B4 4A BC AE D8 AB C9 8A 19 3D 46 8F /.p..J.. .....=F. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] A9 23 CB 1C 1D 99 E0 49 40 4B 73 4E 3A D4 83 DE .#.....I @KsN:... > [0030] 1E 6E 49 A6 E0 FB 7C B7 B5 5E 4C 6E 14 B7 01 08 .nI...|. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:00:46.025331, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:00:46.025353, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:00:46.025376, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:00:46.025417, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:00:46.025448, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:00:46.025468, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:00:46.025510, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:00:46.025604, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:00:46.025627, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:00:46.025715, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:00:46.025744, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:01:01.044583, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:01:01.044655, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:01:01.044743, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:01:01.044818, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:01:01.044909, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000005b (91) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:01:01.045190, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:01:01.045293, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:01:01.045321, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:01:01.048144, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:01:01.048202, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000005b (91) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 38 65 BB 29 ED 9E 33 CC 1C 54 AB 41 81 27 A6 3B 8e.)..3. .T.A.'.; > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 7E 6E 38 9D 93 36 F5 08 33 67 53 09 F7 AD B9 25 ~n8..6.. 3gS....% > [0030] 14 33 54 A1 F9 A3 47 C1 B5 5E 4C 6E 14 B7 01 08 .3T...G. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:01:01.048459, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:01:01.048480, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:01:01.048505, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:01:01.048539, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:01:01.048576, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:01:01.048614, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:01:01.048654, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:01:01.048721, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:01:01.048743, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:01:01.048810, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:01:01.048831, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:01:16.066640, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:01:16.066698, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:01:16.066834, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:01:16.066998, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:01:16.067127, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000005c (92) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:01:16.067359, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:01:16.067531, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:01:16.067570, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:01:16.068177, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:01:16.068266, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000005c (92) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 3F 51 02 54 1B 66 C1 F1 DB 14 CD 2A 93 97 4E 5D ?Q.T.f.. ...*..N] > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 08 01 CB D0 4F 94 18 37 2A B1 CD 12 7D 6A F9 7D ....O..7 *...}j.} > [0030] 1B 29 9E C4 B7 18 64 1B B5 5E 4C 6E 14 B7 01 08 .)....d. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:01:16.068546, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:01:16.068571, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:01:16.068591, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:01:16.068632, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:01:16.068663, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:01:16.068685, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:01:16.068715, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:01:16.068785, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:01:16.068824, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:01:16.068897, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:01:16.068920, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:01:31.062008, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:01:31.062106, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:01:31.062226, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:01:31.062341, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:01:31.062474, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000005d (93) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:01:31.062680, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:01:31.062792, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:01:31.062821, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:01:31.079077, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:01:31.079145, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000005d (93) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] ED DE 56 83 AB 66 FA B8 72 90 47 66 05 A6 6D 58 ..V..f.. r.Gf..mX > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] E2 13 C0 6F 97 AA E1 9E 5F 82 33 14 79 1E DA 6D ...o.... _.3.y..m > [0030] 91 7D DA B3 3E 88 AB B3 B5 5E 4C 6E 14 B7 01 08 .}..>... .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:01:31.079413, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:01:31.079457, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:01:31.079479, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:01:31.079537, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:01:31.079560, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:01:31.079579, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:01:31.079620, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:01:31.079700, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:01:31.079722, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:01:31.079792, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:01:31.079823, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:01:46.023203, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:01:46.023269, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:01:46.023376, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:01:46.023466, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:01:46.023587, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000005e (94) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:01:46.023819, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:01:46.023924, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:01:46.023973, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:01:46.025036, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:01:46.025088, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000005e (94) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] AC F6 98 66 95 4C 51 0D 2C C5 48 61 36 AB 66 55 ...f.LQ. ,.Ha6.fU > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] F3 4D 06 A9 1F 02 C8 32 11 00 66 D3 2C 9C D6 42 .M.....2 ..f.,..B > [0030] 31 B0 C3 AC 9D DC 12 9E 8C 7A 36 8B 1D 20 81 83 1....... .z6.. .. > [0040] 55 C5 CB 05 E9 46 A6 B4 1A D1 EF EF 1E D5 AF 86 U....F.. ........ >[2025/04/09 07:01:46.025452, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:01:46.025475, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:01:46.025500, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:01:46.025533, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:01:46.025554, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:01:46.025584, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:01:46.025613, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:01:46.025701, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:01:46.025724, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:01:46.025783, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:01:46.025803, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:02:01.035175, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:02:01.035258, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:02:01.035436, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:02:01.035588, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:02:01.035724, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000005f (95) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:02:01.035987, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:02:01.036114, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:02:01.036149, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:02:01.044692, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:02:01.044749, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000005f (95) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 96 78 70 B9 A8 09 67 3A E6 58 D2 71 6A D5 58 54 .xp...g: .X.qj.XT > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] F2 D5 99 EF CA A4 10 0C 89 83 DA 4E 33 18 61 79 ........ ...N3.ay > [0030] B3 FC 1B 85 2C 4F 21 E1 8C 7A 36 8B 1D 20 81 83 ....,O!. .z6.. .. > [0040] 55 C5 CB 05 E9 46 A6 B4 1A D1 EF EF 1E D5 AF 86 U....F.. ........ >[2025/04/09 07:02:01.045053, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:02:01.045078, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:02:01.045102, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:02:01.045143, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:02:01.045172, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:02:01.045199, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:02:01.045234, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:02:01.045318, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:02:01.045340, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:02:01.045399, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:02:01.045419, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:02:19.423563, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:02:19.423634, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:02:19.423741, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:02:19.423841, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:02:19.423992, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000060 (96) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:02:19.424215, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:02:19.424352, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:02:19.424387, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:02:19.425046, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:02:19.425127, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000060 (96) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 06 4D ED D1 C1 5C DE 4D 92 B1 A1 8E 87 31 D9 23 .M...\.M .....1.# > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 9D 05 B5 B3 98 18 F5 98 E8 85 83 ED A6 92 26 38 ........ ......&8 > [0030] 5A 73 2B 89 E1 FA 8E 90 83 B1 4D 7A 5B 50 D6 E1 Zs+..... ..Mz[P.. > [0040] 5B 9C 55 60 4F E0 34 84 F2 5D 0D A6 E7 80 31 B8 [.U`O.4. .]....1. >[2025/04/09 07:02:19.425503, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:02:19.425527, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:02:19.425550, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:02:19.425584, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:02:19.425605, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:02:19.425632, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:02:19.425660, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:02:19.425742, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:02:19.425765, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:02:19.425837, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:02:19.425858, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:02:31.059269, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:02:31.059328, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:02:31.059463, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:02:31.059607, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:02:31.059726, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000061 (97) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:02:31.059984, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:02:31.060150, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:02:31.060188, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:02:31.060943, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:02:31.061055, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000061 (97) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] A1 C0 83 3D 44 C2 FF E4 40 D0 AA CB 65 52 11 3D ...=D... @...eR.= > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 58 ED 17 DC A0 37 CD 5F 29 C1 05 45 7E 00 4C 31 X....7._ )..E~.L1 > [0030] 22 E1 43 CC 06 74 69 6A 00 00 00 00 00 00 00 00 ".C..tij ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:02:31.061336, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:02:31.061367, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:02:31.061387, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:02:31.061420, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:02:31.061471, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:02:31.061493, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:02:31.061533, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:02:31.061601, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:02:31.061639, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:02:31.061711, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:02:31.061733, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:02:46.041281, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:02:46.041343, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:02:46.041413, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:02:46.041499, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:02:46.041576, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000062 (98) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:02:46.041808, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:02:46.041910, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:02:46.041939, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:02:46.042646, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:02:46.042738, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000062 (98) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 1E BA 26 D6 2D D8 CA 48 99 AB 59 81 74 1E F5 F6 ..&.-..H ..Y.t... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 4B 0A 52 EC FE 1E BD B4 5F 1E A3 D7 B0 25 6B 7A K.R..... _....%kz > [0030] 54 77 A4 44 31 B0 C5 62 00 00 00 00 00 00 00 00 Tw.D1..b ........ > [0040] 90 2C 5C 7A 00 02 00 00 00 00 00 00 00 00 00 00 .,\z.... ........ >[2025/04/09 07:02:46.043084, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:02:46.043114, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:02:46.043134, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:02:46.043167, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:02:46.043189, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:02:46.043208, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:02:46.043235, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:02:46.043302, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:02:46.043323, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:02:46.043386, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:02:46.043406, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:03:01.065228, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:03:01.065328, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:03:01.065455, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:03:01.065567, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:03:01.065699, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000063 (99) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:03:01.065917, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:03:01.066053, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:03:01.066082, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:03:01.066719, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:03:01.066783, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000063 (99) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 19 EE 6C BD 74 ED 10 B2 71 71 B8 BD 57 80 54 1B ..l.t... qq..W.T. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 04 E6 27 93 5C 00 DF DE 8F E9 34 A6 1B 5D AA 22 ..'.\... ..4..]." > [0030] 4C A5 DE 97 8A 8C 3F E9 B5 5E 4C 6E 14 B7 01 08 L.....?. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:03:01.067126, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:03:01.067150, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:03:01.067169, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:03:01.067207, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:03:01.067228, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:03:01.067256, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:03:01.067295, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:03:01.067380, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:03:01.067403, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:03:01.067462, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:03:01.067482, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:03:16.048530, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:03:16.048587, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:03:16.048710, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:03:16.048853, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:03:16.048980, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000064 (100) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:03:16.049228, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:03:16.049351, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:03:16.049380, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:03:16.050010, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:03:16.050085, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000064 (100) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] F2 DA F0 EC 4F 67 E2 7C 41 EF 69 CA 7B 9A AE BA ....Og.| A.i.{... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 92 B4 AC 9F 18 45 EB 46 1E 17 79 D2 AF 9E D9 FD .....E.F ..y..... > [0030] 4D C0 EE 63 53 07 9E 36 B5 5E 4C 6E 14 B7 01 08 M..cS..6 .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:03:16.050406, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:03:16.050431, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:03:16.050451, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:03:16.050486, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:03:16.050509, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:03:16.050539, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:03:16.050569, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:03:16.050638, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:03:16.050661, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:03:16.050723, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:03:16.050744, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:03:31.090214, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:03:31.090313, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:03:31.090541, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:03:31.090709, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:03:31.090850, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000065 (101) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:03:31.091142, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:03:31.091299, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:03:31.091343, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:03:31.094417, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:03:31.094489, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000065 (101) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] C2 40 61 E5 AE 6E CF F3 7D 1A 9F 29 0A C8 B2 26 .@a..n.. }..)...& > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] EE E3 2F 1F E0 BD 72 71 51 4C 88 CD 2B 06 A3 64 ../...rq QL..+..d > [0030] 20 F4 DC 27 0C AA 6C BD 00 00 00 00 00 00 00 00 ..'..l. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:03:31.094826, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:03:31.094852, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:03:31.094872, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:03:31.094908, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:03:31.094931, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:03:31.094990, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:03:31.095038, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:03:31.095153, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:03:31.095177, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:03:31.095261, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:03:31.095284, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:03:46.064374, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:03:46.064439, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:03:46.064569, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:03:46.064704, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:03:46.064841, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000066 (102) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:03:46.065077, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:03:46.065231, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:03:46.065268, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:03:46.067245, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:03:46.067319, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000066 (102) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 84 9C 15 00 6D 32 9A A2 1B C3 27 E4 27 CD 8B 09 ....m2.. ..'.'... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 37 3E 76 62 2F 95 2D 2D 41 56 6A 01 95 7C D5 52 7>vb/.-- AVj..|.R > [0030] 99 57 6C 16 A8 FD F2 0E B5 5E 4C 6E 14 B7 01 08 .Wl..... .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:03:46.067612, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:03:46.067637, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:03:46.067656, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:03:46.067711, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:03:46.067743, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:03:46.067781, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:03:46.067809, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:03:46.067884, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:03:46.067913, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:03:46.068024, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:03:46.068048, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:04:01.081838, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:04:01.081903, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:04:01.082040, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:04:01.082136, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:04:01.082230, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000067 (103) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:04:01.082425, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:04:01.082536, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:04:01.082565, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:04:01.083532, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:04:01.083586, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000067 (103) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 65 2E DF FF 8A 08 CB 9A 0A FB B0 79 F1 1B 2D 1F e....... ...y..-. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 9B DC A4 D1 89 68 82 93 52 3F A2 50 FA 64 C6 54 .....h.. R?.P.d.T > [0030] 24 A6 98 F1 EA EB 26 0B D8 EA 16 74 00 02 00 00 $.....&. ...t.... > [0040] F8 EA 16 74 00 02 00 00 04 00 00 00 B1 FA 99 13 ...t.... ........ >[2025/04/09 07:04:01.083852, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:04:01.083875, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:04:01.083893, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:04:01.083925, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:04:01.083985, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:04:01.084006, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:04:01.084034, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:04:01.084101, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:04:01.084132, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:04:01.084192, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:04:01.084212, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:04:16.063561, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:04:16.063663, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:04:16.063795, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:04:16.063929, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:04:16.064115, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000068 (104) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:04:16.064357, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:04:16.064478, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:04:16.064508, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:04:16.065150, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:04:16.065223, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000068 (104) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] A1 28 6F C3 F3 76 F4 15 E4 20 92 FE DA 16 DB 86 .(o..v.. . ...... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 9A 25 44 70 1C F9 20 6A C0 AF D2 DE D7 F8 99 C6 .%Dp.. j ........ > [0030] 03 E3 7A 4D 31 6F 6A 0E 00 00 00 00 00 00 00 00 ..zM1oj. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:04:16.065518, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:04:16.065542, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:04:16.065562, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:04:16.065595, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:04:16.065617, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:04:16.065645, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:04:16.065686, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:04:16.065774, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:04:16.065797, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:04:16.065864, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:04:16.065884, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:04:31.083950, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:04:31.084026, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:04:31.084175, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:04:31.084317, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:04:31.084424, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000069 (105) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:04:31.084689, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:04:31.084819, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:04:31.084853, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:04:31.085401, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:04:31.085472, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000069 (105) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] F0 3C 89 7D 0A A5 99 31 47 29 3C 3E 3F 15 10 00 .<.}...1 G)<>?... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 54 13 0F 53 B9 9A ED CC CE 9B C6 11 1D AE 10 0A T..S.... ........ > [0030] 89 7A 37 CF F3 7B 84 DC 00 00 00 00 00 00 00 00 .z7..{.. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:04:31.085768, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:04:31.085797, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:04:31.085818, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:04:31.085852, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:04:31.085876, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:04:31.085905, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:04:31.085936, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:04:31.086054, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:04:31.086079, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:04:31.086144, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:04:31.086166, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:04:49.426249, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:04:49.426393, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:04:49.426567, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:04:49.426687, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:04:49.426831, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000006a (106) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:04:49.427045, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:04:49.427157, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:04:49.427200, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:04:49.427790, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:04:49.427847, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000006a (106) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] D9 D6 3B 9D 15 C4 5F DC F8 AB DC DB 1A 4C 32 38 ..;..._. .....L28 > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 15 96 F9 99 43 64 72 28 AF 50 98 F1 BE 83 E7 BE ....Cdr( .P...... > [0030] 11 5C DE 60 C2 47 63 5F 00 00 00 00 00 00 00 00 .\.`.Gc_ ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:04:49.428169, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:04:49.428192, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:04:49.428211, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:04:49.428243, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:04:49.428264, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:04:49.428287, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:04:49.428321, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:04:49.428421, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:04:49.428444, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:04:49.428512, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:04:49.428532, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:05:01.119646, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:05:01.119714, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:05:01.119855, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:05:01.120041, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:05:01.120184, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000006b (107) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:05:01.120419, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:05:01.120614, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:05:01.120653, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:05:01.121926, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:05:01.122037, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000006b (107) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 7F 17 53 E6 3B 0A A8 EF EE 25 0B BC 64 3F 59 C7 ..S.;... .%..d?Y. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 72 A0 A0 4A C4 E1 A3 7A 4B F7 0B 27 9F 7E 82 2A r..J...z K..'.~.* > [0030] 22 BA C2 91 5A 2A 40 B5 00 00 00 00 00 00 00 00 "...Z*@. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:05:01.122337, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:05:01.122363, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:05:01.122382, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:05:01.122416, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:05:01.122445, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:05:01.122473, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:05:01.122510, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:05:01.122579, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:05:01.122618, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:05:01.122696, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:05:01.122718, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:05:16.068552, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:05:16.068625, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:05:16.068697, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:05:16.068786, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:05:16.068880, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000006c (108) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:05:16.069122, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:05:16.069238, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:05:16.069268, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:05:16.069999, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:05:16.070068, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000006c (108) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] C4 19 18 DC 31 76 F7 4B E4 3B 64 19 44 A4 45 BD ....1v.K .;d.D.E. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] DE E1 1D 7D 72 74 32 01 EF BF E9 41 D9 1D DA 11 ...}rt2. ...A.... > [0030] 4E 26 EF 7E AA 6D A5 9E 00 00 00 00 00 00 00 00 N&.~.m.. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:05:16.070481, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:05:16.070505, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:05:16.070524, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:05:16.070555, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:05:16.070577, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:05:16.070596, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:05:16.070623, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:05:16.070689, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:05:16.070711, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:05:16.070769, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:05:16.070789, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:05:31.103641, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:05:31.103735, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:05:31.103900, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:05:31.104080, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:05:31.104240, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000006d (109) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:05:31.104444, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:05:31.104564, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:05:31.104592, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:05:31.111013, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:05:31.111076, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000006d (109) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] B3 C4 9C E0 3A 51 19 8B 77 67 8A 79 99 1B 0F 5D ....:Q.. wg.y...] > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 1E 3B A6 CB EA C2 EF 5A 24 70 C9 FB EB 94 BB 2F .;.....Z $p...../ > [0030] 09 28 31 E1 7E 01 DB 87 D8 EA 16 74 00 02 00 00 .(1.~... ...t.... > [0040] F8 EA 16 74 00 02 00 00 04 00 00 00 B1 FA 99 13 ...t.... ........ >[2025/04/09 07:05:31.111500, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:05:31.111537, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:05:31.111557, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:05:31.111612, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:05:31.111634, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:05:31.111668, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:05:31.111715, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:05:31.111804, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:05:31.111827, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:05:31.111890, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:05:31.111911, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:05:46.081765, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:05:46.081834, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:05:46.081982, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:05:46.082119, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:05:46.082240, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000006e (110) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:05:46.082436, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:05:46.082540, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:05:46.082578, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:05:46.083438, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:05:46.083513, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000006e (110) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 0B 7D 24 5B 26 5D 1C 00 50 1B 7B EF 23 9F E5 EE .}$[&].. P.{.#... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 3A 1B A6 35 26 F9 36 4D BC F6 9F 9F 4A CB A2 9D :..5&.6M ....J... > [0030] 39 07 82 5C 2D 64 22 2D D8 EA 16 74 00 02 00 00 9..\-d"- ...t.... > [0040] F8 EA 16 74 00 02 00 00 04 00 00 00 B1 FA 99 13 ...t.... ........ >[2025/04/09 07:05:46.083848, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:05:46.083872, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:05:46.083891, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:05:46.083925, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:05:46.083947, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:05:46.083994, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:05:46.084032, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:05:46.084109, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:05:46.084131, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:05:46.084191, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:05:46.084212, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:06:01.106897, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:06:01.106998, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:06:01.107115, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:06:01.107219, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:06:01.107334, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000006f (111) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:06:01.107525, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:06:01.107632, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:06:01.107671, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:06:01.108511, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:06:01.108591, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000006f (111) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 70 0B A2 9C E6 DA B2 71 FE 6C F2 51 13 37 E4 5E p......q .l.Q.7.^ > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 4D 19 26 6C 79 6A C8 2E E8 1E F9 53 FA 48 91 75 M.&lyj.. ...S.H.u > [0030] E9 F7 D1 4E 37 DB 9C E4 00 00 00 00 00 00 00 00 ...N7... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:06:01.108890, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:06:01.108914, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:06:01.108945, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:06:01.109006, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:06:01.109029, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:06:01.109049, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:06:01.109084, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:06:01.109184, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:06:01.109206, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:06:01.109279, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:06:01.109300, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:06:16.088313, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:06:16.088380, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:06:16.088491, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:06:16.088607, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:06:16.088706, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000070 (112) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:06:16.088902, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:06:16.089042, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:06:16.089077, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:06:16.089716, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:06:16.089784, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000070 (112) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 21 06 FA 6F 58 4F C1 56 3E 1A B9 E4 F6 3C 8E 4F !..oXO.V >....<.O > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] A8 78 4E A3 D9 50 A1 A4 2F 44 E0 25 D5 B3 91 36 .xN..P.. /D.%...6 > [0030] B7 C0 A5 57 2E 70 AC 7B B5 5E 4C 6E 14 B7 01 08 ...W.p.{ .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:06:16.090228, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:06:16.090255, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:06:16.090274, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:06:16.090308, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:06:16.090330, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:06:16.090358, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:06:16.090398, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:06:16.090479, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:06:16.090521, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:06:16.090610, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:06:16.090632, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:06:31.093469, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:06:31.093536, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:06:31.093657, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:06:31.093773, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:06:31.093882, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000071 (113) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:06:31.094126, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:06:31.094286, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:06:31.094321, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:06:31.095496, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:06:31.095551, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000071 (113) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] BC AC 86 38 2D 73 76 81 AB 97 B1 2B A9 9F F2 43 ...8-sv. ...+...C > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 8E 9C C6 BF 15 FB 40 B3 12 E6 00 86 7F ED E8 9C ......@. ........ > [0030] 0A AC 50 9A 8E CF 31 7A B5 5E 4C 6E 14 B7 01 08 ..P...1z .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:06:31.095831, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:06:31.095854, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:06:31.095872, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:06:31.095904, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:06:31.095933, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:06:31.095988, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:06:31.096024, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:06:31.096100, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:06:31.096131, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:06:31.096195, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:06:31.096217, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:06:46.097965, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:06:46.098076, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:06:46.098213, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:06:46.098328, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:06:46.098463, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000072 (114) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:06:46.098668, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:06:46.098798, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:06:46.098830, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:06:46.099535, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:06:46.099594, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000072 (114) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 86 95 28 05 38 54 24 8B 07 52 20 50 DB 76 60 9A ..(.8T$. .R P.v`. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] EC C5 57 4A 68 37 6B C6 8F 23 4F 45 CC C3 7C EE ..WJh7k. .#OE..|. > [0030] 08 F7 BB 61 5A 1B 34 47 7B 6F 64 A6 60 3E DB D8 ...aZ.4G {od.`>.. > [0040] 6E EA 43 B1 38 A4 BB C1 15 A3 80 03 91 75 E1 B8 n.C.8... .....u.. >[2025/04/09 07:06:46.099880, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:06:46.099905, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:06:46.099925, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:06:46.100000, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:06:46.100032, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:06:46.100053, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:06:46.100097, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:06:46.100181, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:06:46.100206, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:06:46.100276, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:06:46.100298, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent > >Logs name: log.winbindd.scenario2 >======================== >[2025/04/09 07:30:31.351116, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:31.351326, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:31.351355, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2382516)]: request interface version (version = 32) >[2025/04/09 07:30:31.351584, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382516):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:31.352386, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:30:31.352418, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2382516)]: ping >[2025/04/09 07:30:31.352488, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382516):PING]: delivered response to client >[2025/04/09 07:30:31.355382, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:31.373905, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:31.374032, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:31.374062, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2382523)]: request interface version (version = 32) >[2025/04/09 07:30:31.374110, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382523):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:31.374247, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:31.374275, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2382523)]: request interface version (version = 32) >[2025/04/09 07:30:31.374317, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382523):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:31.374436, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:30:31.374472, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2382523)]: request misc info >[2025/04/09 07:30:31.374516, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382523):INFO]: delivered response to client >[2025/04/09 07:30:31.374622, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:30:31.374653, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2382523)]: request netbios name >[2025/04/09 07:30:31.374694, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382523):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:30:31.374786, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:30:31.374810, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2382523)]: request domain name >[2025/04/09 07:30:31.374848, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382523):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:30:31.374941, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2382523)] Handling async request: DOMAIN_INFO >[2025/04/09 07:30:31.374995, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2382523]: domain_info [ADPROTOCOLX] >[2025/04/09 07:30:31.375041, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2382523):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:30:31.375089, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382523):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:30:31.375188, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2382523)] Handling async request: PING_DC >[2025/04/09 07:30:31.375243, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:31.377834, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:31.377911, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2382523):PING_DC]: NT_STATUS_OK >[2025/04/09 07:30:31.377978, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382523):PING_DC]: delivered response to client >[2025/04/09 07:30:31.381566, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:36.890938, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:36.891130, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:36.891165, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2382630)]: request interface version (version = 32) >[2025/04/09 07:30:36.891226, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382630):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:36.891434, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:36.891459, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2382630)]: request interface version (version = 32) >[2025/04/09 07:30:36.891506, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382630):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:36.891719, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:30:36.891753, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2382630)]: request misc info >[2025/04/09 07:30:36.891802, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382630):INFO]: delivered response to client >[2025/04/09 07:30:36.891925, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:30:36.891950, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2382630)]: request netbios name >[2025/04/09 07:30:36.892029, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382630):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:30:36.892104, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:30:36.892147, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2382630)]: request domain name >[2025/04/09 07:30:36.892190, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382630):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:30:36.892408, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2382630)] Handling async request: DOMAIN_INFO >[2025/04/09 07:30:36.892435, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2382630]: domain_info [ADPROTOCOLX] >[2025/04/09 07:30:36.892463, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2382630):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:30:36.892512, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382630):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:30:36.892654, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2382630)] Handling async request: PING_DC >[2025/04/09 07:30:36.892718, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:36.894968, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:36.895041, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2382630):PING_DC]: NT_STATUS_OK >[2025/04/09 07:30:36.895090, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382630):PING_DC]: delivered response to client >[2025/04/09 07:30:36.895343, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:36.899020, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:36.899099, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:36.899122, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2382631)]: request interface version (version = 32) >[2025/04/09 07:30:36.899177, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2382631):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:36.899390, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2382631)] Handling async request: GETPWUID >[2025/04/09 07:30:36.899425, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2382631)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:30:36.899476, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:30:36.899569, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:30:36.899596, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:36.899629, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:36.905096, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:30:36.905180, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:36.905204, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:30:36.905225, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:30:36.905243, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:36.905265, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:36.909484, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:30:36.909578, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:36.909599, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:36.909621, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:30:36.909639, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:30:36.909676, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:30:36 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:30:36.909726, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:30:36 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:30:36.909766, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:30:36.909786, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:36.909813, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:36.909848, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:36.909881, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:30:36.909914, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:30:36.909939, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:36.909989, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:30:36.910011, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:30:36.910029, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:30:36.910049, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:30:36.910067, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:36.910087, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:36.910106, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:36.910126, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:30:36.910147, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:30:36.910196, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:30:36.910256, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:30:36.910282, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:36.910380, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:30:36.910405, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:30:36.910433, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:30:36.910496, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:30:36.910519, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:30:36.910557, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:36.922846, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:30:36.922887, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:30:36.923010, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:30:36.923031, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:30:36.923066, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:36.923179, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:30:36.923209, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:36.925496, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:30:36.925658, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:36.925773, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:30:36.925791, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:36.925937, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:30:36.926048, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:30:36.926079, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2382631):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:30:36.926138, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2382631):GETPWUID]: delivered response to client >[2025/04/09 07:30:36.926330, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:42.361053, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:42.361267, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:42.361294, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2382653)]: request interface version (version = 32) >[2025/04/09 07:30:42.361345, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382653):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:42.361441, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:42.361464, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2382653)]: request interface version (version = 32) >[2025/04/09 07:30:42.361509, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382653):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:42.361576, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:30:42.361598, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2382653)]: request misc info >[2025/04/09 07:30:42.361651, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382653):INFO]: delivered response to client >[2025/04/09 07:30:42.361711, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:30:42.361733, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2382653)]: request netbios name >[2025/04/09 07:30:42.361775, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382653):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:30:42.361833, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:30:42.361855, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2382653)]: request domain name >[2025/04/09 07:30:42.361903, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382653):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:30:42.361985, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2382653)] Handling async request: DOMAIN_INFO >[2025/04/09 07:30:42.362015, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2382653]: domain_info [ADPROTOCOLX] >[2025/04/09 07:30:42.362045, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2382653):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:30:42.362114, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382653):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:30:42.362200, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2382653)] Handling async request: PING_DC >[2025/04/09 07:30:42.362250, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:42.364613, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:42.364706, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2382653):PING_DC]: NT_STATUS_OK >[2025/04/09 07:30:42.364762, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2382653):PING_DC]: delivered response to client >[2025/04/09 07:30:42.364830, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:42.367912, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:42.368032, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:42.368060, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2382654)]: request interface version (version = 32) >[2025/04/09 07:30:42.368102, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2382654):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:42.368217, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2382654)] Handling async request: GETPWUID >[2025/04/09 07:30:42.368253, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2382654)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:30:42.368277, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:30:42.368325, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:30:42.368350, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:42.368380, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:42.369525, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:30:42.369619, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:42.369656, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:30:42.369679, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:30:42.369709, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:42.369734, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:42.372296, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:30:42.372391, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:42.372414, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:42.372436, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:30:42.372455, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:30:42.372483, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:30:42 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:30:42.372539, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:30:42 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:30:42.372574, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:30:42.372594, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:42.372616, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:42.372656, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:42.372685, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:30:42.372722, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:30:42.372746, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:42.372772, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:30:42.372793, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:30:42.372811, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:30:42.372832, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:30:42.372851, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:42.372871, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:42.372890, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:42.372910, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:30:42.372929, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:30:42.372949, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:30:42.373003, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:30:42.373034, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:42.373125, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:30:42.373145, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:30:42.373167, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:30:42.373200, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:30:42.373222, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:30:42.373248, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:42.376264, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:30:42.376307, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:30:42.376391, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:30:42.376412, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:30:42.376432, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:42.376530, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:30:42.376554, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:42.378643, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:30:42.378802, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:42.378908, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:30:42.378927, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:42.379123, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:30:42.379153, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:30:42.379191, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2382654):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:30:42.379245, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2382654):GETPWUID]: delivered response to client >[2025/04/09 07:30:42.379855, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:43.548286, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:30:43.548363, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:30:43.548385, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:30:43.548418, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:30:43.548441, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:30:43.548463, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:30:46.356308, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:46.356629, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:46.356664, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383027)]: request interface version (version = 32) >[2025/04/09 07:30:46.356723, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383027):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:46.356889, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:30:46.356923, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2383027)]: ping >[2025/04/09 07:30:46.356978, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383027):PING]: delivered response to client >[2025/04/09 07:30:46.358117, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:46.377284, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:46.377378, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:46.377403, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383032)]: request interface version (version = 32) >[2025/04/09 07:30:46.377450, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383032):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:46.378639, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:46.378669, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383032)]: request interface version (version = 32) >[2025/04/09 07:30:46.378725, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383032):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:46.380870, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:30:46.380901, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2383032)]: request misc info >[2025/04/09 07:30:46.380948, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383032):INFO]: delivered response to client >[2025/04/09 07:30:46.382394, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:30:46.382430, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2383032)]: request netbios name >[2025/04/09 07:30:46.382481, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383032):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:30:46.382621, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:30:46.382646, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2383032)]: request domain name >[2025/04/09 07:30:46.382709, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383032):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:30:46.382780, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383032)] Handling async request: DOMAIN_INFO >[2025/04/09 07:30:46.382821, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2383032]: domain_info [ADPROTOCOLX] >[2025/04/09 07:30:46.382851, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383032):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:30:46.382898, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383032):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:30:46.382978, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383032)] Handling async request: PING_DC >[2025/04/09 07:30:46.383036, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:46.385540, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:46.385603, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383032):PING_DC]: NT_STATUS_OK >[2025/04/09 07:30:46.385659, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383032):PING_DC]: delivered response to client >[2025/04/09 07:30:46.388028, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:47.831481, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:47.831609, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:47.831643, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383105)]: request interface version (version = 32) >[2025/04/09 07:30:47.831690, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383105):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:47.831811, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:47.831836, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383105)]: request interface version (version = 32) >[2025/04/09 07:30:47.831874, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383105):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:47.831996, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:30:47.832036, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2383105)]: request misc info >[2025/04/09 07:30:47.832084, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383105):INFO]: delivered response to client >[2025/04/09 07:30:47.832204, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:30:47.832228, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2383105)]: request netbios name >[2025/04/09 07:30:47.832275, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383105):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:30:47.832366, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:30:47.832389, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2383105)]: request domain name >[2025/04/09 07:30:47.832426, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383105):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:30:47.832513, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383105)] Handling async request: DOMAIN_INFO >[2025/04/09 07:30:47.832538, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2383105]: domain_info [ADPROTOCOLX] >[2025/04/09 07:30:47.832575, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383105):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:30:47.832619, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383105):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:30:47.832716, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383105)] Handling async request: PING_DC >[2025/04/09 07:30:47.832767, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:47.835128, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:47.835198, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383105):PING_DC]: NT_STATUS_OK >[2025/04/09 07:30:47.835242, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383105):PING_DC]: delivered response to client >[2025/04/09 07:30:47.836020, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:47.838515, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:47.838599, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:47.838628, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2383106)]: request interface version (version = 32) >[2025/04/09 07:30:47.838676, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2383106):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:47.839001, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2383106)] Handling async request: GETPWUID >[2025/04/09 07:30:47.839065, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2383106)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:30:47.839110, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:30:47.839148, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:30:47.839189, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:47.839215, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:47.840112, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:30:47.840203, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:47.840225, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:30:47.840247, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:30:47.840266, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:47.840289, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:47.842709, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:30:47.842805, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:47.842830, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:47.842852, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:30:47.842871, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:30:47.842899, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:30:47 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:30:47.842986, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:30:47 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:30:47.843045, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:30:47.843066, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:47.843087, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:47.843111, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:47.843138, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:30:47.843159, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:30:47.843182, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:47.843211, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:30:47.843233, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:30:47.843251, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:30:47.843272, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:30:47.843290, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:47.843309, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:47.843328, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:47.843348, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:30:47.843366, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:30:47.843395, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:30:47.843435, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:30:47.843453, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:47.843546, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:30:47.843565, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:30:47.843583, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:30:47.843623, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:30:47.843645, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:30:47.843671, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:47.846574, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:30:47.846612, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:30:47.846698, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:30:47.846718, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:30:47.846753, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:47.846856, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:30:47.846880, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:47.848976, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:30:47.849116, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:47.849223, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:30:47.849253, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:47.849374, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:30:47.849411, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:30:47.849456, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2383106):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:30:47.849505, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2383106):GETPWUID]: delivered response to client >[2025/04/09 07:30:47.849683, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:53.279707, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:53.279870, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:53.279898, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383128)]: request interface version (version = 32) >[2025/04/09 07:30:53.279945, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383128):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:53.280071, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:53.280097, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383128)]: request interface version (version = 32) >[2025/04/09 07:30:53.280142, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383128):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:53.280238, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:30:53.280263, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2383128)]: request misc info >[2025/04/09 07:30:53.280301, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383128):INFO]: delivered response to client >[2025/04/09 07:30:53.280392, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:30:53.280416, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2383128)]: request netbios name >[2025/04/09 07:30:53.280455, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383128):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:30:53.280550, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:30:53.280581, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2383128)]: request domain name >[2025/04/09 07:30:53.280620, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383128):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:30:53.280711, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383128)] Handling async request: DOMAIN_INFO >[2025/04/09 07:30:53.280736, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2383128]: domain_info [ADPROTOCOLX] >[2025/04/09 07:30:53.280765, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383128):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:30:53.280835, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383128):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:30:53.280948, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383128)] Handling async request: PING_DC >[2025/04/09 07:30:53.281007, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:53.283331, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:53.283407, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383128):PING_DC]: NT_STATUS_OK >[2025/04/09 07:30:53.283454, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383128):PING_DC]: delivered response to client >[2025/04/09 07:30:53.284106, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:53.286490, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:53.286563, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:53.286589, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2383129)]: request interface version (version = 32) >[2025/04/09 07:30:53.286630, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2383129):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:53.286723, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2383129)] Handling async request: GETPWUID >[2025/04/09 07:30:53.286751, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2383129)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:30:53.286781, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:30:53.286831, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:30:53.286876, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:53.286901, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:53.287630, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:30:53.287706, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:53.287727, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:30:53.287749, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:30:53.287768, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:53.287790, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:53.291331, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:30:53.291420, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:53.291442, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:53.291464, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:30:53.291484, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:30:53.291512, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:30:53 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:30:53.291555, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:30:53 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:30:53.291599, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:30:53.291620, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:53.291642, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:53.291667, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:53.291698, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:30:53.291720, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:30:53.291743, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:53.291773, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:30:53.291794, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:30:53.291823, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:30:53.291846, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:30:53.291865, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:53.291892, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:53.291917, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:30:53.291938, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:30:53.291997, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:30:53.292023, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:30:53.292056, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:30:53.292086, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:53.292192, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:30:53.292213, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:30:53.292249, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:30:53.292275, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:30:53.292294, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:30:53.292319, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:53.295616, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:30:53.295653, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:30:53.295741, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:30:53.295762, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:30:53.295784, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:53.295895, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:30:53.295921, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:53.303588, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:30:53.303748, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:53.303866, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:30:53.303887, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:30:53.304045, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:30:53.304074, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:30:53.304103, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2383129):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:30:53.304149, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2383129):GETPWUID]: delivered response to client >[2025/04/09 07:30:53.304526, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:58.775833, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:58.776001, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:58.776047, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383178)]: request interface version (version = 32) >[2025/04/09 07:30:58.776101, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383178):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:58.776563, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:58.776592, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383178)]: request interface version (version = 32) >[2025/04/09 07:30:58.776636, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383178):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:58.776736, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:30:58.776762, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2383178)]: request misc info >[2025/04/09 07:30:58.776809, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383178):INFO]: delivered response to client >[2025/04/09 07:30:58.776917, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:30:58.776969, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2383178)]: request netbios name >[2025/04/09 07:30:58.777023, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383178):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:30:58.777121, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:30:58.777147, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2383178)]: request domain name >[2025/04/09 07:30:58.777187, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383178):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:30:58.777283, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383178)] Handling async request: DOMAIN_INFO >[2025/04/09 07:30:58.777311, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2383178]: domain_info [ADPROTOCOLX] >[2025/04/09 07:30:58.777353, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383178):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:30:58.777410, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383178):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:30:58.777527, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383178)] Handling async request: PING_DC >[2025/04/09 07:30:58.777591, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:58.780326, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:58.780401, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383178):PING_DC]: NT_STATUS_OK >[2025/04/09 07:30:58.780451, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383178):PING_DC]: delivered response to client >[2025/04/09 07:30:58.782754, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:30:58.787297, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:30:58.787386, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:30:58.787413, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2383189)]: request interface version (version = 32) >[2025/04/09 07:30:58.787466, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2383189):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:30:58.787566, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2383189)] Handling async request: GETPWUID >[2025/04/09 07:30:58.787650, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2383189)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:30:58.787682, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:30:58.787746, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:30:58.787773, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:58.787805, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:30:58.789663, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:30:58.789755, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:30:58.789778, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:30:58.789800, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:30:58.789821, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:30:58.789845, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:31:01.373978, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:31:01.374136, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:01.374171, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383390)]: request interface version (version = 32) >[2025/04/09 07:31:01.374221, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383390):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:01.374345, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:31:01.374379, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2383390)]: ping >[2025/04/09 07:31:01.374420, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383390):PING]: delivered response to client >[2025/04/09 07:31:01.380488, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:31:01.398590, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:31:01.399600, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:01.399636, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383401)]: request interface version (version = 32) >[2025/04/09 07:31:01.399688, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383401):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:01.399796, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:01.399822, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383401)]: request interface version (version = 32) >[2025/04/09 07:31:01.399865, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383401):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:01.399999, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:31:01.400030, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2383401)]: request misc info >[2025/04/09 07:31:01.400075, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383401):INFO]: delivered response to client >[2025/04/09 07:31:01.400175, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:31:01.400201, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2383401)]: request netbios name >[2025/04/09 07:31:01.400243, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383401):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:31:01.400340, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:31:01.400366, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2383401)]: request domain name >[2025/04/09 07:31:01.400406, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383401):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:31:01.400556, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383401)] Handling async request: DOMAIN_INFO >[2025/04/09 07:31:01.400585, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2383401]: domain_info [ADPROTOCOLX] >[2025/04/09 07:31:01.400645, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383401):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:31:01.400707, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383401):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:31:01.401056, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383401)] Handling async request: PING_DC >[2025/04/09 07:31:01.401121, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:11.808536, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_IO_TIMEOUT >[2025/04/09 07:31:11.808752, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:31:11.808779, 1, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:409(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 07:31:11.808801, 1, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_IO_TIMEOUT >[2025/04/09 07:31:11.808842, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2383189):GETPWUID]: NT_STATUS_IO_TIMEOUT >[2025/04/09 07:31:11.808913, 1, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_IO_TIMEOUT. >[2025/04/09 07:31:11.808949, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2383189):GETPWUID]: delivered response to client >[2025/04/09 07:31:11.809022, 0, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 13.021433 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:30:58.787563] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:31:11.808996] [13.021433] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:30:58.787649] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:31:11.808800] [13.021151] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:258 [2025/04/09 07:30:58.787681] ../../source3/winbindd/wb_xids2sids.c:351 [2025/04/09 07:31:11.808747] [13.021066] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 07:30:58.787740] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:30:58.787741] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:30:58.787746] ../../source3/winbindd/wb_xids2sids.c:193 [2025/04/09 07:30:58.789797] [0.002051] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:30:58.787801] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:30:58.789754] [0.001953] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:30:58.787802] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:30:58.789753] [0.001951] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:30:58.787803] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:30:58.789751] [0.001948] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:30:58.787998] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:30:58.789659] [0.001661] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:30:58.788000] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:30:58.789657] [0.001657] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:30:58.788000] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:30:58.789655] [0.001655] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:30:58.788002] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:30:58.788005] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:30:58.788013] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:30:58.789650] [0.001637] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:30:58.788013] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:30:58.788046] [0.000033] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:30:58.788014] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:30:58.788043] [0.000029] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:30:58.788047] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:30:58.789650] [0.001603] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:30:58.788047] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:30:58.789644] [0.001597] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:30:58.789800] ../../source3/winbindd/wb_xids2sids.c:159 [2025/04/09 07:31:11.808746] [13.018946] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:30:58.789842] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:31:11.808739] [13.018897] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:30:58.789843] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:31:11.808737] [13.018894] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:30:58.789844] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:11.808728] [13.018884] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:30:58.789943] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:11.808521] [13.018578] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:30:58.789945] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:11.808519] [13.018574] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:30:58.789945] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:11.808515] [13.018570] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:30:58.789947] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:30:58.789950] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:30:58.789989] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:11.808509] [13.018520] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:30:58.789989] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:30:58.790018] [0.000029] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:30:58.789990] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:30:58.790016] [0.000026] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:30:58.790020] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:11.808507] [13.018487] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:30:58.790020] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:11.808504] [13.018484] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:31:11.808880] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:31:11.808948] [0.000068] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:11.808881] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:11.808910] [0.000029] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:31:11.811274, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:31:13.551126, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:31:13.551310, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:13.551343, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:31:13.551368, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:13.551393, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:31:13.551416, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:16.997238, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:31:16.997461, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:16.997490, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383760)]: request interface version (version = 32) >[2025/04/09 07:31:16.997555, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383760):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:16.997632, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:16.997668, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383760)]: request interface version (version = 32) >[2025/04/09 07:31:16.997724, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383760):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:16.997788, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:31:16.997812, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2383760)]: request misc info >[2025/04/09 07:31:16.997868, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383760):INFO]: delivered response to client >[2025/04/09 07:31:16.997928, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:31:16.997970, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2383760)]: request netbios name >[2025/04/09 07:31:16.998026, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383760):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:31:16.998087, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:31:16.998110, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2383760)]: request domain name >[2025/04/09 07:31:16.998152, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383760):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:31:16.998277, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383760)] Handling async request: DOMAIN_INFO >[2025/04/09 07:31:16.998324, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2383760]: domain_info [ADPROTOCOLX] >[2025/04/09 07:31:16.998360, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383760):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:31:16.998407, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383760):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:31:16.998468, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383760)] Handling async request: PING_DC >[2025/04/09 07:31:16.998508, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:23.962524, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2377294 matches my id: 1:2377294, type=0x40b >[2025/04/09 07:31:23.962638, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2377300 >[2025/04/09 07:31:23.962698, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! >[2025/04/09 07:31:23.989677, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:23.989780, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383401):PING_DC]: NT_STATUS_OK >[2025/04/09 07:31:23.989843, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383401):PING_DC]: delivered response to client >[2025/04/09 07:31:23.989892, 0, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 22.588817 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:31:01.401053] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:31:23.989870] [22.588817] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 07:31:01.401097] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 07:31:23.989777] [22.588680] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 07:31:01.401101] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 07:31:23.989775] [22.588674] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 07:31:01.401104] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 07:31:23.989773] [22.588669] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:01.401117] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:23.989758] [22.588641] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:01.401185] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:23.989657] [22.588472] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:01.401187] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:31:23.989654] [22.588467] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:31:01.401188] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:31:23.989652] [22.588464] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:01.401194] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:23.989650] [22.588456] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:01.401196] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:01.401197] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:01.401203] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:23.989643] [22.588440] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:01.401204] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:01.401232] [0.000028] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:01.401205] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:01.401230] [0.000025] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:01.401234] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:23.989641] [22.588407] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:01.401235] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:23.989637] [22.588402] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:31:23.989816] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:31:23.989841] [0.000025] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:23.989817] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:23.989835] [0.000018] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:31:23.992722, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:31:24.038078, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:31:24.038191, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:24.038221, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383773)]: request interface version (version = 32) >[2025/04/09 07:31:24.038274, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383773):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:24.038479, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:31:24.038505, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2383773)]: ping >[2025/04/09 07:31:24.038552, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383773):PING]: delivered response to client >[2025/04/09 07:31:24.038698, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:31:24.059004, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:31:24.059097, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:24.059121, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383776)]: request interface version (version = 32) >[2025/04/09 07:31:24.059165, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383776):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:24.059256, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:24.059279, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2383776)]: request interface version (version = 32) >[2025/04/09 07:31:24.059335, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383776):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:24.059429, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:31:24.059452, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2383776)]: request misc info >[2025/04/09 07:31:24.059490, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383776):INFO]: delivered response to client >[2025/04/09 07:31:24.059577, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:31:24.059600, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2383776)]: request netbios name >[2025/04/09 07:31:24.059648, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383776):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:31:24.059747, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:31:24.059770, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2383776)]: request domain name >[2025/04/09 07:31:24.059807, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383776):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:31:24.059897, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383776)] Handling async request: DOMAIN_INFO >[2025/04/09 07:31:24.059922, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2383776]: domain_info [ADPROTOCOLX] >[2025/04/09 07:31:24.059986, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383776):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:31:24.060041, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383776):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:31:24.060137, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2383776)] Handling async request: PING_DC >[2025/04/09 07:31:24.060173, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:24.062751, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:24.062841, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383776):PING_DC]: NT_STATUS_OK >[2025/04/09 07:31:24.062894, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383776):PING_DC]: delivered response to client >[2025/04/09 07:31:24.063638, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:31:30.566585, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2377294 matches my id: 1:2377294, type=0x40b >[2025/04/09 07:31:30.566645, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2377677 >[2025/04/09 07:31:30.566689, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! >[2025/04/09 07:31:30.585929, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:30.586051, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2383760):PING_DC]: NT_STATUS_OK >[2025/04/09 07:31:30.586118, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2383760):PING_DC]: delivered response to client >[2025/04/09 07:31:30.586156, 0, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 13.587680 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:31:16.998466] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:31:30.586146] [13.587680] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 07:31:16.998492] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 07:31:30.586042] [13.587550] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 07:31:16.998496] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 07:31:30.586040] [13.587544] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 07:31:16.998499] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 07:31:30.586039] [13.587540] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:16.998502] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:30.586035] [13.587533] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:16.998542] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:30.585916] [13.587374] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:16.998551] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:31:30.585914] [13.587363] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:31:16.998554] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:31:30.585912] [13.587358] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:16.998567] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:30.585910] [13.587343] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:16.998570] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:16.998576] [0.000006] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:16.998585] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:30.585894] [13.587309] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:16.998586] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:16.998628] [0.000042] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:16.998586] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:16.998626] [0.000040] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:16.998635] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:30.585893] [13.587258] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:16.998637] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:30.585884] [13.587247] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:31:30.586086] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:31:30.586116] [0.000030] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:30.586087] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:30.586110] [0.000023] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:31:30.590891, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:31:30.593202, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:31:30.593286, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:30.593313, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2383968)]: request interface version (version = 32) >[2025/04/09 07:31:30.593359, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2383968):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:30.593475, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2383968)] Handling async request: GETPWUID >[2025/04/09 07:31:30.593506, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2383968)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:31:30.593533, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:31:30.593592, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:31:30.593620, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:31:30.593653, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:31:30.594681, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:31:30.594767, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:31:30.594790, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:31:30.594812, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:31:30.594833, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:31:30.594857, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:31:31.371938, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:31:31.372111, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:31.372139, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384019)]: request interface version (version = 32) >[2025/04/09 07:31:31.372204, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384019):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:31.372826, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:31:31.372859, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2384019)]: ping >[2025/04/09 07:31:31.372918, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384019):PING]: delivered response to client >[2025/04/09 07:31:31.373002, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:31:31.394002, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:31:31.394106, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:31.394132, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384026)]: request interface version (version = 32) >[2025/04/09 07:31:31.394179, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384026):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:31.397143, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:31.397178, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384026)]: request interface version (version = 32) >[2025/04/09 07:31:31.397229, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384026):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:31.400604, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:31:31.400638, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2384026)]: request misc info >[2025/04/09 07:31:31.400684, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384026):INFO]: delivered response to client >[2025/04/09 07:31:31.400829, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:31:31.400856, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2384026)]: request netbios name >[2025/04/09 07:31:31.400909, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384026):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:31:31.401038, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:31:31.401067, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2384026)]: request domain name >[2025/04/09 07:31:31.401109, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384026):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:31:31.401209, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384026)] Handling async request: DOMAIN_INFO >[2025/04/09 07:31:31.401250, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2384026]: domain_info [ADPROTOCOLX] >[2025/04/09 07:31:31.401298, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384026):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:31:31.401354, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384026):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:31:31.401845, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384026)] Handling async request: PING_DC >[2025/04/09 07:31:31.401901, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:31.404590, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:31.404660, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384026):PING_DC]: NT_STATUS_OK >[2025/04/09 07:31:31.404709, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384026):PING_DC]: delivered response to client >[2025/04/09 07:31:31.406769, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:31:35.699809, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 07:31:35.699922, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) > WB command dsgetdcname start. > Search domain name adprotocolx and site name (null). >[2025/04/09 07:31:35.699997, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:31:35.704598, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:31:35.704653, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : * > dc_info: struct netr_DsRGetDCNameInfo > dc_unc : * > dc_unc : '\\windc1.adprotocolx.com' > dc_address : * > dc_address : '\\2001:192::656a:348:28e1:d1' > dc_address_type : DS_ADDRESS_TYPE_INET (1) > domain_guid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > domain_name : * > domain_name : 'adprotocolx.com' > forest_name : * > forest_name : 'adprotocolx.com' > dc_flags : 0xe001f3fd (3758224381) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 1: NBT_SERVER_HAS_DNS_NAME > 1: NBT_SERVER_IS_DEFAULT_NC > 1: NBT_SERVER_FOREST_ROOT > dc_site_name : * > dc_site_name : 'Default-First-Site-Name' > client_site_name : * > client_site_name : 'Default-First-Site-Name' > result : NT_STATUS_OK >[2025/04/09 07:31:35.704973, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) > WB command dsgetdcname for adprotocolx end. >[2025/04/09 07:31:35.705006, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_dsgetdcname.c:158(wb_dsgetdcname_gencache_set) > dcinfo: struct netr_DsRGetDCNameInfo > dc_unc : * > dc_unc : '\\windc1.adprotocolx.com' > dc_address : * > dc_address : '\\2001:192::656a:348:28e1:d1' > dc_address_type : DS_ADDRESS_TYPE_INET (1) > domain_guid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > domain_name : * > domain_name : 'adprotocolx.com' > forest_name : * > forest_name : 'adprotocolx.com' > dc_flags : 0xe001f3fd (3758224381) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 1: NBT_SERVER_HAS_DNS_NAME > 1: NBT_SERVER_IS_DEFAULT_NC > 1: NBT_SERVER_FOREST_ROOT > dc_site_name : * > dc_site_name : 'Default-First-Site-Name' > client_site_name : * > client_site_name : 'Default-First-Site-Name' >[2025/04/09 07:31:35.705257, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[DCINFO/ADPROTOCOLX] and timeout=[Wed Apr 9 08:31:35 AM 2025 EDT] (3600 seconds ahead) >[2025/04/09 07:31:35.705321, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:31:38.744224, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:31:38.744334, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:31:38.744358, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:31:38.744385, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:31:38.744406, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:31:38.744439, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:31:38 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:31:38.744491, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:31:38 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:31:38.744543, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:31:38.744584, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:38.744626, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:31:38.744674, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:38.744713, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:31:38.744745, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:31:38.744775, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:38.744803, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:31:38.744825, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:31:38.744846, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:31:38.744868, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:31:38.744887, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:38.744909, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:31:38.744929, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:31:38.744951, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:31:38.745002, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:31:38.745048, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:31:38.745093, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:31:38.745115, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:38.745227, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:31:38.745256, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:31:38.745278, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:31:38.745325, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:31:38.745357, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:31:38.745409, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:38.756481, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:31:38.756520, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:31:38.756622, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:31:38.756645, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:31:38.756667, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:38.756776, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:31:38.756812, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:38.758625, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:31:38.758774, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:38.758882, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:31:38.758901, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:38.759052, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:31:38.759084, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:31:38.759112, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2383968):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:31:38.759172, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2383968):GETPWUID]: delivered response to client >[2025/04/09 07:31:38.759217, 0, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 8.165727 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:31:30.593472] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:31:38.759199] [8.165727] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:31:30.593505] ../../source3/winbindd/winbindd_getpwuid.c:106 [2025/04/09 07:31:38.759082] [8.165577] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:258 [2025/04/09 07:31:30.593532] ../../source3/winbindd/wb_xids2sids.c:395 [2025/04/09 07:31:38.744541] [8.151009] -> TEVENT_REQ_DONE (2 0)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 07:31:30.593587] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:31:30.593587] [0.000000] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:31:30.593591] ../../source3/winbindd/wb_xids2sids.c:193 [2025/04/09 07:31:30.594809] [0.001218] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:31:30.593649] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:31:30.594766] [0.001117] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:31:30.593650] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:31:30.594765] [0.001115] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:30.593651] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:30.594763] [0.001112] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:30.593758] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:30.594676] [0.000918] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:30.593759] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:30.594675] [0.000916] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:30.593760] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:30.594673] [0.000913] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:30.593761] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:30.593764] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:30.593771] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:30.594669] [0.000898] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:30.593771] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:30.593799] [0.000028] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:30.593772] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:30.593797] [0.000025] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:30.593800] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:30.594668] [0.000868] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:30.593801] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:30.594666] [0.000865] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:31:30.594812] ../../source3/winbindd/wb_xids2sids.c:193 [2025/04/09 07:31:38.744378] [8.149566] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:31:30.594854] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:31:35.699918] [5.105064] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:31:30.594855] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:31:35.699916] [5.105061] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:30.594856] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:35.699907] [5.105051] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:30.594939] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:35.699795] [5.104856] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:30.594940] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:35.699789] [5.104849] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:30.594941] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:35.699780] [5.104839] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:30.594950] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:30.594980] [0.000030] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:30.594986] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:35.699765] [5.104779] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:30.594987] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:30.595013] [0.000026] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:30.594988] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:30.595011] [0.000023] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:30.595014] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:35.699764] [5.104750] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:30.595015] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:35.699747] [5.104732] -> TEVENT_REQ_DONE (2 0)) > [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:31:35.699922] ../../source3/winbindd/wb_dsgetdcname.c:122 [2025/04/09 07:31:35.704972] [0.005050] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:31:35.699988] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:31:35.704966] [0.004978] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:31:35.699990] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:31:35.704965] [0.004975] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:35.699994] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:35.704949] [0.004955] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:35.700073] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:35.704629] [0.004556] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:35.700076] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:31:35.704627] [0.004551] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:31:35.700123] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:31:35.704574] [0.004451] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:35.700130] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:35.704572] [0.004442] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:35.700132] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:35.700133] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:35.700145] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:35.704561] [0.004416] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:35.700146] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:35.700190] [0.000044] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:35.700146] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:35.700188] [0.000042] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:35.700197] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:35.704561] [0.004364] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:35.700198] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:35.704559] [0.004361] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:31:35.705317] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:31:38.744332] [3.039015] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:31:35.705319] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:31:38.744330] [3.039011] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:35.705320] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:38.744327] [3.039007] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:35.705402] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:38.744216] [3.038814] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:35.705403] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:38.744213] [3.038810] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:35.705404] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:38.744210] [3.038806] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:35.705405] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:35.705409] [0.000004] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:35.705414] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:38.744204] [3.038790] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:35.705415] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:35.705441] [0.000026] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:35.705416] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:35.705439] [0.000023] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:35.705443] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:38.744203] [3.038760] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:35.705444] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:38.744199] [3.038755] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:31:38.744385] ../../source3/winbindd/wb_xids2sids.c:111 [2025/04/09 07:31:38.744425] [0.000040] -> TEVENT_REQ_DONE (2 0)) > [struct wb_getpwsid_state] ../../source3/winbindd/wb_getpwsid.c:45 [2025/04/09 07:31:38.744626] ../../source3/winbindd/wb_getpwsid.c:148 [2025/04/09 07:31:38.759050] [0.014424] -> TEVENT_REQ_DONE (2 0)) > [struct wb_queryuser_state] ../../source3/winbindd/wb_queryuser.c:52 [2025/04/09 07:31:38.744673] ../../source3/winbindd/wb_queryuser.c:340 [2025/04/09 07:31:38.758881] [0.014208] -> TEVENT_REQ_DONE (2 0)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 07:31:38.744709] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:31:38.744709] [0.000000] -> TEVENT_REQ_DONE (2 0)) > [struct wb_sids2xids_state] ../../source3/winbindd/wb_sids2xids.c:85 [2025/04/09 07:31:38.744744] ../../source3/winbindd/wb_sids2xids.c:178 [2025/04/09 07:31:38.744864] [0.000120] -> TEVENT_REQ_DONE (2 0)) > [struct wb_lookupsid_state] ../../source3/winbindd/wb_lookupsid.c:44 [2025/04/09 07:31:38.745255] ../../source3/winbindd/wb_lookupsid.c:88 [2025/04/09 07:31:38.756621] [0.011366] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_LookupSid_state] librpc/gen_ndr/ndr_winbind_c.c:335 [2025/04/09 07:31:38.745383] librpc/gen_ndr/ndr_winbind_c.c:401 [2025/04/09 07:31:38.756620] [0.011237] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_LookupSid_r_state] librpc/gen_ndr/ndr_winbind_c.c:248 [2025/04/09 07:31:38.745386] librpc/gen_ndr/ndr_winbind_c.c:282 [2025/04/09 07:31:38.756619] [0.011233] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:38.745405] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:38.756618] [0.011213] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:38.745468] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:38.756512] [0.011044] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:38.745469] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:31:38.756510] [0.011041] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:31:38.745486] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:31:38.756469] [0.010983] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:38.745493] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:38.756467] [0.010974] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:38.745494] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:38.745495] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:38.745509] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:38.756462] [0.010953] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:38.745519] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:38.745552] [0.000033] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:38.745520] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:38.745550] [0.000030] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:38.745564] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:38.756462] [0.010898] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:38.745582] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:38.756460] [0.010878] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_GetNssInfo_state] librpc/gen_ndr/ndr_winbind_c.c:1945 [2025/04/09 07:31:38.756807] librpc/gen_ndr/ndr_winbind_c.c:2007 [2025/04/09 07:31:38.758771] [0.001964] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_GetNssInfo_r_state] librpc/gen_ndr/ndr_winbind_c.c:1861 [2025/04/09 07:31:38.756809] librpc/gen_ndr/ndr_winbind_c.c:1895 [2025/04/09 07:31:38.758770] [0.001961] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:38.756810] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:38.758768] [0.001958] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:38.756978] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:38.758618] [0.001640] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:38.756979] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:38.758617] [0.001638] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:38.756980] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:38.758615] [0.001635] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:38.756982] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:38.756986] [0.000004] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:38.756996] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:38.758610] [0.001614] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:38.756998] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:38.757034] [0.000036] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:38.756999] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:38.757032] [0.000033] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:38.757035] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:38.758610] [0.001575] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:38.757036] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:38.758608] [0.001572] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:31:38.759140] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:31:38.759171] [0.000031] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:38.759141] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:38.759166] [0.000025] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:31:38.763498, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:31:43.552812, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:31:43.552915, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:43.552946, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:31:43.552990, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:43.553010, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:31:43.553033, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:44.216258, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:31:44.216375, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:44.216400, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384117)]: request interface version (version = 32) >[2025/04/09 07:31:44.216454, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384117):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:44.216556, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:44.216579, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384117)]: request interface version (version = 32) >[2025/04/09 07:31:44.216617, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384117):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:44.216718, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:31:44.216742, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2384117)]: request misc info >[2025/04/09 07:31:44.216780, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384117):INFO]: delivered response to client >[2025/04/09 07:31:44.216877, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:31:44.216902, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2384117)]: request netbios name >[2025/04/09 07:31:44.216939, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384117):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:31:44.217057, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:31:44.217081, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2384117)]: request domain name >[2025/04/09 07:31:44.217117, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384117):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:31:44.217205, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384117)] Handling async request: DOMAIN_INFO >[2025/04/09 07:31:44.217231, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2384117]: domain_info [ADPROTOCOLX] >[2025/04/09 07:31:44.217259, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384117):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:31:44.217300, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384117):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:31:44.217391, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384117)] Handling async request: PING_DC >[2025/04/09 07:31:44.217431, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:44.219630, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:44.219721, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384117):PING_DC]: NT_STATUS_OK >[2025/04/09 07:31:44.219769, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384117):PING_DC]: delivered response to client >[2025/04/09 07:31:44.220869, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:31:44.222685, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:31:44.222756, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:44.222793, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2384118)]: request interface version (version = 32) >[2025/04/09 07:31:44.222835, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2384118):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:44.222923, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2384118)] Handling async request: GETPWUID >[2025/04/09 07:31:44.222949, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2384118)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:31:44.222999, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:31:44.223037, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:31:44.223059, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:31:44.223082, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:31:44.223799, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:31:44.223883, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:31:44.223904, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:31:44.223925, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:31:44.223943, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:31:44.223995, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:31:44.226152, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:31:44.226242, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:31:44.226264, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:31:44.226291, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:31:44.226309, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:31:44.226336, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:31:44 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:31:44.226378, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:31:44 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:31:44.226412, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:31:44.226431, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:44.226452, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:31:44.226477, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:44.226503, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:31:44.226525, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:31:44.226547, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:44.226572, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:31:44.226597, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:31:44.226617, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:31:44.226637, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:31:44.226655, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:44.226693, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:31:44.226712, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:31:44.226732, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:31:44.226750, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:31:44.226770, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:31:44.226800, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:31:44.226818, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:44.226909, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:31:44.226929, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:31:44.226947, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:31:44.227001, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:31:44.227022, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:31:44.227051, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:44.229980, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:31:44.230027, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:31:44.230115, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:31:44.230135, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:31:44.230157, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:44.230258, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:31:44.230282, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:44.232018, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:31:44.232174, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:44.232276, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:31:44.232296, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:31:44.232409, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:31:44.232436, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:31:44.232468, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2384118):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:31:44.232513, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2384118):GETPWUID]: delivered response to client >[2025/04/09 07:31:44.232832, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:31:46.388998, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:31:46.389202, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:46.389231, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384331)]: request interface version (version = 32) >[2025/04/09 07:31:46.389283, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384331):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:46.389419, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:31:46.389445, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2384331)]: ping >[2025/04/09 07:31:46.389484, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384331):PING]: delivered response to client >[2025/04/09 07:31:46.391809, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:31:46.418661, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:31:46.418825, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:46.418854, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384343)]: request interface version (version = 32) >[2025/04/09 07:31:46.418922, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384343):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:46.419267, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:31:46.419296, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384343)]: request interface version (version = 32) >[2025/04/09 07:31:46.419338, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384343):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:31:46.419436, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:31:46.419468, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2384343)]: request misc info >[2025/04/09 07:31:46.419510, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384343):INFO]: delivered response to client >[2025/04/09 07:31:46.420010, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:31:46.420042, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2384343)]: request netbios name >[2025/04/09 07:31:46.420087, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384343):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:31:46.420186, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:31:46.420211, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2384343)]: request domain name >[2025/04/09 07:31:46.420251, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384343):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:31:46.420346, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384343)] Handling async request: DOMAIN_INFO >[2025/04/09 07:31:46.420375, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2384343]: domain_info [ADPROTOCOLX] >[2025/04/09 07:31:46.420409, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384343):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:31:46.420470, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384343):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:31:46.420573, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384343)] Handling async request: PING_DC >[2025/04/09 07:31:46.420629, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:46.423126, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:46.423196, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384343):PING_DC]: NT_STATUS_OK >[2025/04/09 07:31:46.423243, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384343):PING_DC]: delivered response to client >[2025/04/09 07:31:46.425101, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:32:01.364217, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:32:01.364390, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:01.364428, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384605)]: request interface version (version = 32) >[2025/04/09 07:32:01.364477, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384605):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:01.364607, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:32:01.364640, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2384605)]: ping >[2025/04/09 07:32:01.364680, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384605):PING]: delivered response to client >[2025/04/09 07:32:01.366511, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:32:01.384781, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:32:01.385796, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:01.385828, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384611)]: request interface version (version = 32) >[2025/04/09 07:32:01.385875, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384611):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:01.386077, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:01.386106, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384611)]: request interface version (version = 32) >[2025/04/09 07:32:01.386147, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384611):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:01.386238, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:32:01.386261, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2384611)]: request misc info >[2025/04/09 07:32:01.386304, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384611):INFO]: delivered response to client >[2025/04/09 07:32:01.386399, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:32:01.386423, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2384611)]: request netbios name >[2025/04/09 07:32:01.386472, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384611):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:32:01.386861, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:32:01.386887, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2384611)]: request domain name >[2025/04/09 07:32:01.386926, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384611):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:32:01.387072, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384611)] Handling async request: DOMAIN_INFO >[2025/04/09 07:32:01.387102, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2384611]: domain_info [ADPROTOCOLX] >[2025/04/09 07:32:01.387151, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384611):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:32:01.387197, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384611):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:32:01.387295, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384611)] Handling async request: PING_DC >[2025/04/09 07:32:01.387353, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:32:01.391162, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:32:01.391228, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384611):PING_DC]: NT_STATUS_OK >[2025/04/09 07:32:01.391272, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384611):PING_DC]: delivered response to client >[2025/04/09 07:32:01.393475, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:32:13.555586, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:32:13.555730, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:32:13.555776, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:32:13.555800, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:32:13.555818, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:32:13.555840, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:32:16.373161, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:32:16.373419, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:16.373454, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384915)]: request interface version (version = 32) >[2025/04/09 07:32:16.373511, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384915):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:16.374313, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:32:16.374344, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2384915)]: ping >[2025/04/09 07:32:16.374390, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384915):PING]: delivered response to client >[2025/04/09 07:32:16.374694, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:32:16.398062, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:32:16.398173, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:16.398220, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384926)]: request interface version (version = 32) >[2025/04/09 07:32:16.398284, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384926):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:16.398733, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:16.398761, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2384926)]: request interface version (version = 32) >[2025/04/09 07:32:16.398807, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384926):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:16.398900, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:32:16.398924, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2384926)]: request misc info >[2025/04/09 07:32:16.398995, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384926):INFO]: delivered response to client >[2025/04/09 07:32:16.399092, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:32:16.399124, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2384926)]: request netbios name >[2025/04/09 07:32:16.399170, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384926):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:32:16.399302, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:32:16.399326, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2384926)]: request domain name >[2025/04/09 07:32:16.399363, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384926):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:32:16.399453, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384926)] Handling async request: DOMAIN_INFO >[2025/04/09 07:32:16.399479, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2384926]: domain_info [ADPROTOCOLX] >[2025/04/09 07:32:16.399539, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384926):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:32:16.399595, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384926):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:32:16.399708, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2384926)] Handling async request: PING_DC >[2025/04/09 07:32:16.399776, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:32:16.403314, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:32:16.403412, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2384926):PING_DC]: NT_STATUS_OK >[2025/04/09 07:32:16.403463, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2384926):PING_DC]: delivered response to client >[2025/04/09 07:32:16.404899, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:32:31.363808, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:32:31.363999, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:31.364036, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2385221)]: request interface version (version = 32) >[2025/04/09 07:32:31.364114, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385221):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:31.364227, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:32:31.364252, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2385221)]: ping >[2025/04/09 07:32:31.364301, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385221):PING]: delivered response to client >[2025/04/09 07:32:31.374751, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:32:31.387782, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:32:31.387868, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:31.387893, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2385227)]: request interface version (version = 32) >[2025/04/09 07:32:31.387936, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385227):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:31.389338, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:31.389370, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2385227)]: request interface version (version = 32) >[2025/04/09 07:32:31.389413, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385227):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:31.389522, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:32:31.389552, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2385227)]: request misc info >[2025/04/09 07:32:31.389596, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385227):INFO]: delivered response to client >[2025/04/09 07:32:31.389698, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:32:31.389738, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2385227)]: request netbios name >[2025/04/09 07:32:31.389816, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385227):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:32:31.390017, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:32:31.390046, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2385227)]: request domain name >[2025/04/09 07:32:31.390090, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385227):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:32:31.390493, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2385227)] Handling async request: DOMAIN_INFO >[2025/04/09 07:32:31.390530, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2385227]: domain_info [ADPROTOCOLX] >[2025/04/09 07:32:31.390578, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2385227):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:32:31.390624, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385227):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:32:31.390726, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2385227)] Handling async request: PING_DC >[2025/04/09 07:32:31.390775, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:32:31.393306, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:32:31.393370, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2385227):PING_DC]: NT_STATUS_OK >[2025/04/09 07:32:31.393415, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385227):PING_DC]: delivered response to client >[2025/04/09 07:32:31.395525, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:32:43.558275, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:32:43.558465, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:32:43.558494, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:32:43.558518, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:32:43.558536, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:32:43.558558, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:32:49.471270, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:32:49.471454, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:49.471481, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2385775)]: request interface version (version = 32) >[2025/04/09 07:32:49.471550, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385775):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:49.471686, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:32:49.471711, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2385775)]: ping >[2025/04/09 07:32:49.471770, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385775):PING]: delivered response to client >[2025/04/09 07:32:49.472990, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:32:49.495428, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:32:49.495537, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:49.495567, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2385784)]: request interface version (version = 32) >[2025/04/09 07:32:49.495611, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385784):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:49.495732, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:32:49.495767, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2385784)]: request interface version (version = 32) >[2025/04/09 07:32:49.495807, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385784):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:32:49.495903, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:32:49.495927, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2385784)]: request misc info >[2025/04/09 07:32:49.495981, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385784):INFO]: delivered response to client >[2025/04/09 07:32:49.496076, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:32:49.496099, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2385784)]: request netbios name >[2025/04/09 07:32:49.496137, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385784):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:32:49.496224, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:32:49.496247, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2385784)]: request domain name >[2025/04/09 07:32:49.496283, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385784):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:32:49.496371, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2385784)] Handling async request: DOMAIN_INFO >[2025/04/09 07:32:49.496397, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2385784]: domain_info [ADPROTOCOLX] >[2025/04/09 07:32:49.496440, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2385784):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:32:49.496484, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385784):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:32:49.496579, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2385784)] Handling async request: PING_DC >[2025/04/09 07:32:49.496649, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:32:49.499578, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:32:49.499644, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2385784):PING_DC]: NT_STATUS_OK >[2025/04/09 07:32:49.499687, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2385784):PING_DC]: delivered response to client >[2025/04/09 07:32:49.500867, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:33:01.364027, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:33:01.364296, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:01.364332, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386017)]: request interface version (version = 32) >[2025/04/09 07:33:01.364388, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386017):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:01.366404, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:33:01.366438, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2386017)]: ping >[2025/04/09 07:33:01.366482, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386017):PING]: delivered response to client >[2025/04/09 07:33:01.367570, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:33:01.392177, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:33:01.392277, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:01.392311, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386023)]: request interface version (version = 32) >[2025/04/09 07:33:01.392364, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386023):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:01.392473, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:01.392499, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386023)]: request interface version (version = 32) >[2025/04/09 07:33:01.392545, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386023):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:01.392639, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:33:01.392664, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2386023)]: request misc info >[2025/04/09 07:33:01.392704, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386023):INFO]: delivered response to client >[2025/04/09 07:33:01.392797, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:33:01.392822, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2386023)]: request netbios name >[2025/04/09 07:33:01.392862, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386023):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:33:01.393000, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:33:01.393030, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2386023)]: request domain name >[2025/04/09 07:33:01.393073, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386023):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:33:01.393168, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2386023)] Handling async request: DOMAIN_INFO >[2025/04/09 07:33:01.393195, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2386023]: domain_info [ADPROTOCOLX] >[2025/04/09 07:33:01.393252, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2386023):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:33:01.393308, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386023):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:33:01.393438, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2386023)] Handling async request: PING_DC >[2025/04/09 07:33:01.393504, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:33:01.396172, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:33:01.396260, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2386023):PING_DC]: NT_STATUS_OK >[2025/04/09 07:33:01.396312, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386023):PING_DC]: delivered response to client >[2025/04/09 07:33:01.397534, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:33:13.560754, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:33:13.560941, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:33:13.560994, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:33:13.561021, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:33:13.561039, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:33:13.561061, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:33:16.397359, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:33:16.397503, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:16.397535, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386338)]: request interface version (version = 32) >[2025/04/09 07:33:16.397583, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386338):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:16.398599, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:33:16.398630, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2386338)]: ping >[2025/04/09 07:33:16.398680, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386338):PING]: delivered response to client >[2025/04/09 07:33:16.400921, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:33:16.419380, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:33:16.419471, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:16.419501, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386351)]: request interface version (version = 32) >[2025/04/09 07:33:16.419550, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386351):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:16.420014, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:16.420045, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386351)]: request interface version (version = 32) >[2025/04/09 07:33:16.420102, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386351):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:16.421016, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:33:16.421049, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2386351)]: request misc info >[2025/04/09 07:33:16.421111, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386351):INFO]: delivered response to client >[2025/04/09 07:33:16.421245, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:33:16.421275, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2386351)]: request netbios name >[2025/04/09 07:33:16.421329, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386351):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:33:16.421420, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:33:16.421444, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2386351)]: request domain name >[2025/04/09 07:33:16.421481, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386351):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:33:16.421600, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2386351)] Handling async request: DOMAIN_INFO >[2025/04/09 07:33:16.421626, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2386351]: domain_info [ADPROTOCOLX] >[2025/04/09 07:33:16.421684, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2386351):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:33:16.421737, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386351):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:33:16.421845, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2386351)] Handling async request: PING_DC >[2025/04/09 07:33:16.421911, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:33:16.424528, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:33:16.424610, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2386351):PING_DC]: NT_STATUS_OK >[2025/04/09 07:33:16.424657, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386351):PING_DC]: delivered response to client >[2025/04/09 07:33:16.425827, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:33:31.398088, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:33:31.398300, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:31.398336, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386647)]: request interface version (version = 32) >[2025/04/09 07:33:31.398408, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386647):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:31.401975, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:33:31.402009, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2386647)]: ping >[2025/04/09 07:33:31.402057, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386647):PING]: delivered response to client >[2025/04/09 07:33:31.410627, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:33:31.431851, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:33:31.431995, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:31.432027, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386660)]: request interface version (version = 32) >[2025/04/09 07:33:31.432075, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386660):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:31.432760, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:31.432790, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386660)]: request interface version (version = 32) >[2025/04/09 07:33:31.432846, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386660):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:31.432955, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:33:31.432984, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2386660)]: request misc info >[2025/04/09 07:33:31.433054, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386660):INFO]: delivered response to client >[2025/04/09 07:33:31.433154, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:33:31.433179, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2386660)]: request netbios name >[2025/04/09 07:33:31.433217, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386660):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:33:31.433307, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:33:31.433331, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2386660)]: request domain name >[2025/04/09 07:33:31.433369, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386660):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:33:31.433486, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2386660)] Handling async request: DOMAIN_INFO >[2025/04/09 07:33:31.433534, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2386660]: domain_info [ADPROTOCOLX] >[2025/04/09 07:33:31.433589, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2386660):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:33:31.433640, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386660):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:33:31.433748, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2386660)] Handling async request: PING_DC >[2025/04/09 07:33:31.433804, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:33:31.439987, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:33:31.440079, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2386660):PING_DC]: NT_STATUS_OK >[2025/04/09 07:33:31.440141, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386660):PING_DC]: delivered response to client >[2025/04/09 07:33:31.443022, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:33:43.563548, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:33:43.564008, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:33:43.564043, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:33:43.564080, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:33:43.564099, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:33:43.564122, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:33:46.395882, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:33:46.396084, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:46.396116, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386954)]: request interface version (version = 32) >[2025/04/09 07:33:46.396179, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386954):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:46.397131, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:33:46.397168, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2386954)]: ping >[2025/04/09 07:33:46.397221, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386954):PING]: delivered response to client >[2025/04/09 07:33:46.398729, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:33:46.418934, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:33:46.420464, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:46.420499, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386963)]: request interface version (version = 32) >[2025/04/09 07:33:46.420552, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386963):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:46.420657, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:33:46.420689, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2386963)]: request interface version (version = 32) >[2025/04/09 07:33:46.420741, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386963):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:33:46.420841, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:33:46.420865, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2386963)]: request misc info >[2025/04/09 07:33:46.420906, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386963):INFO]: delivered response to client >[2025/04/09 07:33:46.421040, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:33:46.421070, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2386963)]: request netbios name >[2025/04/09 07:33:46.421111, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386963):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:33:46.421213, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:33:46.421237, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2386963)]: request domain name >[2025/04/09 07:33:46.421276, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386963):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:33:46.421664, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2386963)] Handling async request: DOMAIN_INFO >[2025/04/09 07:33:46.421694, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2386963]: domain_info [ADPROTOCOLX] >[2025/04/09 07:33:46.421768, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2386963):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:33:46.421815, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386963):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:33:46.421918, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2386963)] Handling async request: PING_DC >[2025/04/09 07:33:46.422004, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:33:46.426329, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:33:46.426397, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2386963):PING_DC]: NT_STATUS_OK >[2025/04/09 07:33:46.426446, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2386963):PING_DC]: delivered response to client >[2025/04/09 07:33:46.430209, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited > >Logs name: log.wb-ADPROTOCOLX.scenario2 >======================== >[2025/04/09 07:30:31.375499, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:31.375589, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:30:31.375729, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:31.375826, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:30:31.375935, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000001a (26) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:31.376180, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:31.376294, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:31.376325, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:31.377054, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:30:31.377121, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000001a (26) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 24 A0 EF 42 55 60 21 44 E2 82 D6 A0 3A C2 5F DC $..BU`!D ....:._. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 79 B6 2B D1 C7 A7 56 D8 C8 14 23 69 33 DF 15 1D y.+...V. ..#i3... > [0030] 1E E5 69 4F D6 0D 69 A1 00 00 00 00 00 00 00 00 ..iO..i. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:31.377403, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:31.377426, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:30:31.377456, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:31.377493, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:30:31.377515, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:31.377535, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:30:31.377565, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:30:31.377637, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:30:31.377659, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:31.377720, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:31.377740, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:30:36.892881, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:36.892949, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:30:36.893062, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:36.893181, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:30:36.893280, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000001b (27) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:36.893458, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:36.893570, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:36.893598, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:36.894182, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:30:36.894245, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000001b (27) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 5F 8B D2 85 AC 50 3F B8 3B 8E 55 B8 59 3B F9 43 _....P?. ;.U.Y;.C > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 44 72 DE AC 38 37 1D 4A CB 47 57 31 CB E8 F3 B5 Dr..87.J .GW1.... > [0030] EB 51 1C 01 C8 58 5B ED 00 00 00 00 00 00 00 00 .Q...X[. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:36.894557, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:36.894581, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:30:36.894599, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:36.894634, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:30:36.894655, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:36.894673, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:30:36.894701, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:30:36.894765, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:30:36.894786, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:36.894842, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:36.894862, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:30:36.910703, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:30:36.910741, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:36.910761, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:30:36.910803, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:36.910881, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:30:36.910936, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:30:36.910983, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:30:36.911004, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:30:36.911030, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:196(winbindd_domain_init_backend) > winbindd_domain_init_backend: Setting ADS methods for domain ADPROTOCOLX >[2025/04/09 07:30:36.911065, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 07:30:36.911098, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 07:30:36.911158, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:30:36.911195, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:30:36.911256, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:30:36.911308, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) > ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 >[2025/04/09 07:30:36.911340, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) > ctdbd_migrate: Sending ctdb packet >[2025/04/09 07:30:36.911492, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:30:36.911554, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:30:36.911585, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:30:36.911631, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:30:36.911650, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:30:36.911736, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 135 >[2025/04/09 07:30:36.912556, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:30:36.913180, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 0, auth_level 1 >[2025/04/09 07:30:36.913216, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0048 (72) > auth_length : 0x0000 (0) > call_id : 0x0000001c (28) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa > if_version : 0x00000003 (3) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:30:36.913452, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:36.913474, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 72 >[2025/04/09 07:30:36.913872, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 44 >[2025/04/09 07:30:36.914015, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x003c (60) > auth_length : 0x0000 (0) > call_id : 0x0000001c (28) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x000010aa (4266) > secondary_address_size : 0x0004 (4) > secondary_address : '135' > _pad1 : DATA_BLOB length=2 > [0000] 00 00 .. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:30:36.914292, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:36.914315, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 60 bytes. >[2025/04/09 07:30:36.914336, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:30:36.914397, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > in: struct epm_Map > object : NULL > map_tower : * > map_tower: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. > [0010] 00 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 0.0.0.0 > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 00000000-0000-0000-0000-000000000000 > max_towers : 0x00000001 (1) >[2025/04/09 07:30:36.914945, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x0000001d (29) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000074 (116) > context_id : 0x0000 (0) > opnum : 0x0003 (3) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:36.915146, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:36.915169, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 140 >[2025/04/09 07:30:36.915905, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 136 >[2025/04/09 07:30:36.915950, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0098 (152) > auth_length : 0x0000 (0) > call_id : 0x0000001d (29) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000080 (128) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=128 > [0000] 00 00 00 00 D7 86 32 9B 1C 21 77 49 A8 60 CB CA ......2. .!wI.`.. > [0010] 7A C9 B4 2D 01 00 00 00 01 00 00 00 00 00 00 00 z..-.... ........ > [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... > [0030] 05 00 13 00 0D 78 57 34 12 34 12 CD AB EF 00 01 .....xW4 .4...... > [0040] 23 45 67 89 AB 00 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] > [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. > [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ > [0070] C2 06 01 00 09 04 00 0A 1C 01 5D 00 00 00 00 00 ........ ..]..... >[2025/04/09 07:30:36.916279, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 152, data_len 128 >[2025/04/09 07:30:36.916300, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:36.916318, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 128 bytes. >[2025/04/09 07:30:36.916375, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > out: struct epm_Map > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 9b3286d7-211c-4977-a860-cbca7ac9b42d > num_towers : * > num_towers : 0x00000001 (1) > towers: ARRAY(1) > towers: struct epm_twr_p_t > twr : * > twr: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. > [0010] 00 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0xc206 (49670) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 10.28.1.93 > result : 0x00000000 (0) >[2025/04/09 07:30:36.916919, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 49670 >[2025/04/09 07:30:36.917536, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:30:36.917648, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : f84a3e6cf7f56e83f9ea355692ec252e > sequence : 0x67f65980 (1744198016) > seed: struct netr_Credential > data : 14a25089396d21ba > client: struct netr_Credential > data : 91793482be92c06e > server: struct netr_Credential > data : 968bde57e92fc9f8 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 07:30:36.918194, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 07:30:36.918240, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 07:30:36.918262, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 07:30:36.918316, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc4eaec0 >[2025/04/09 07:30:36.918356, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4eaec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 07:30:36.918434, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 07:30:36.918533, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x0000001e (30) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345778-1234-abcd-ef00-0123456789ab > if_version : 0x00000000 (0) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 07:30:36.918826, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:36.918848, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 111 >[2025/04/09 07:30:36.919245, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 64 >[2025/04/09 07:30:36.919311, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0050 (80) > auth_length : 0x000c (12) > call_id : 0x0000001e (30) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000bbd (3005) > secondary_address_size : 0x0006 (6) > secondary_address : '49670' > _pad1 : DATA_BLOB length=0 > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 07:30:36.919614, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:36.919637, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 80 bytes. >[2025/04/09 07:30:36.919658, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:30:36.919678, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:30:36.919705, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc4eaec0 >[2025/04/09 07:30:36.919730, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc4eaec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 07:30:36.919766, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3622(cli_rpc_pipe_open_schannel_with_creds) > cli_rpc_pipe_open_schannel_with_creds: opened pipe lsarpc to machine windc2.adprotocolx.com with key netlogon_creds_cli:CLI[GPFSNMBASH/GPFSNMBASH$]/SRV[WINDC2/ADPROTOCOLX] and bound using schannel. >[2025/04/09 07:30:36.919797, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:30:36.919816, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:30:36.919841, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:30:36.919864, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 07:30:36.919885, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=15, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 07:30:36.919987, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:30:36.920023, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:30:36.920042, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:30:36.920059, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:30:36.920080, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:30:36.920127, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 07:30:36.920348, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345778-1234-abcd-ef00-0123456789ab > if_version : 0x00000000 (0) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:30:36.920528, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000001f (31) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000084 (132) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:36.920719, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:36.920795, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:36.920819, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 232 >[2025/04/09 07:30:36.921467, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 07:30:36.921516, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x0000001f (31) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] C4 31 B7 CE 69 0F 3C 11 BE 49 CD 5B D8 04 D4 B5 .1..i.<. .I.[.... > [0010] 7A AC 95 88 46 33 84 A4 5C A7 60 BF 4D 81 2F 7F z...F3.. \.`.M./. > [0020] DA 0E 15 5C BE 84 6A A9 AF 90 AA 45 F1 0F E9 E0 ...\..j. ...E.... > [0030] E9 48 C3 00 57 F1 65 AF 01 81 28 A2 E7 21 B9 80 .H..W.e. ..(..!.. > [0040] 5C BA 66 45 BC F6 EE D0 B5 DE E1 C6 A7 9C 1E E9 \.fE.... ........ > [0050] C4 F2 C4 1A C8 0D 43 07 EA 53 CC 5A EF FC 14 DC ......C. .S.Z.... > [0060] 09 B4 0B C8 16 D8 B7 E8 4C 65 51 6D 86 69 CC FE ........ LeQm.i.. > [0070] 86 2A 70 9F A6 51 CD F1 30 2F 20 1C F0 27 71 DC .*p..Q.. 0/ ..'q. > [0080] 23 35 D0 FF 25 31 3D 67 F0 13 61 70 9F D9 0F 68 #5..%1=g ..ap...h > [0090] D3 E1 EE 7B B6 F0 76 53 F5 34 F3 E3 C4 1B 27 46 ...{..vS .4....'F > [00A0] C6 42 71 69 DA C4 DD A9 76 60 B3 77 1B 93 D4 3B .Bqi.... v`.w...; > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] C8 4C AF AA 97 AC 05 D3 5F 82 E0 C5 12 C5 DD 26 .L...... _......& > [00D0] FA 01 BF 9C 15 F0 B3 56 00 00 00 00 00 00 00 00 .......V ........ > [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:36.921936, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:36.921977, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:30:36.921998, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:36.922031, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 07:30:36.922052, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:36.922071, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 168 bytes. >[2025/04/09 07:30:36.922123, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:30:36.922401, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:30:36.922425, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:30:36.922470, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:35:36 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:30:36.922561, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:35:36 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:30:36.922611, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:30:36.922725, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:36.922746, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:30:42.362395, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:42.362464, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:30:42.362551, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:42.362661, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:30:42.362755, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000020 (32) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:42.362972, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:42.363081, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:42.363110, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:42.363793, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:30:42.363845, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000020 (32) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 90 83 BD F5 4C 3A 64 86 E0 CA 26 6B 9F D5 2B 31 ....L:d. ..&k..+1 > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 29 9E 2D B6 7E 70 5A 26 63 FE 6C 78 E7 BC F2 93 ).-.~pZ& c.lx.... > [0030] 07 26 1E 4C BD FA 94 C9 00 00 00 00 00 00 00 00 .&.L.... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:42.364135, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:42.364159, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:30:42.364178, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:42.364208, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:30:42.364230, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:42.364254, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:30:42.364293, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:30:42.364368, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:30:42.364390, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:42.364450, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:42.364480, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:30:42.373401, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:30:42.373457, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:42.373480, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:30:42.373517, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:42.373570, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:30:42.373615, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:30:42.373650, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:30:42.373669, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:30:42.373688, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 07:30:42.373715, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 07:30:42.373738, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:30:42.373781, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 07:30:42.373928, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000021 (33) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000048 (72) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:42.374159, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:42.374235, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:42.374260, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:42.374937, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 07:30:42.375014, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x00000021 (33) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] 48 6D 9A 65 19 FD 6C AB 82 50 A2 5F 2D FA 8F 9F Hm.e..l. .P._-... > [0010] 3D 9A E0 A3 01 53 A7 65 0F 1D 74 FF 36 A5 19 42 =....S.e ..t.6..B > [0020] 57 AF 04 B7 52 93 AE 19 A2 84 80 D9 ED 6D E8 E0 W...R... .....m.. > [0030] 3B 02 FB 83 86 90 FF 09 BC 0F 06 52 75 7B C2 F6 ;....... ...Ru{.. > [0040] B9 B6 A8 B1 56 CB F0 BC B2 67 A5 A3 80 6D 01 92 ....V... .g...m.. > [0050] E6 74 76 40 46 9B EB 44 92 C1 05 34 E9 06 62 87 .tv@F..D ...4..b. > [0060] 89 25 CB E5 16 9D B2 89 61 2F 7B 9C B8 AB B5 B4 .%...... a/{..... > [0070] 14 43 69 4C A5 81 45 E5 0C 5C E5 29 CC 5B FF BC .CiL..E. .\.).[.. > [0080] F9 2C A0 33 7E 91 A4 B0 5E F2 45 32 8D DB 0C 8A .,.3~... ^.E2.... > [0090] B4 75 DA 4D B8 68 93 C8 84 E6 14 48 88 EF 2B 84 .u.M.h.. ...H..+. > [00A0] BC C7 93 F7 19 76 DF 5F 88 8A 86 FE D6 B4 D0 4A .....v._ .......J > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] 58 88 24 FB FA 50 11 C5 97 59 A5 A3 B6 E4 3F 0A X.$..P.. .Y....?. > [00D0] 36 66 46 71 CA CF 2C D3 00 00 00 00 00 00 00 00 6fFq..,. ........ > [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:42.375415, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:42.375438, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:30:42.375456, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:42.375489, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 07:30:42.375510, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:42.375529, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 168 bytes. >[2025/04/09 07:30:42.375582, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:30:42.375830, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:30:42.375855, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:30:42.375880, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:35:42 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:30:42.375919, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:35:42 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:30:42.375984, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:30:42.376098, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:42.376119, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:30:46.383159, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:46.383227, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:30:46.383317, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:46.383401, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:30:46.383500, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000022 (34) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:46.383677, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:46.383796, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:46.383835, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:46.384792, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:30:46.384860, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000022 (34) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] B4 4C 1F B4 9E 3B EC AF 75 1D A1 7D 74 54 B8 FF .L...;.. u..}tT.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 90 1E 63 ED 5E 90 7C E7 DE 82 8A 88 19 02 3F 99 ..c.^.|. ......?. > [0030] FA C6 13 58 CA 01 F7 4E 0C B1 D0 11 9B A8 00 C0 ...X...N ........ > [0040] 4F D9 2E F5 00 00 00 00 33 05 71 71 BA BE 37 49 O....... 3.qq..7I >[2025/04/09 07:30:46.385151, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:46.385175, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:30:46.385193, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:46.385225, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:30:46.385247, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:46.385266, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:30:46.385293, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:30:46.385357, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:30:46.385379, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:46.385436, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:46.385455, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:30:47.832899, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:47.832947, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:30:47.833049, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:47.833111, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:30:47.833213, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000023 (35) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:47.833397, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:47.833492, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:47.833521, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:47.834258, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:30:47.834344, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000023 (35) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 5C 80 F6 CE 36 1E B3 0C E2 31 B7 23 F6 5D D6 F3 \...6... .1.#.].. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] F0 66 EB 83 00 33 86 46 32 F9 4C 52 F0 E7 AE 79 .f...3.F 2.LR...y > [0030] C4 53 04 47 8C 35 0B F1 00 00 00 00 00 00 00 00 .S.G.5.. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:47.834629, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:47.834652, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:30:47.834670, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:47.834710, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:30:47.834744, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:47.834764, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:30:47.834791, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:30:47.834863, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:30:47.834884, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:47.834941, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:47.834996, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:30:47.843838, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:30:47.843884, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:47.843907, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:30:47.843946, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:47.844056, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:30:47.844094, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:30:47.844116, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:30:47.844134, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:30:47.844153, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 07:30:47.844173, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 07:30:47.844195, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:30:47.844227, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 07:30:47.844371, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000024 (36) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000048 (72) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:47.844569, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:47.844645, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:47.844671, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:47.845307, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 07:30:47.845369, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x00000024 (36) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] 1F F5 7D 87 1F B9 FC F3 BA 02 98 7E 43 6D C9 0C ..}..... ...~Cm.. > [0010] 84 00 B8 47 7C 7D E8 D3 62 42 EF 97 CE 0A 5B DC ...G|}.. bB....[. > [0020] 25 13 60 0A 6E 27 05 1D 2B F7 8D 8C 0B 72 31 6D %.`.n'.. +....r1m > [0030] 25 37 60 C0 92 E8 EF 6A C5 BF 13 4E 8D A8 C1 FF %7`....j ...N.... > [0040] D8 F7 12 F8 0E 97 44 51 D3 E2 70 2D F1 90 58 A4 ......DQ ..p-..X. > [0050] 15 3F 0E 82 DE DD B1 4B 68 F3 9F B3 BD AC C8 58 .?.....K h......X > [0060] D0 71 81 50 95 4E 4A 93 41 26 A2 40 39 5D E7 39 .q.P.NJ. A&.@9].9 > [0070] 55 00 C6 DF C2 08 30 98 0F D7 D8 E6 27 41 49 D0 U.....0. ....'AI. > [0080] 82 2F CE 7E AF 7F CC 8C 16 86 86 AC A1 5B 29 72 ./.~.... .....[)r > [0090] 2E 16 62 AA A0 0C 78 DD A0 B9 13 A4 36 25 07 08 ..b...x. ....6%.. > [00A0] 65 8D 03 88 F6 6C 87 C3 50 63 6D 44 0A DC E0 0D e....l.. PcmD.... > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] 03 1B EE E6 B0 CB 3E D6 C6 19 D3 BF 40 1D 95 5C ......>. ....@..\ > [00D0] 51 D3 F1 91 23 65 BE 7B 00 00 00 00 00 00 00 00 Q...#e.{ ........ > [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:47.845820, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:47.845843, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:30:47.845861, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:47.845895, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 07:30:47.845916, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:47.845935, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 168 bytes. >[2025/04/09 07:30:47.845992, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:30:47.846242, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:30:47.846267, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:30:47.846293, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:35:47 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:30:47.846333, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:35:47 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:30:47.846372, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:30:47.846457, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:47.846477, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:30:53.281150, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:53.281200, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:30:53.281261, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:53.281327, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:30:53.281407, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000025 (37) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:53.281600, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:53.281692, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:53.281728, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:53.282476, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:30:53.282572, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000025 (37) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] B7 6D 55 47 E5 F7 0F C1 88 90 76 39 51 DC FA AE .mUG.... ..v9Q... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 9D 4E 49 4E A0 F6 DB 0B 49 1B 1D A2 87 D1 5E D4 .NIN.... I.....^. > [0030] D8 63 DE A7 E7 09 A6 14 DE 06 37 B7 87 C8 2F 60 .c...... ..7.../` > [0040] 81 43 46 D6 30 04 D0 93 3B 60 AA 07 65 62 F9 43 .CF.0... ;`..eb.C >[2025/04/09 07:30:53.282854, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:53.282883, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:30:53.282902, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:53.282937, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:30:53.282987, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:53.283010, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:30:53.283043, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:30:53.283116, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:30:53.283143, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:53.283202, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:53.283222, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:30:53.292446, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:30:53.292482, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:53.292524, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:30:53.292568, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:30:53.292620, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:30:53.292645, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:30:53.292669, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:30:53.292689, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:30:53.292708, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 07:30:53.292728, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 07:30:53.292766, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:30:53.292834, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 07:30:53.293069, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000026 (38) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000048 (72) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:53.293278, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:53.293360, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:53.293389, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:53.294350, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 07:30:53.294423, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x00000026 (38) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] 90 51 B5 55 11 2A 8F B7 82 14 C4 EB 94 10 EC 60 .Q.U.*.. .......` > [0010] 26 38 57 F8 0A 47 E2 05 F4 6F 84 B5 BA A3 1B B5 &8W..G.. .o...... > [0020] 81 04 FE 6A F0 28 6D 78 47 CC 2C 21 B7 FE 80 20 ...j.(mx G.,!... > [0030] 62 23 14 18 07 6C 17 28 39 81 8B D2 69 E3 A1 EA b#...l.( 9...i... > [0040] 24 FE 18 23 EA 9E C3 64 E5 B7 93 02 30 65 7E 91 $..#...d ....0e~. > [0050] B9 BF 01 7E 5F 1D 31 4B A7 85 43 4C 86 4B 80 84 ...~_.1K ..CL.K.. > [0060] 65 84 96 54 D0 AF A0 1D A5 13 F8 19 93 C5 55 41 e..T.... ......UA > [0070] D0 ED 19 D0 DF FE 86 95 55 D0 4D F8 D9 46 19 9A ........ U.M..F.. > [0080] B8 5E F6 D8 53 F3 5E 2A 41 D9 6A CF 73 0D 8F 51 .^..S.^* A.j.s..Q > [0090] 39 EF 4B D5 56 66 5D CC CF A9 24 DC 91 71 F2 E6 9.K.Vf]. ..$..q.. > [00A0] AC 79 57 D2 7F F0 7D B8 3D 3A EC 07 E6 D2 DE C6 .yW...}. =:...... > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] 7A 29 C6 33 2C 9C DF FA EC 2A 0B B7 46 62 22 82 z).3,... .*..Fb". > [00D0] 9F CD B5 E3 2F D8 61 40 00 00 00 00 00 00 00 00 ..../.a@ ........ > [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:53.294858, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:53.294882, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:30:53.294901, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:53.294941, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 07:30:53.294987, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:53.295009, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 168 bytes. >[2025/04/09 07:30:53.295045, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:30:53.295288, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:30:53.295312, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:30:53.295338, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:35:53 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:30:53.295380, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:35:53 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:30:53.295415, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:30:53.295513, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:53.295535, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:30:58.777759, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:30:58.777824, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:30:58.777926, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:30:58.778056, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:30:58.778203, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000027 (39) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:30:58.778475, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:30:58.778612, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:30:58.778648, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:30:58.779432, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:30:58.779507, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000027 (39) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] F1 3D 2A ED 5C 23 69 06 56 B0 D8 2D 32 E7 4D F3 .=*.\#i. V..-2.M. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] ED DB 4F 32 3D 5F FE 06 DF F0 14 F4 F0 EA B8 52 ..O2=_.. .......R > [0030] 47 B1 8C 08 B7 61 B9 E7 B5 5E 4C 6E 14 B7 01 08 G....a.. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:30:58.779792, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:30:58.779819, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:30:58.779840, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:30:58.779875, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:30:58.779921, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:30:58.779945, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:30:58.780009, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:30:58.780103, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:30:58.780141, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:30:58.780206, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:30:58.780231, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:31:01.401290, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:01.401335, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:31:01.401459, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:01.401565, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:31:01.401675, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000028 (40) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:01.401891, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:01.402085, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:31:01.402133, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:31:11.412157, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) > cli_api_pipe failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 07:31:11.412368, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 10000 (ms) to 1000 (ms). >[2025/04/09 07:31:11.412477, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 1000 (ms) to 500 (ms). >[2025/04/09 07:31:11.412508, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 500 (ms) to 500 (ms). >[2025/04/09 07:31:11.412728, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:31:11.913579, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1946(connection_ok) > connection_ok: Connection to windc2.adprotocolx.com for domain ADPROTOCOLX is not connected >[2025/04/09 07:31:11.913674, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1760(cm_open_connection) > Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. >[2025/04/09 07:31:11.913702, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1767(cm_open_connection) > Attempt 0/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 07:31:11.913736, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1528(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 07:31:11.913839, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX" domain >[2025/04/09 07:31:11.913881, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc2.adprotocolx.com >[2025/04/09 07:31:11.913901, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1439(connect_preferred_dc) > connect_preferred_dc: saf_servername is 'windc2.adprotocolx.com' for domain ADPROTOCOLX >[2025/04/09 07:31:11.913935, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:31:11.913987, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:31:11.914027, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:31:11.914068, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:11.914102, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. >[2025/04/09 07:31:11.914183, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.93'. >[2025/04/09 07:31:11.914218, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: adprotocolx.com) >[2025/04/09 07:31:16.998822, 4, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:16.999022, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:31:16.999293, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:16.999591, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:31:16.999710, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:31:16.999977, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000008 (8) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000088 (136) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:17.000370, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:17.000494, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:31:17.000534, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 232 >[2025/04/09 07:31:17.916942, 2, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/cldap.c:417(ads_cldap_netlogon) > ads_cldap_netlogon: did not get a reply >[2025/04/09 07:31:17.917074, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:387(ads_try_connect) > ads_try_connect: ads_cldap_netlogon_5(10.28.1.93, adprotocolx.com) failed. >[2025/04/09 07:31:17.917121, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:32:17 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 07:31:17.917340, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX (windc2.adprotocolx.com) to failed conn cache >[2025/04/09 07:31:17.917368, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) >[2025/04/09 07:31:17.917390, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) >[2025/04/09 07:31:17.917416, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [ADPROTOCOLX] >[2025/04/09 07:31:17.917437, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:32:17 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 07:31:17.917473, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain adprotocolx.com (windc2.adprotocolx.com) to failed conn cache >[2025/04/09 07:31:17.917495, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 07:31:17.917527, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 07:31:17.917554, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [adprotocolx.com] >[2025/04/09 07:31:17.917576, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1539(find_dc) > Retrieving a list of IP addresses for DCs. >[2025/04/09 07:31:17.917608, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 07:31:17.917630, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) > ads_dc_name: domain=ADPROTOCOLX >[2025/04/09 07:31:17.917686, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 07:31:17.917712, 6, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) > resolve_and_ping_dns: (cldap) looking for realm 'adprotocolx.com' >[2025/04/09 07:31:17.917736, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) >[2025/04/09 07:31:17.917767, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 07:31:17.917791, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:31:17.917811, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) >[2025/04/09 07:31:17.917844, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 07:31:17.917879, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:17.917900, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:17.917925, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:17.917947, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:17.918011, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:17.918036, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:17.918068, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:17.918091, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.918126, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:17.918151, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:17.918169, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.918197, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:17.918244, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:17.918270, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:17.918293, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:17.918317, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:17.918342, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.918375, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) > cldap_ping_list: Try to create 6 netlogon connections for domain 'adprotocolx.com' (provided count of addresses was 6). >[2025/04/09 07:31:17.919913, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f3fd (127997) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc1.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC1' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:31:17.920348, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:31:17.920376, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478522 seconds ahead) >[2025/04/09 07:31:17.920419, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:31:17.920439, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478522 seconds ahead) >[2025/04/09 07:31:17.920472, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) > cldap_ping_list: realm[adprotocolx.com]: selected 10.28.1.92 => windc1.adprotocolx.com >[2025/04/09 07:31:17.920491, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) > cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f3fd (127997) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc1.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC1' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:31:17.920801, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.92 >[2025/04/09 07:31:17.920827, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 07:31:17.920850, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:31:17.920896, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX >[2025/04/09 07:31:17.920921, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 07:31:17.920953, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:31:17.921040, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:31:17.921073, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 07:31:17.921167, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 07:31:17.921326, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:31:17.921363, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 07:31:17.921453, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 13 88 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 07:31:17.922995, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 13 88 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 07:31:17.923374, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 07:31:17.923402, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 07:31:17.923422, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.923441, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 07:31:17.923459, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 07:31:17.923476, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:17.923496, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:17.923547, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:17.923571, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:17.923593, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:17.923615, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.923637, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:17.923664, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:17.923687, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:17.923705, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:17.923724, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:17.923752, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:17.923775, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:31:17.923797, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 07:31:17.923818, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:31:17.923837, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) >[2025/04/09 07:31:17.923869, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 07:31:17.923887, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 07:31:17.923937, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:31:17.923959, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 07:31:17.924042, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 64 3C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 d<...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 07:31:17.924496, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 64 3C 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 d<...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s > [0100] D0 D7 81 C8 0F 00 ...... >[2025/04/09 07:31:17.924785, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 07:31:17.924809, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 07:31:17.924828, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:17.924846, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 07:31:17.924864, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 07:31:17.924882, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.924901, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.924943, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:17.924984, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:17.925016, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:17.925039, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:17.925061, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:17.925081, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:17.925102, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.925125, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:17.925144, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:17.925161, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:17.925188, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:31:17.925234, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:31:18.127345, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f3fd (127997) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc1.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC1' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:31:20.927177, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.92 > kdc = [2001:192::656a:348:28e1:d1]:88 > >[2025/04/09 07:31:20.927603, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.92 > kdc = [2001:192::656a:348:28e1:d1]:88 > >[2025/04/09 07:31:20.927673, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) > ads_dc_name: using server='WINDC1.ADPROTOCOLX.COM' IP=10.28.1.92 >[2025/04/09 07:31:20.927765, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" >[2025/04/09 07:31:20.927792, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) >[2025/04/09 07:31:20.927822, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 07:31:20.927857, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:31:20.927881, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) >[2025/04/09 07:31:20.927910, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 07:31:20.927950, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:20.928012, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:20.928040, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:20.928068, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:20.928109, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.928144, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:20.928182, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:20.928205, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.928224, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:20.928244, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:20.928262, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.928303, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:31:20.928328, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:31:20.928359, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:31:20.928400, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:31:20.928429, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.928454, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.928474, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename NULL) >[2025/04/09 07:31:20.928497, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 07:31:20.928518, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:31:20.928537, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#1c (sitename (null)) >[2025/04/09 07:31:20.928561, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name adprotocolx.com#1C found. >[2025/04/09 07:31:20.928589, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:20.928626, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:20.928651, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:20.928673, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:20.928695, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.928717, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:20.928738, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:20.928760, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.928779, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:20.928798, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:20.928821, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.928847, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:31:20.928870, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:31:20.928892, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:31:20.928914, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:31:20.928936, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.928996, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.929021, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1543(find_dc) > Retrieved IP addresses for 6 DCs. >[2025/04/09 07:31:20.929058, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1564(find_dc) > Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). >[2025/04/09 07:31:20.929165, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 445 >[2025/04/09 07:31:20.930596, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1579(find_dc) > Successfully connected to DC '10.28.1.92'. >[2025/04/09 07:31:20.930651, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. >[2025/04/09 07:31:20.930683, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.92'. >[2025/04/09 07:31:20.930708, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: adprotocolx.com) >[2025/04/09 07:31:20.931526, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f3fd (127997) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc1.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC1' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:31:20.931895, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:31:20.931923, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478519 seconds ahead) >[2025/04/09 07:31:20.932002, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:31:20.932025, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478519 seconds ahead) >[2025/04/09 07:31:20.932063, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.92 >[2025/04/09 07:31:20.932088, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc1.adprotocolx.com#20: 10.28.1.92 >[2025/04/09 07:31:20.932113, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC1.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:42:20 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 07:31:20.932146, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1134(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f3fd >[2025/04/09 07:31:20.932166, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:31:20.932188, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:31:20.932242, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX >[2025/04/09 07:31:20.932270, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 07:31:20.932310, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:31:20.932330, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:31:20.932352, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 07:31:20.932373, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 07:31:20.932459, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:31:20.932484, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 07:31:20.932550, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 9A 81 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 07:31:20.933293, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 9A 81 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... > [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. > [0120] D7 81 C8 0F 00 ..... >[2025/04/09 07:31:20.933631, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 07:31:20.933664, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 07:31:20.933686, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.933706, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 07:31:20.933724, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 07:31:20.933743, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.933764, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.933808, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:20.933833, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:20.933857, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:20.933879, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.933901, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:20.933923, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:20.933944, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.934006, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:20.934029, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:20.934048, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.934071, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:31:20.934095, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "adprotocolx.com" domain >[2025/04/09 07:31:20.934116, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:31:20.934141, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) >[2025/04/09 07:31:20.934163, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 07:31:20.934183, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 07:31:20.934237, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:31:20.934259, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 07:31:20.934329, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 92 6A 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .j...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 07:31:20.934886, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 92 6A 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .j...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej > [0100] 03 48 28 E1 00 D1 .H(... >[2025/04/09 07:31:20.935190, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 07:31:20.935216, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 07:31:20.935235, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.935255, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 07:31:20.935286, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 07:31:20.935307, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.935342, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.935387, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:20.935411, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:20.935434, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:20.935456, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:20.935478, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:20.935500, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:20.935521, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.935540, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:20.935560, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:20.935578, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:20.935600, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:31:20.935623, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:31:21.036753, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f3fd (127997) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc1.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC1' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:31:23.936149, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.92 > kdc = [2001:192::656a:348:28e1:d1]:88 > >[2025/04/09 07:31:23.936415, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.92 > kdc = [2001:192::656a:348:28e1:d1]:88 > >[2025/04/09 07:31:23.936503, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc1.adprotocolx.com], expire = [1744199183] >[2025/04/09 07:31:23.936535, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:46:23 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:31:23.936584, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [adprotocolx.com], server = [windc1.adprotocolx.com], expire = [1744199183] >[2025/04/09 07:31:23.936605, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:46:23 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:31:23.936635, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1168(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92' is 'windc1.adprotocolx.com' >[2025/04/09 07:31:23.936662, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc1.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 07:31:23.936922, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 20000 (ms) to 10000 (ms). >[2025/04/09 07:31:23.937068, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:31:23.939271, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:857(cm_prepare_connection) > connecting to windc1.adprotocolx.com (ADPROTOCOLX, adprotocolx.com) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] >[2025/04/09 07:31:23.939358, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc1.adprotocolx.com >[2025/04/09 07:31:23.939523, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] >[2025/04/09 07:31:23.939599, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939515: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:31:23.940806, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939517: Sending unauthenticated request >[2025/04/09 07:31:23.940864, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939518: Sending request (182 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:31:23.941501, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939519: Sending initial UDP request to dgram 10.28.1.92:88 >[2025/04/09 07:31:23.943909, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939520: Received answer (219 bytes) from dgram 10.28.1.92:88 >[2025/04/09 07:31:23.943992, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939521: Response was from master KDC >[2025/04/09 07:31:23.944037, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939522: Received error from KDC: -1765328359/Additional pre-authentication required >[2025/04/09 07:31:23.944088, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939525: Preauthenticating using KDC method data >[2025/04/09 07:31:23.944116, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939526: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) >[2025/04/09 07:31:23.944152, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939527: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:31:23.947996, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939528: AS key obtained for encrypted timestamp: aes256-cts/C8D8 >[2025/04/09 07:31:23.948107, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939530: Encrypted timestamp (for 1744209082.486206): plain 301AA011180F32303235303430393134333132325AA1050203076B3E, encrypted BBA77B0BC1F3943B1D39DF45ED76BEC8C0C2BB4F27B42D948B8EC68818A48D79E0D814D67A78B3247FC7949D187599C8951AA97E27DE4BBC >[2025/04/09 07:31:23.948143, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939531: Preauth module encrypted_timestamp (2) (real) returned: 0/Success >[2025/04/09 07:31:23.948167, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939532: Produced preauth for next request: PA-ENC-TIMESTAMP (2) >[2025/04/09 07:31:23.948206, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939533: Sending request (261 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:31:23.948270, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939534: Sending initial UDP request to dgram 10.28.1.92:88 >[2025/04/09 07:31:23.950310, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939535: Received answer (102 bytes) from dgram 10.28.1.92:88 >[2025/04/09 07:31:23.950384, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939536: Response was from master KDC >[2025/04/09 07:31:23.950420, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939537: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP >[2025/04/09 07:31:23.950446, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939538: Request or response is too big for UDP; retrying with TCP >[2025/04/09 07:31:23.950479, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939539: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) >[2025/04/09 07:31:23.950538, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939540: Initiating TCP connection to stream 10.28.1.92:88 >[2025/04/09 07:31:23.951120, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939541: Sending TCP request to stream 10.28.1.92:88 >[2025/04/09 07:31:23.952359, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939542: Received answer (1596 bytes) from stream 10.28.1.92:88 >[2025/04/09 07:31:23.952413, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939543: Terminating TCP connection to stream 10.28.1.92:88 >[2025/04/09 07:31:23.952493, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939544: Response was from master KDC >[2025/04/09 07:31:23.952547, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939545: Processing preauth types: PA-ETYPE-INFO2 (19) >[2025/04/09 07:31:23.952583, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939546: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:31:23.952620, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939547: Produced preauth for next request: (empty) >[2025/04/09 07:31:23.952648, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939548: AS key determined by preauth: aes256-cts/C8D8 >[2025/04/09 07:31:23.952743, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939549: Decrypted AS reply; session key is: aes256-cts/E772 >[2025/04/09 07:31:23.952783, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939550: FAST negotiation: unavailable >[2025/04/09 07:31:23.952929, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:31:23.953039, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939551: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:31:23.953084, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377300] 1744198283.939552: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect >[2025/04/09 07:31:23.953120, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc1.adprotocolx.com using Kerberos >[2025/04/09 07:31:23.953143, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) > cli_session_setup_spnego_send: Connect to windc1.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO >[2025/04/09 07:31:23.953409, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 07:31:23.953500, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 07:31:23.958200, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55bdbc4f8610]: subreq: 0x55bdbc4eaec0 >[2025/04/09 07:31:23.958243, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55bdbc4fb000]: subreq: 0x55bdbc551ae0 >[2025/04/09 07:31:23.958280, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55bdbc4f8610]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4eaec0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906] >[2025/04/09 07:31:23.958352, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc551ae0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55bdbc551cc0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] >[2025/04/09 07:31:23.960282, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55bdbc4f8610]: subreq: 0x55bdbc542e40 >[2025/04/09 07:31:23.960340, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55bdbc4fb000]: subreq: 0x55bdbc551ae0 >[2025/04/09 07:31:23.960368, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55bdbc4f8610]: NT_STATUS_OK tevent_req[0x55bdbc542e40/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55bdbc543020)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913] >[2025/04/09 07:31:23.960444, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc551ae0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55bdbc551cc0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] >[2025/04/09 07:31:23.960638, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:31:23.961037, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc1.adprotocolx.com], expire = [1744199183] >[2025/04/09 07:31:23.961071, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:46:23 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:31:23.961115, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [adprotocolx.com], server = [windc1.adprotocolx.com], expire = [1744199183] >[2025/04/09 07:31:23.961137, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:46:23 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:31:23.961207, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) > set_domain_online: called for domain ADPROTOCOLX >[2025/04/09 07:31:23.961495, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:23.961883, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) > messaging_dgm_send: Sending message to 2377294 >[2025/04/09 07:31:23.961936, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403285364 seconds ahead) >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:31:23.962209, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=18, srvid=0 >[2025/04/09 07:31:23.962750, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=17, vnn=4026531841, opcode=4, srvid=0 >[2025/04/09 07:31:23.962850, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=18, vnn=4026531841, opcode=149, srvid=0 >[2025/04/09 07:31:23.963067, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) > db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b >[2025/04/09 07:31:23.964095, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:31:23.964134, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:31:23.964172, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:23.964256, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) > ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 >[2025/04/09 07:31:23.964295, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) > ctdbd_migrate: Sending ctdb packet >[2025/04/09 07:31:23.964820, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:23.964880, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:23.964912, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:31:23.964943, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:31:23.964995, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:31:23.965107, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 135 >[2025/04/09 07:31:23.965804, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:31:23.966749, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 >[2025/04/09 07:31:23.966799, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0048 (72) > auth_length : 0x0000 (0) > call_id : 0x00000029 (41) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa > if_version : 0x00000003 (3) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:23.968101, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.968130, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 72 >[2025/04/09 07:31:23.968510, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 44 >[2025/04/09 07:31:23.968605, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x003c (60) > auth_length : 0x0000 (0) > call_id : 0x00000029 (41) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00001041 (4161) > secondary_address_size : 0x0004 (4) > secondary_address : '135' > _pad1 : DATA_BLOB length=2 > [0000] 38 00 8. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:23.968901, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.968925, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. >[2025/04/09 07:31:23.968949, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:31:23.969080, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > in: struct epm_Map > object : NULL > map_tower : * > map_tower: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 0.0.0.0 > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 00000000-0000-0000-0000-000000000000 > max_towers : 0x00000001 (1) >[2025/04/09 07:31:23.969613, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x0000002a (42) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000074 (116) > context_id : 0x0000 (0) > opnum : 0x0003 (3) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:23.969798, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.969820, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 140 >[2025/04/09 07:31:23.970370, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 136 >[2025/04/09 07:31:23.970433, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0098 (152) > auth_length : 0x0000 (0) > call_id : 0x0000002a (42) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000080 (128) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=128 > [0000] 00 00 00 00 2B 9D 30 91 7C DB E5 4C A6 0E CD 80 ....+.0. |..L.... > [0010] 7D EF B5 56 01 00 00 00 01 00 00 00 00 00 00 00 }..V.... ........ > [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... > [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... > [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] > [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. > [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ > [0070] C2 06 01 00 09 04 00 0A 1C 01 5C 00 00 00 00 00 ........ ..\..... >[2025/04/09 07:31:23.970752, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 152, data_len 128 >[2025/04/09 07:31:23.970773, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.970793, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 128 bytes. >[2025/04/09 07:31:23.970841, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > out: struct epm_Map > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 91309d2b-db7c-4ce5-a60e-cd807defb556 > num_towers : * > num_towers : 0x00000001 (1) > towers: ARRAY(1) > towers: struct epm_twr_p_t > twr : * > twr: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0xc206 (49670) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 10.28.1.92 > result : 0x00000000 (0) >[2025/04/09 07:31:23.971442, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 49670 >[2025/04/09 07:31:23.971997, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:31:23.972172, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 >[2025/04/09 07:31:23.972205, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0048 (72) > auth_length : 0x0000 (0) > call_id : 0x0000002b (43) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:23.972478, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.972504, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 72 >[2025/04/09 07:31:23.972760, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 44 >[2025/04/09 07:31:23.972812, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x003c (60) > auth_length : 0x0000 (0) > call_id : 0x0000002b (43) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b09 (2825) > secondary_address_size : 0x0006 (6) > secondary_address : '49670' > _pad1 : DATA_BLOB length=0 > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:23.973096, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.973121, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. >[2025/04/09 07:31:23.973145, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:31:23.973175, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3410(cli_rpc_pipe_open_noauth_transport) > cli_rpc_pipe_open_noauth: opened pipe netlogon to machine windc1.adprotocolx.com and bound anonymously. >[2025/04/09 07:31:23.973216, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 2 for netlogon_creds_cli.tdb >[2025/04/09 07:31:23.973242, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:netlogon_creds_cli.tdb 3:<none> 4:<none> >[2025/04/09 07:31:23.973271, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 761302038 key 434C495B475046534E4D >[2025/04/09 07:31:23.973297, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=21, vnn=4026531841, opcode=128, srvid=761302038 >[2025/04/09 07:31:23.973392, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 761302038 key 434C495B475046534E4D >[2025/04/09 07:31:23.973431, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 2 for netlogon_creds_cli.tdb >[2025/04/09 07:31:23.973479, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_ServerReqChallenge: struct netr_ServerReqChallenge > in: struct netr_ServerReqChallenge > server_name : * > server_name : '\\windc1.adprotocolx.com' > computer_name : * > computer_name : 'GPFSNMBASH' > credentials : * > credentials: struct netr_Credential > data : 67f35085d52192ff >[2025/04/09 07:31:23.973601, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x0000002c (44) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000006e (110) > context_id : 0x0000 (0) > opnum : 0x0004 (4) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:23.973798, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.973821, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 134 >[2025/04/09 07:31:23.974240, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 20 >[2025/04/09 07:31:23.974293, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0024 (36) > auth_length : 0x0000 (0) > call_id : 0x0000002c (44) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=12 > [0000] 86 B1 10 03 7F CC 52 39 00 00 00 00 ......R9 .... >[2025/04/09 07:31:23.974514, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 36, data_len 12 >[2025/04/09 07:31:23.974537, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 36 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.974557, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:31:23.974593, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_ServerReqChallenge: struct netr_ServerReqChallenge > out: struct netr_ServerReqChallenge > return_credentials : * > return_credentials: struct netr_Credential > data : 86b110037fcc5239 > result : NT_STATUS_OK >[2025/04/09 07:31:23.974699, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_ServerAuthenticate3: struct netr_ServerAuthenticate3 > in: struct netr_ServerAuthenticate3 > server_name : * > server_name : '\\windc1.adprotocolx.com' > account_name : * > account_name : 'GPFSNMBASH$' > secure_channel_type : SEC_CHAN_WKSTA (2) > computer_name : * > computer_name : 'GPFSNMBASH' > credentials : * > credentials: struct netr_Credential > data : f09427dc47a0c036 > negotiate_flags : * > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC >[2025/04/09 07:31:23.975043, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x0000002d (45) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000009c (156) > context_id : 0x0000 (0) > opnum : 0x001a (26) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:23.975235, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.975259, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 180 >[2025/04/09 07:31:23.976105, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 28 >[2025/04/09 07:31:23.976162, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x002c (44) > auth_length : 0x0000 (0) > call_id : 0x0000002d (45) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000014 (20) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=20 > [0000] 11 1E 37 C7 AC 11 3D 0E FF FF 0F 61 54 04 00 00 ..7...=. ...aT... > [0010] 00 00 00 00 .... >[2025/04/09 07:31:23.976504, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 44, data_len 20 >[2025/04/09 07:31:23.976553, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 44 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.976579, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 20 bytes. >[2025/04/09 07:31:23.976614, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_ServerAuthenticate3: struct netr_ServerAuthenticate3 > out: struct netr_ServerAuthenticate3 > return_credentials : * > return_credentials: struct netr_Credential > data : 111e37c7ac113d0e > negotiate_flags : * > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > rid : * > rid : 0x00000454 (1108) > result : NT_STATUS_OK >[2025/04/09 07:31:23.976883, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 2 for netlogon_creds_cli.tdb >[2025/04/09 07:31:23.976908, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:netlogon_creds_cli.tdb 3:<none> 4:<none> >[2025/04/09 07:31:23.976935, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 761302038 key 434C495B475046534E4D >[2025/04/09 07:31:23.977006, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 761302038 key 434C495B475046534E4D >[2025/04/09 07:31:23.977039, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 2 for netlogon_creds_cli.tdb >[2025/04/09 07:31:23.977086, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 0f6aa5761550cc62041379939299a172 > sequence : 0x67f65a8b (1744198283) > seed: struct netr_Credential > data : f09427dc47a0c036 > client: struct netr_Credential > data : f09427dc47a0c036 > server: struct netr_Credential > data : 111e37c7ac113d0e > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 07:31:23.977384, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_netlogon.c:249(rpccli_setup_netlogon_creds_locked) > rpccli_setup_netlogon_creds_locked: using new netlogon_creds cli[GPFSNMBASH$/GPFSNMBASH] to windc1.adprotocolx.com >[2025/04/09 07:31:23.977475, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 135 >[2025/04/09 07:31:23.977875, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:31:23.978061, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 >[2025/04/09 07:31:23.978099, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0048 (72) > auth_length : 0x0000 (0) > call_id : 0x0000002e (46) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa > if_version : 0x00000003 (3) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:23.978371, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.978396, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 72 >[2025/04/09 07:31:23.978625, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 44 >[2025/04/09 07:31:23.978678, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x003c (60) > auth_length : 0x0000 (0) > call_id : 0x0000002e (46) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00001042 (4162) > secondary_address_size : 0x0004 (4) > secondary_address : '135' > _pad1 : DATA_BLOB length=2 > [0000] 30 91 0. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:23.978987, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.979013, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. >[2025/04/09 07:31:23.979037, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:31:23.979089, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > in: struct epm_Map > object : NULL > map_tower : * > map_tower: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 0.0.0.0 > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 00000000-0000-0000-0000-000000000000 > max_towers : 0x00000001 (1) >[2025/04/09 07:31:23.979558, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x0000002f (47) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000074 (116) > context_id : 0x0000 (0) > opnum : 0x0003 (3) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:23.979760, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.979784, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 140 >[2025/04/09 07:31:23.980088, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 136 >[2025/04/09 07:31:23.980140, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0098 (152) > auth_length : 0x0000 (0) > call_id : 0x0000002f (47) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000080 (128) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=128 > [0000] 00 00 00 00 6D BD 67 DB 59 92 10 49 8A D7 13 E3 ....m.g. Y..I.... > [0010] 14 DB BB 74 01 00 00 00 01 00 00 00 00 00 00 00 ...t.... ........ > [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... > [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... > [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] > [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. > [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ > [0070] C2 06 01 00 09 04 00 0A 1C 01 5C 00 00 00 00 00 ........ ..\..... >[2025/04/09 07:31:23.980481, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 152, data_len 128 >[2025/04/09 07:31:23.980504, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.980524, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 128 bytes. >[2025/04/09 07:31:23.980558, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > out: struct epm_Map > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : db67bd6d-9259-4910-8ad7-13e314dbbb74 > num_towers : * > num_towers : 0x00000001 (1) > towers: ARRAY(1) > towers: struct epm_twr_p_t > twr : * > twr: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0xc206 (49670) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 10.28.1.92 > result : 0x00000000 (0) >[2025/04/09 07:31:23.981115, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 49670 >[2025/04/09 07:31:23.981482, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:31:23.981527, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 0f6aa5761550cc62041379939299a172 > sequence : 0x67f65a8b (1744198283) > seed: struct netr_Credential > data : f09427dc47a0c036 > client: struct netr_Credential > data : f09427dc47a0c036 > server: struct netr_Credential > data : 111e37c7ac113d0e > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 07:31:23.981926, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 07:31:23.981988, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 07:31:23.982018, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 07:31:23.982059, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55bdbc502550]: subreq: 0x55bdbc542e40 >[2025/04/09 07:31:23.982089, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55bdbc502550]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc542e40/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc543020)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 07:31:23.982123, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 07:31:23.982221, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x00000030 (48) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 07:31:23.983299, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.983339, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 111 >[2025/04/09 07:31:23.984099, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 64 >[2025/04/09 07:31:23.984217, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0050 (80) > auth_length : 0x000c (12) > call_id : 0x00000030 (48) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b0a (2826) > secondary_address_size : 0x0006 (6) > secondary_address : '49670' > _pad1 : DATA_BLOB length=0 > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 07:31:23.984514, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.984539, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 80 bytes. >[2025/04/09 07:31:23.984564, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:31:23.984598, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:31:23.984636, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55bdbc502550]: subreq: 0x55bdbc542e40 >[2025/04/09 07:31:23.984666, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55bdbc502550]: NT_STATUS_OK tevent_req[0x55bdbc542e40/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc543020)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 07:31:23.984746, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 0f6aa5761550cc62041379939299a172 > sequence : 0x67f65a8b (1744198283) > seed: struct netr_Credential > data : f09427dc47a0c036 > client: struct netr_Credential > data : f09427dc47a0c036 > server: struct netr_Credential > data : 111e37c7ac113d0e > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 07:31:23.985039, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:254(netlogon_creds_step) > seed dc2794f0:36c0a047 >[2025/04/09 07:31:23.985068, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:259(netlogon_creds_step) > seed+time 441def7d:36c0a047 >[2025/04/09 07:31:23.985101, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:269(netlogon_creds_step) > CLIENT 294550ea:b7a85bdc >[2025/04/09 07:31:23.985119, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:275(netlogon_creds_step) > seed+time+1 441def7e:36c0a047 >[2025/04/09 07:31:23.985140, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:283(netlogon_creds_step) > SERVER be3250e9:bfbd2ef9 >[2025/04/09 07:31:23.985177, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonGetCapabilities: struct netr_LogonGetCapabilities > in: struct netr_LogonGetCapabilities > server_name : * > server_name : '\\windc1.adprotocolx.com' > computer_name : * > computer_name : 'GPFSNMBASH' > credential : * > credential: struct netr_Authenticator > cred: struct netr_Credential > data : ea504529dc5ba8b7 > timestamp : Wed Apr 9 07:31:25 AM 2025 EDT > return_authenticator : * > return_authenticator: struct netr_Authenticator > cred: struct netr_Credential > data : 0000000000000000 > timestamp : (time_t)0 > query_level : 0x00000001 (1) >[2025/04/09 07:31:23.985353, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:31:23.985539, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000031 (49) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x000000c0 (192) > context_id : 0x0000 (0) > opnum : 0x0015 (21) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:23.985723, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:23.985812, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.985837, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 280 >[2025/04/09 07:31:23.986408, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 104 >[2025/04/09 07:31:23.986468, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0078 (120) > auth_length : 0x0038 (56) > call_id : 0x00000031 (49) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000018 (24) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=96 > [0000] B0 6F 25 41 05 84 98 FD CE BD AE 50 7D 5A 69 37 .o%A.... ...P}Zi7 > [0010] 67 B3 0A 09 DF 11 A9 56 DB 99 0F B9 F6 61 C7 4A g......V .....a.J > [0020] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0030] 7E 0B BC AC B5 F9 38 F6 F3 CB 90 B9 33 40 C1 95 ~.....8. ....3@.. > [0040] E9 A4 95 D7 11 F6 72 3E 00 00 00 00 00 00 00 00 ......r> ........ > [0050] 0C 00 00 00 00 00 00 00 41 00 44 00 50 00 52 00 ........ A.D.P.R. >[2025/04/09 07:31:23.986744, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:23.986766, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:31:23.986785, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:23.986819, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 120, data_len 24 >[2025/04/09 07:31:23.986841, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 120 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.986868, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 24 bytes. >[2025/04/09 07:31:23.986898, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonGetCapabilities: struct netr_LogonGetCapabilities > out: struct netr_LogonGetCapabilities > return_authenticator : * > return_authenticator: struct netr_Authenticator > cred: struct netr_Credential > data : e95032bef92ebdbf > timestamp : (time_t)0 > capabilities : * > capabilities : union netr_Capabilities(case 1) > server_capabilities : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > result : NT_STATUS_OK >[2025/04/09 07:31:23.987196, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:754(netlogon_creds_cli_store_internal) > creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 0f6aa5761550cc62041379939299a172 > sequence : 0x67f65a8d (1744198285) > seed: struct netr_Credential > data : 7eef1d4447a0c036 > client: struct netr_Credential > data : ea504529dc5ba8b7 > server: struct netr_Credential > data : e95032bef92ebdbf > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 07:31:23.987480, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 2 for netlogon_creds_cli.tdb >[2025/04/09 07:31:23.987503, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:netlogon_creds_cli.tdb 3:<none> 4:<none> >[2025/04/09 07:31:23.987529, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 761302038 key 434C495B475046534E4D >[2025/04/09 07:31:23.987556, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 761302038 key 434C495B475046534E4D >[2025/04/09 07:31:23.987583, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 2 for netlogon_creds_cli.tdb >[2025/04/09 07:31:23.987619, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:31:23.987640, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:31:23.987665, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:23.987692, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 07:31:23.987715, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=22, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 07:31:23.987755, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:23.987784, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:31:23.987803, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:31:23.987820, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:31:23.987856, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:31:23.987917, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000032 (50) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:23.988133, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:23.988209, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:23.988234, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:31:23.988757, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:31:23.988813, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000032 (50) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] AF 95 E9 C9 2F 01 E5 12 01 E3 BC 40 16 25 46 1E ..../... ...@.%F. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] F5 57 8F C2 02 74 3D 8F 28 86 C6 FA C5 F7 1A 19 .W...t=. (....... > [0030] 86 2D 16 50 C3 06 84 E9 F3 CB 90 B9 33 40 C1 95 .-.P.... ....3@.. > [0040] E9 A4 95 D7 11 F6 72 3E 00 00 00 00 00 00 00 00 ......r> ........ >[2025/04/09 07:31:23.989102, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:23.989126, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:31:23.989145, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:23.989177, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:31:23.989198, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:23.989217, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:31:23.989244, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:31:23.989346, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:31:23.989379, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:23.989460, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:23.989481, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:31:24.060372, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:24.060436, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:31:24.060505, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:24.060587, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:31:24.060667, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000033 (51) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:24.060872, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:24.060985, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:24.061018, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:31:24.061843, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:31:24.061900, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000033 (51) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 94 1B D1 6C E2 D5 5B CC 2F 1F 1C D8 E8 3F 44 4E ...l..[. /....?DN > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 2F 5E 68 C9 B8 14 13 EE FE 0D 2A 47 E2 CD 4E B2 /^h..... ..*G..N. > [0030] E3 D5 DD 9F C1 B2 74 20 F3 CB 90 B9 33 40 C1 95 ......t ....3@.. > [0040] E9 A4 95 D7 11 F6 72 3E 00 00 00 00 00 00 00 00 ......r> ........ >[2025/04/09 07:31:24.062204, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:24.062229, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:31:24.062248, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:24.062281, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:31:24.062304, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:24.062337, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:31:24.062375, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:31:24.062444, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:31:24.062467, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:24.062525, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:24.062545, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:31:27.010922, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) > cli_api_pipe failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 07:31:27.011195, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 10000 (ms) to 1000 (ms). >[2025/04/09 07:31:27.011314, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 1000 (ms) to 500 (ms). >[2025/04/09 07:31:27.011384, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 500 (ms) to 500 (ms). >[2025/04/09 07:31:27.011588, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:31:27.512458, 3, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1946(connection_ok) > connection_ok: Connection to windc2.adprotocolx.com for domain ADPROTOCOLX is not connected >[2025/04/09 07:31:27.512534, 3, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1760(cm_open_connection) > Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. >[2025/04/09 07:31:27.512558, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1767(cm_open_connection) > Attempt 0/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 07:31:27.512588, 3, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1528(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 07:31:27.512663, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc1.adprotocolx.com" for "ADPROTOCOLX" domain >[2025/04/09 07:31:27.512690, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com >[2025/04/09 07:31:27.512708, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1439(connect_preferred_dc) > connect_preferred_dc: saf_servername is 'windc1.adprotocolx.com' for domain ADPROTOCOLX >[2025/04/09 07:31:27.512752, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:31:27.512777, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:31:27.512801, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc1.adprotocolx.com#20 found. >[2025/04/09 07:31:27.512845, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:27.512880, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. >[2025/04/09 07:31:27.512941, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.92'. >[2025/04/09 07:31:27.512997, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: adprotocolx.com) >[2025/04/09 07:31:27.513802, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f3fd (127997) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc1.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC1' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:31:27.514191, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:31:27.514217, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478512 seconds ahead) >[2025/04/09 07:31:27.514290, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:31:27.514312, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478512 seconds ahead) >[2025/04/09 07:31:27.514347, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.92 >[2025/04/09 07:31:27.514378, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc1.adprotocolx.com#20: 10.28.1.92 >[2025/04/09 07:31:27.514418, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC1.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:42:27 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 07:31:27.514450, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1134(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f3fd >[2025/04/09 07:31:27.514469, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:31:27.514490, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:31:27.514551, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX >[2025/04/09 07:31:27.514578, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc1.adprotocolx.com" for "adprotocolx.com" domain >[2025/04/09 07:31:27.514602, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc1.adprotocolx.com, *" >[2025/04/09 07:31:27.514621, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:31:27.514641, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 07:31:27.514669, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 07:31:27.514749, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:31:27.514778, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 07:31:27.514851, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] E0 6F 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .o...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . >[2025/04/09 07:31:27.515504, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] E0 6F 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .o...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx > [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 07:31:27.515825, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 07:31:27.515852, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 07:31:27.515871, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:27.515890, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 07:31:27.515908, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 07:31:27.515926, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:27.515945, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:27.516015, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:27.516046, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:31:27.516068, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:31:27.516090, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc1.adprotocolx.com#20 found. >[2025/04/09 07:31:27.516113, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:27.516137, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:27.516159, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:27.516181, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:27.516202, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:27.516223, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:27.516243, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:27.516264, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:27.516287, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:27.516307, 4, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:27.516325, 4, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 10.28.1.93 192.168.122.206 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:27.516347, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:31:27.516369, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc1.adprotocolx.com" for "adprotocolx.com" domain >[2025/04/09 07:31:27.516404, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc1.adprotocolx.com, *" >[2025/04/09 07:31:27.516425, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) >[2025/04/09 07:31:27.516446, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS >[2025/04/09 07:31:27.516464, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com >[2025/04/09 07:31:27.516512, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:31:27.516534, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP >[2025/04/09 07:31:27.516589, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] B2 90 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. >[2025/04/09 07:31:27.517143, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] B2 90 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol > [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s > [0100] D0 D7 81 C8 0F 00 ...... >[2025/04/09 07:31:27.517451, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 >[2025/04/09 07:31:27.517484, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 >[2025/04/09 07:31:27.517503, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:27.517522, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 >[2025/04/09 07:31:27.517539, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 >[2025/04/09 07:31:27.517557, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:27.517577, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:27.517618, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:31:27.517648, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:31:27.517670, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:31:27.517692, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc1.adprotocolx.com#20 found. >[2025/04/09 07:31:27.517715, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:27.517738, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:27.517760, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 >[2025/04/09 07:31:27.517781, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 >[2025/04/09 07:31:27.517802, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:31:27.517823, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 >[2025/04/09 07:31:27.517843, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 >[2025/04/09 07:31:27.517870, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:27.517889, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:31:27.517908, 4, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:31:27.517929, 4, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:31:27.517951, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:31:27.517998, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:31:27.719787, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f3fd (127997) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc1.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC1' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:31:30.521011, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.92 > kdc = [2001:192::656a:348:28e1:d1]:88 > >[2025/04/09 07:31:30.521200, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.92 > kdc = [2001:192::656a:348:28e1:d1]:88 > >[2025/04/09 07:31:30.521278, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc1.adprotocolx.com], expire = [1744199190] >[2025/04/09 07:31:30.521306, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:46:30 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:31:30.521352, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [adprotocolx.com], server = [windc1.adprotocolx.com], expire = [1744199190] >[2025/04/09 07:31:30.521373, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:46:30 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:31:30.521404, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1168(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92' is 'windc1.adprotocolx.com' >[2025/04/09 07:31:30.521448, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com >[2025/04/09 07:31:30.521526, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 445 >[2025/04/09 07:31:30.523105, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc1.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 07:31:30.523361, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 20000 (ms) to 10000 (ms). >[2025/04/09 07:31:30.523480, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:31:30.526315, 5, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:857(cm_prepare_connection) > connecting to windc1.adprotocolx.com (ADPROTOCOLX, adprotocolx.com) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] >[2025/04/09 07:31:30.526362, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc1.adprotocolx.com >[2025/04/09 07:31:30.526612, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] >[2025/04/09 07:31:30.526681, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526604: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:31:30.527267, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526606: Sending unauthenticated request >[2025/04/09 07:31:30.527323, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526607: Sending request (182 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:31:30.527649, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526608: Sending initial UDP request to dgram 10.28.1.92:88 >[2025/04/09 07:31:30.529111, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526609: Received answer (219 bytes) from dgram 10.28.1.92:88 >[2025/04/09 07:31:30.529214, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526610: Response was from master KDC >[2025/04/09 07:31:30.529261, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526611: Received error from KDC: -1765328359/Additional pre-authentication required >[2025/04/09 07:31:30.529318, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526614: Preauthenticating using KDC method data >[2025/04/09 07:31:30.529347, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526615: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) >[2025/04/09 07:31:30.529377, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526616: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:31:30.533353, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526617: AS key obtained for encrypted timestamp: aes256-cts/C8D8 >[2025/04/09 07:31:30.533430, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526619: Encrypted timestamp (for 1744209089.79996): plain 301AA011180F32303235303430393134333132395AA105020301387C, encrypted 6908374D76B1D77DE8F4A79A810815AA8FC6427FC4D5187C3301D62207329D2ED38EAD306CEB7D76812BC3F6AFD3FA3EAF23C0C60C19DB6D >[2025/04/09 07:31:30.533476, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526620: Preauth module encrypted_timestamp (2) (real) returned: 0/Success >[2025/04/09 07:31:30.533501, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526621: Produced preauth for next request: PA-ENC-TIMESTAMP (2) >[2025/04/09 07:31:30.533550, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526622: Sending request (261 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:31:30.533632, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526623: Sending initial UDP request to dgram 10.28.1.92:88 >[2025/04/09 07:31:30.534861, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526624: Received answer (102 bytes) from dgram 10.28.1.92:88 >[2025/04/09 07:31:30.534926, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526625: Response was from master KDC >[2025/04/09 07:31:30.535014, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526626: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP >[2025/04/09 07:31:30.535048, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526627: Request or response is too big for UDP; retrying with TCP >[2025/04/09 07:31:30.535073, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526628: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) >[2025/04/09 07:31:30.535145, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526629: Initiating TCP connection to stream 10.28.1.92:88 >[2025/04/09 07:31:30.535539, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526630: Sending TCP request to stream 10.28.1.92:88 >[2025/04/09 07:31:30.537337, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526631: Received answer (1596 bytes) from stream 10.28.1.92:88 >[2025/04/09 07:31:30.537378, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526632: Terminating TCP connection to stream 10.28.1.92:88 >[2025/04/09 07:31:30.537488, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526633: Response was from master KDC >[2025/04/09 07:31:30.537547, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526634: Processing preauth types: PA-ETYPE-INFO2 (19) >[2025/04/09 07:31:30.537579, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526635: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:31:30.537625, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526636: Produced preauth for next request: (empty) >[2025/04/09 07:31:30.537661, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526637: AS key determined by preauth: aes256-cts/C8D8 >[2025/04/09 07:31:30.537781, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526638: Decrypted AS reply; session key is: aes256-cts/92D9 >[2025/04/09 07:31:30.537856, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526639: FAST negotiation: unavailable >[2025/04/09 07:31:30.537910, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:31:30.537956, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526640: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:31:30.538042, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2377677] 1744198290.526641: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect >[2025/04/09 07:31:30.538091, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc1.adprotocolx.com using Kerberos >[2025/04/09 07:31:30.538117, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) > cli_session_setup_spnego_send: Connect to windc1.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO >[2025/04/09 07:31:30.538362, 5, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 07:31:30.538444, 5, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 07:31:30.549224, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55bdbc4fabf0]: subreq: 0x55bdbc4f2ad0 >[2025/04/09 07:31:30.549260, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55bdbc4fb000]: subreq: 0x55bdbc4daaa0 >[2025/04/09 07:31:30.549289, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55bdbc4fabf0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4f2ad0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55bdbc4f2cb0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906] >[2025/04/09 07:31:30.549373, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4daaa0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55bdbc4dac80)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] >[2025/04/09 07:31:30.551132, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55bdbc4fabf0]: subreq: 0x55bdbc514150 >[2025/04/09 07:31:30.551165, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55bdbc4fb000]: subreq: 0x55bdbc4daaa0 >[2025/04/09 07:31:30.551192, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55bdbc4fabf0]: NT_STATUS_OK tevent_req[0x55bdbc514150/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55bdbc514330)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913] >[2025/04/09 07:31:30.551227, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc4daaa0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55bdbc4dac80)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] >[2025/04/09 07:31:30.551442, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:31:30.553057, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc1.adprotocolx.com], expire = [1744199190] >[2025/04/09 07:31:30.553094, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:46:30 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:31:30.553161, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [adprotocolx.com], server = [windc1.adprotocolx.com], expire = [1744199190] >[2025/04/09 07:31:30.553184, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:46:30 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:31:30.553251, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) > set_domain_online: called for domain ADPROTOCOLX >[2025/04/09 07:31:30.553283, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:30.553386, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) > messaging_dgm_send: Sending message to 2377294 >[2025/04/09 07:31:30.553448, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403285357 seconds ahead) >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:31:30.553665, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=14, vnn=4026531841, opcode=18, srvid=0 >[2025/04/09 07:31:30.553783, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=15, vnn=4026531841, opcode=4, srvid=0 >[2025/04/09 07:31:30.553872, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=149, srvid=0 >[2025/04/09 07:31:30.553988, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) > db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b >[2025/04/09 07:31:30.554092, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 0f6aa5761550cc62041379939299a172 > sequence : 0x67f65a8d (1744198285) > seed: struct netr_Credential > data : 7eef1d4447a0c036 > client: struct netr_Credential > data : ea504529dc5ba8b7 > server: struct netr_Credential > data : e95032bef92ebdbf > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 07:31:30.554451, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:31:30.554498, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:31:30.554532, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:30.554605, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) > ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 >[2025/04/09 07:31:30.554633, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) > ctdbd_migrate: Sending ctdb packet >[2025/04/09 07:31:30.566749, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:30.566789, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:30.566819, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:31:30.566840, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:31:30.566858, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:31:30.566925, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 135 >[2025/04/09 07:31:30.574664, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:31:30.574863, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 >[2025/04/09 07:31:30.574910, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0048 (72) > auth_length : 0x0000 (0) > call_id : 0x00000009 (9) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa > if_version : 0x00000003 (3) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:30.575195, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:30.575221, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 72 >[2025/04/09 07:31:30.575987, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 44 >[2025/04/09 07:31:30.576090, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x003c (60) > auth_length : 0x0000 (0) > call_id : 0x00000009 (9) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00001044 (4164) > secondary_address_size : 0x0004 (4) > secondary_address : '135' > _pad1 : DATA_BLOB length=2 > [0000] 67 DB g. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:30.576382, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:30.576407, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. >[2025/04/09 07:31:30.576431, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:31:30.576505, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > in: struct epm_Map > object : NULL > map_tower : * > map_tower: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 0.0.0.0 > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 00000000-0000-0000-0000-000000000000 > max_towers : 0x00000001 (1) >[2025/04/09 07:31:30.577059, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x0000000a (10) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000074 (116) > context_id : 0x0000 (0) > opnum : 0x0003 (3) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:30.577252, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:30.577275, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 140 >[2025/04/09 07:31:30.579373, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 136 >[2025/04/09 07:31:30.579443, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0098 (152) > auth_length : 0x0000 (0) > call_id : 0x0000000a (10) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000080 (128) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=128 > [0000] 00 00 00 00 99 C2 52 EF 88 B8 CB 4A 93 25 86 8B ......R. ...J.%.. > [0010] AE 1A E0 20 01 00 00 00 01 00 00 00 00 00 00 00 ... .... ........ > [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... > [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... > [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] > [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. > [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ > [0070] C2 06 01 00 09 04 00 0A 1C 01 5C 00 00 00 00 00 ........ ..\..... >[2025/04/09 07:31:30.579769, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 152, data_len 128 >[2025/04/09 07:31:30.579793, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:30.579813, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 128 bytes. >[2025/04/09 07:31:30.579851, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > out: struct epm_Map > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : ef52c299-b888-4acb-9325-868bae1ae020 > num_towers : * > num_towers : 0x00000001 (1) > towers: ARRAY(1) > towers: struct epm_twr_p_t > twr : * > twr: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [0010] 01 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0xc206 (49670) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 10.28.1.92 > result : 0x00000000 (0) >[2025/04/09 07:31:30.580443, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 49670 >[2025/04/09 07:31:30.581275, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:31:30.581329, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 0f6aa5761550cc62041379939299a172 > sequence : 0x67f65a8d (1744198285) > seed: struct netr_Credential > data : 7eef1d4447a0c036 > client: struct netr_Credential > data : ea504529dc5ba8b7 > server: struct netr_Credential > data : e95032bef92ebdbf > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 07:31:30.581737, 5, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 07:31:30.581781, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 07:31:30.581805, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 07:31:30.581854, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc514150 >[2025/04/09 07:31:30.581886, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc514150/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc514330)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 07:31:30.581924, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 07:31:30.582045, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x0000000b (11) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 07:31:30.582357, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:30.582381, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 111 >[2025/04/09 07:31:30.582834, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 64 >[2025/04/09 07:31:30.582888, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0050 (80) > auth_length : 0x000c (12) > call_id : 0x0000000b (11) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b0c (2828) > secondary_address_size : 0x0006 (6) > secondary_address : '49670' > _pad1 : DATA_BLOB length=0 > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 07:31:30.583243, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:30.583268, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 80 bytes. >[2025/04/09 07:31:30.583291, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:31:30.583313, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:31:30.583344, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc514150 >[2025/04/09 07:31:30.583371, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc514150/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc514330)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 07:31:30.583411, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:31:30.583450, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:31:30.583479, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:30.583504, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 07:31:30.583527, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=18, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 07:31:30.583641, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:30.583677, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:31:30.583697, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:31:30.583715, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:31:30.583751, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:31:30.583815, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:31:30.584068, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000000c (12) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000088 (136) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:30.584257, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:30.584350, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:30.584376, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 232 >[2025/04/09 07:31:30.585052, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:31:30.585112, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000000c (12) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 51 0E 39 8B 33 B0 94 2B E8 6F E1 A8 98 11 C7 B8 Q.9.3..+ .o...... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 36 D0 33 4E 1A 49 E6 1B 42 AB 45 0F 33 CA 09 A4 6.3N.I.. B.E.3... > [0030] 45 A6 16 75 B5 E4 B0 AD 5F 8C 48 13 64 8C 6D 4D E..u.... _.H.d.mM > [0040] BC 45 A3 DC F6 F2 E1 87 52 EC D9 1D 9C B1 C1 D8 .E...... R....... >[2025/04/09 07:31:30.585381, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:30.585403, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:31:30.585423, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:30.585475, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:31:30.585499, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:30.585519, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:31:30.585547, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:31:30.585636, 5, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:31:30.585671, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:30.585780, 4, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:30.585804, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:31:31.402176, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:31.402225, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:31:31.402456, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:31.402557, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:31:31.402669, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000034 (52) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:31.402882, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:31.403037, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:31.403081, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:31:31.403729, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:31:31.403794, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000034 (52) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 7F CA 94 BD D3 8B 6F D9 9E EC EF 22 21 76 6A 19 ......o. ..."!vj. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 6C FC BD 2E 4E 89 B0 37 46 0D BB 1F 74 41 EE 91 l...N..7 F...tA.. > [0030] CB D9 B5 B8 84 B3 3C 72 F3 CB 90 B9 33 40 C1 95 ......<r ....3@.. > [0040] E9 A4 95 D7 11 F6 72 3E 00 00 00 00 00 00 00 00 ......r> ........ >[2025/04/09 07:31:31.404090, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:31.404115, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:31:31.404135, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:31.404178, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:31:31.404201, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:31.404256, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:31:31.404290, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:31:31.404362, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:31:31.404386, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:31.404477, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:31.404501, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:31:35.700268, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 36 extra bytes >[2025/04/09 07:31:35.700339, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:35.700375, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') >[2025/04/09 07:31:35.700470, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:31:35.700625, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_DsRGetDCName: struct netr_DsRGetDCName > in: struct netr_DsRGetDCName > server_unc : * > server_unc : 'windc1.adprotocolx.com' > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_guid : NULL > flags : 0x40000001 (1073741825) > 1: DS_FORCE_REDISCOVERY > 0: DS_DIRECTORY_SERVICE_REQUIRED > 0: DS_DIRECTORY_SERVICE_PREFERRED > 0: DS_GC_SERVER_REQUIRED > 0: DS_PDC_REQUIRED > 0: DS_BACKGROUND_ONLY > 0: DS_IP_REQUIRED > 0: DS_KDC_REQUIRED > 0: DS_TIMESERV_REQUIRED > 0: DS_WRITABLE_REQUIRED > 0: DS_GOOD_TIMESERV_PREFERRED > 0: DS_AVOID_SELF > 0: DS_ONLY_LDAP_NEEDED > 0: DS_IS_FLAT_NAME > 0: DS_IS_DNS_NAME > 0: DS_TRY_NEXTCLOSEST_SITE > 0: DS_DIRECTORY_SERVICE_6_REQUIRED > 0: DS_WEB_SERVICE_REQUIRED > 0: DS_DIRECTORY_SERVICE_8_REQUIRED > 0: DS_DIRECTORY_SERVICE_9_REQUIRED > 0: DS_DIRECTORY_SERVICE_10_REQUIRED > 1: DS_RETURN_DNS_NAME > 0: DS_RETURN_FLAT_NAME >[2025/04/09 07:31:35.700876, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000035 (53) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000074 (116) > context_id : 0x0000 (0) > opnum : 0x0014 (20) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:35.701103, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:35.701203, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:35.701229, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 216 >[2025/04/09 07:31:35.702959, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 472 >[2025/04/09 07:31:35.703051, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x01e8 (488) > auth_length : 0x0038 (56) > call_id : 0x00000035 (53) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000190 (400) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=464 > [0000] 5D B7 54 E1 51 AD 2F B3 7B 49 4B 6B 0F 0A 5A 98 ].T.Q./. {IKk..Z. > [0010] 7A EA EC 0D 91 12 F0 8A F3 33 86 76 F9 C9 CC 69 z....... .3.v...i > [0020] FA 80 BA 5D 0F 0E E4 98 00 62 C3 6B 7A A1 65 54 ...].... .b.kz.eT > [0030] A5 A7 03 77 63 22 57 2F C5 F6 E6 A1 F4 DF 84 9B ...wc"W/ ........ > [0040] 56 AC 16 E1 49 21 24 82 82 5A 15 DB 4B C6 37 D0 V...I!$. .Z..K.7. > [0050] C0 8D 10 60 B9 90 74 3F 96 B2 1D CF CD BC 7F 49 ...`..t? .......I > [0060] 27 74 F7 16 6C B8 65 60 4E 08 55 C4 8F 38 78 F5 't..l.e` N.U..8x. > [0070] 06 E2 54 1E 87 18 10 0E D9 6B D9 1B 5A BC 36 FC ..T..... .k..Z.6. > [0080] 48 E1 78 5E 7D C7 D4 ED BE F7 96 C1 0C 05 03 6B H.x^}... .......k > [0090] 55 50 5D 0E E8 E9 9E 8E 16 5C B8 DE 36 DA 91 40 UP]..... .\..6..@ > [00A0] 04 D9 DD 3E A7 77 2B 14 72 3E 01 B0 FE C9 DD 3A ...>.w+. r>.....: > [00B0] B9 FB 5B CE 4C 33 42 34 AF D1 E3 54 E5 4D 21 B9 ..[.L3B4 ...T.M!. > [00C0] E6 A4 66 B9 B3 84 92 FF E6 3E BA BF A9 AB C1 9F ..f..... .>...... > [00D0] 26 24 6B 0F F8 2C 15 8E 05 72 5C 18 4E 84 23 D8 &$k..,.. .r\.N.#. > [00E0] FB 30 11 7D FC 42 A0 24 27 EE 6C D3 C3 6C 43 84 .0.}.B.$ '.l..lC. > [00F0] 22 54 C8 C6 25 65 A3 5B B8 8D 92 CA C8 87 DC D4 "T..%e.[ ........ > [0100] DD CC 65 B4 1C 71 EA 12 1B 46 21 15 83 48 32 52 ..e..q.. .F!..H2R > [0110] E5 DE 79 8B 77 F4 9E D1 9C 6D 9A F1 A6 9F CF BB ..y.w... .m...... > [0120] 57 4B 31 D5 E9 0B C6 80 F7 77 F2 0F 96 F2 D5 EE WK1..... .w...... > [0130] 17 71 97 88 DF 84 D3 F8 B9 DD A0 61 4C 87 BA 8D .q...... ...aL... > [0140] D6 CB DB 27 E7 3A 25 30 59 2A 34 3B 0C A1 99 E1 ...'.:%0 Y*4;.... > [0150] 51 FD 20 15 EB 89 F1 73 D7 E4 30 0C 65 EA B6 03 Q. ....s ..0.e... > [0160] 7D 15 4A D3 11 30 64 87 5F 51 90 D5 D0 54 11 E2 }.J..0d. _Q...T.. > [0170] 50 7D F3 41 D6 64 0F 6A 05 AA 8F 76 18 B8 43 39 P}.A.d.j ...v..C9 > [0180] 9F F4 35 A9 48 E0 FC E0 4F 42 DB AF A9 6D F9 0D ..5.H... OB...m.. > [0190] 44 06 00 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [01A0] 25 0B 8E D7 CB 45 39 5A 31 70 22 48 FB E6 DD AB %....E9Z 1p"H.... > [01B0] 81 A1 53 A0 E2 B4 C8 70 00 00 00 00 00 00 00 00 ..S....p ........ > [01C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:31:35.703694, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:35.703718, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:31:35.703737, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:35.703776, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 488, data_len 400 >[2025/04/09 07:31:35.703798, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 488 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:35.703817, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 400 bytes. >[2025/04/09 07:31:35.703872, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_DsRGetDCName: struct netr_DsRGetDCName > out: struct netr_DsRGetDCName > info : * > info : * > info: struct netr_DsRGetDCNameInfo > dc_unc : * > dc_unc : '\\windc1.adprotocolx.com' > dc_address : * > dc_address : '\\2001:192::656a:348:28e1:d1' > dc_address_type : DS_ADDRESS_TYPE_INET (1) > domain_guid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > domain_name : * > domain_name : 'adprotocolx.com' > forest_name : * > forest_name : 'adprotocolx.com' > dc_flags : 0xe001f3fd (3758224381) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 1: NBT_SERVER_HAS_DNS_NAME > 1: NBT_SERVER_IS_DEFAULT_NC > 1: NBT_SERVER_FOREST_ROOT > dc_site_name : * > dc_site_name : 'Default-First-Site-Name' > client_site_name : * > client_site_name : 'Default-First-Site-Name' > result : WERR_OK >[2025/04/09 07:31:35.704179, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : * > dc_info: struct netr_DsRGetDCNameInfo > dc_unc : * > dc_unc : '\\windc1.adprotocolx.com' > dc_address : * > dc_address : '\\2001:192::656a:348:28e1:d1' > dc_address_type : DS_ADDRESS_TYPE_INET (1) > domain_guid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > domain_name : * > domain_name : 'adprotocolx.com' > forest_name : * > forest_name : 'adprotocolx.com' > dc_flags : 0xe001f3fd (3758224381) > 1: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 1: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 1: NBT_SERVER_HAS_DNS_NAME > 1: NBT_SERVER_IS_DEFAULT_NC > 1: NBT_SERVER_FOREST_ROOT > dc_site_name : * > dc_site_name : 'Default-First-Site-Name' > client_site_name : * > client_site_name : 'Default-First-Site-Name' > result : NT_STATUS_OK >[2025/04/09 07:31:35.704459, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:35.704483, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4408 bytes to parent >[2025/04/09 07:31:38.745614, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:31:38.745669, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:38.745692, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:31:38.745759, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:38.745829, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:38.745863, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:31:38.745891, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:31:38.745912, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:31:38.745942, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 07:31:38.745999, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 07:31:38.746043, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:31:38.746073, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:31:38.746112, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:38.746164, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:38.746196, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:31:38.746216, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:31:38.746235, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:31:38.746303, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 135 >[2025/04/09 07:31:38.746716, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:31:38.747035, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 >[2025/04/09 07:31:38.747077, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0048 (72) > auth_length : 0x0000 (0) > call_id : 0x00000036 (54) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa > if_version : 0x00000003 (3) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:38.747339, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:38.747364, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 72 >[2025/04/09 07:31:38.747635, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 44 >[2025/04/09 07:31:38.747706, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x003c (60) > auth_length : 0x0000 (0) > call_id : 0x00000036 (54) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00001045 (4165) > secondary_address_size : 0x0004 (4) > secondary_address : '135' > _pad1 : DATA_BLOB length=2 > [0000] 52 EF R. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=0 >[2025/04/09 07:31:38.748020, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:38.748046, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. >[2025/04/09 07:31:38.748070, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:31:38.748125, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > in: struct epm_Map > object : NULL > map_tower : * > map_tower: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. > [0010] 00 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 0.0.0.0 > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 00000000-0000-0000-0000-000000000000 > max_towers : 0x00000001 (1) >[2025/04/09 07:31:38.748628, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0000 (0) > call_id : 0x00000037 (55) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000074 (116) > context_id : 0x0000 (0) > opnum : 0x0003 (3) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:38.748819, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:38.748843, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 140 >[2025/04/09 07:31:38.749215, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 136 >[2025/04/09 07:31:38.749275, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0098 (152) > auth_length : 0x0000 (0) > call_id : 0x00000037 (55) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000080 (128) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=128 > [0000] 00 00 00 00 A0 CD 8B D1 3E 32 A1 43 A4 04 E8 DA ........ >2.C.... > [0010] 2A 3E 45 14 01 00 00 00 01 00 00 00 00 00 00 00 *>E..... ........ > [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... > [0030] 05 00 13 00 0D 78 57 34 12 34 12 CD AB EF 00 01 .....xW4 .4...... > [0040] 23 45 67 89 AB 00 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] > [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. > [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ > [0070] C2 03 01 00 09 04 00 0A 1C 01 5C 00 00 00 00 00 ........ ..\..... >[2025/04/09 07:31:38.749607, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 152, data_len 128 >[2025/04/09 07:31:38.749630, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:38.749650, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 128 bytes. >[2025/04/09 07:31:38.749688, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > epm_Map: struct epm_Map > out: struct epm_Map > entry_handle : * > entry_handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : d18bcda0-323e-43a1-a404-e8da2a3e4514 > num_towers : * > num_towers : 0x00000001 (1) > towers: ARRAY(1) > towers: struct epm_twr_p_t > twr : * > twr: struct epm_twr_t > tower_length : 0x0000004b (75) > tower: struct epm_tower > num_floors : 0x0005 (5) > floors: ARRAY(5) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. > [0010] 00 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_UUID (13) > lhs_data : DATA_BLOB length=18 > [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [0010] 02 00 .. > rhs : union epm_rhs(case 13) > uuid: struct epm_rhs_uuid > unknown : DATA_BLOB length=2 > [0000] 00 00 .. > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_NCACN (11) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 11) > ncacn: struct epm_rhs_ncacn > minor_version : 0x0000 (0) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_TCP (7) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 7) > tcp: struct epm_rhs_tcp > port : 0xc203 (49667) > floors: struct epm_floor > lhs: struct epm_lhs > protocol : EPM_PROTOCOL_IP (9) > lhs_data : DATA_BLOB length=0 > rhs : union epm_rhs(case 9) > ip: struct epm_rhs_ip > ipaddr : 10.28.1.92 > result : 0x00000000 (0) >[2025/04/09 07:31:38.750254, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.92 at port 49667 >[2025/04/09 07:31:38.750880, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >[2025/04/09 07:31:38.750944, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > session_key : 0f6aa5761550cc62041379939299a172 > sequence : 0x67f65a8d (1744198285) > seed: struct netr_Credential > data : 7eef1d4447a0c036 > client: struct netr_Credential > data : ea504529dc5ba8b7 > server: struct netr_Credential > data : e95032bef92ebdbf > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > sid : NULL >[2025/04/09 07:31:38.751381, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 07:31:38.751424, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 07:31:38.751448, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 07:31:38.751496, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc4eaec0 >[2025/04/09 07:31:38.751532, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4eaec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 07:31:38.751567, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 07:31:38.751684, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x00000038 (56) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345778-1234-abcd-ef00-0123456789ab > if_version : 0x00000000 (0) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 07:31:38.752021, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:38.752046, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 111 >[2025/04/09 07:31:38.752331, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 64 >[2025/04/09 07:31:38.752383, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0050 (80) > auth_length : 0x000c (12) > call_id : 0x00000038 (56) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b0d (2829) > secondary_address_size : 0x0006 (6) > secondary_address : '49667' > _pad1 : DATA_BLOB length=0 > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 07:31:38.752695, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:38.752720, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 80 bytes. >[2025/04/09 07:31:38.752743, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:31:38.752766, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:31:38.752796, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc4eaec0 >[2025/04/09 07:31:38.752823, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc4eaec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] >[2025/04/09 07:31:38.752862, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3622(cli_rpc_pipe_open_schannel_with_creds) > cli_rpc_pipe_open_schannel_with_creds: opened pipe lsarpc to machine windc1.adprotocolx.com with key netlogon_creds_cli:CLI[GPFSNMBASH/GPFSNMBASH$]/SRV[WINDC1/ADPROTOCOLX] and bound using schannel. >[2025/04/09 07:31:38.752898, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:31:38.752919, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:31:38.752946, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:38.753006, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 07:31:38.753038, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=23, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 07:31:38.753161, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:31:38.753196, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:31:38.753217, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:31:38.753242, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:31:38.753267, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:31:38.753310, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 07:31:38.753518, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345778-1234-abcd-ef00-0123456789ab > if_version : 0x00000000 (0) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:31:38.753758, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000039 (57) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000084 (132) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:38.753978, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:38.754083, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:38.754121, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 232 >[2025/04/09 07:31:38.755088, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 07:31:38.755140, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x00000039 (57) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] 79 39 53 C7 99 1E 26 CD 79 91 56 91 B0 55 9E 56 y9S...&. y.V..U.V > [0010] 7E 71 3C 2A 93 7C 23 BE 58 33 05 04 F5 8B EA C6 ~q<*.|#. X3...... > [0020] 77 B5 DC 34 01 B7 FA 47 4F AF 80 CF 7B 19 00 CD w..4...G O...{... > [0030] 9E 01 10 45 D1 9A F6 08 3F BC 70 C5 1A FB FC C6 ...E.... ?.p..... > [0040] 86 AF C9 8B A2 04 4B 32 0B 2C A1 E8 33 0C E7 FF ......K2 .,..3... > [0050] DF D4 7E ED 89 0B DE D3 89 AA 4F B5 4A FD 89 FD ..~..... ..O.J... > [0060] 46 97 B5 CD 73 80 81 9C 85 E9 7C 6B F9 52 FD F8 F...s... ..|k.R.. > [0070] 8D 0A 46 5F 89 39 75 C8 9C 8A 38 9B EB 35 DC E9 ..F_.9u. ..8..5.. > [0080] C3 8A B3 27 F4 A9 D7 4A FA 02 5A 51 DE B6 CA BB ...'...J ..ZQ.... > [0090] F2 05 A9 76 03 69 7B CC 4A 2A 0E EF 8C 15 25 3F ...v.i{. J*....%? > [00A0] 10 F7 FC C2 A9 0F DC A8 E5 16 07 96 06 59 86 CC ........ .....Y.. > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] C0 24 31 15 B5 F3 F7 D1 5E 46 6D 53 66 95 94 7E .$1..... ^FmSf..~ > [00D0] FC E0 DE ED D0 55 6B 7B 63 00 6F 00 6D 00 00 00 .....Uk{ c.o.m... > [00E0] 00 00 00 00 F9 01 00 00 00 00 00 00 22 00 00 00 ........ ...."... >[2025/04/09 07:31:38.755593, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:38.755626, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:31:38.755646, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:38.755683, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 07:31:38.755717, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:38.755741, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. >[2025/04/09 07:31:38.755797, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:31:38.756114, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:31:38.756140, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:31:38.756178, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:36:38 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:31:38.756228, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:36:38 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:31:38.756271, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:31:38.756372, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:38.756399, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:31:44.217577, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:44.217632, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:31:44.217708, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:44.217788, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:31:44.217869, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003a (58) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:44.218104, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:44.218194, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:44.218220, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:31:44.218846, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:31:44.218909, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003a (58) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 4E A2 B3 FB 1C E0 47 68 55 5A 31 A5 9D AE D1 65 N.....Gh UZ1....e > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 29 A9 7F F1 B5 90 44 92 DA 2A 0A 93 10 86 DE E2 ).....D. .*...... > [0030] 36 46 38 D4 D0 89 1A F7 3F BC 70 C5 1A FB FC C6 6F8..... ?.p..... > [0040] 86 AF C9 8B A2 04 4B 32 0B 2C A1 E8 33 0C E7 FF ......K2 .,..3... >[2025/04/09 07:31:44.219201, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:44.219225, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:31:44.219248, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:44.219280, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:31:44.219302, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:44.219321, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:31:44.219349, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:31:44.219414, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:31:44.219435, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:44.219491, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:44.219510, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:31:44.227185, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:31:44.227225, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:44.227245, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:31:44.227291, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:31:44.227344, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:31:44.227369, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:31:44.227388, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:31:44.227406, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:31:44.227431, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 07:31:44.227452, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) > cm_connect_lsa_tcp >[2025/04/09 07:31:44.227485, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:31:44.227517, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > in: struct lsa_LookupSids3 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray2 > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) > lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) > client_revision : LSA_CLIENT_REVISION_2 (2) >[2025/04/09 07:31:44.227701, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003b (59) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000048 (72) > context_id : 0x0000 (0) > opnum : 0x004c (76) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:44.227904, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:44.228005, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:44.228040, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:31:44.228682, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 248 >[2025/04/09 07:31:44.228744, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0108 (264) > auth_length : 0x0038 (56) > call_id : 0x0000003b (59) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a8 (168) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=240 > [0000] FE 56 0E A7 24 CB 96 D3 CE 40 B9 B5 EE A0 3C F6 .V..$... .@....<. > [0010] 28 83 A5 5E 80 77 0E B7 41 04 79 89 C4 EB EB D9 (..^.w.. A.y..... > [0020] 9D EE A3 99 C0 B2 B2 C4 31 78 78 E9 F3 8E C6 72 ........ 1xx....r > [0030] 5C 11 99 71 A4 E8 E0 31 42 A4 FE 01 EF 1A C9 BA \..q...1 B....... > [0040] 68 CC E7 54 90 0E EA 2B D0 CA 48 53 E9 A7 7A 12 h..T...+ ..HS..z. > [0050] 20 14 CB AC 01 18 83 FF CF E1 B1 37 99 BA E8 F1 ....... ...7.... > [0060] 79 DA 3E 0D 1B 00 C0 89 79 B3 34 7A 3E FE DB 35 y.>..... y.4z>..5 > [0070] F8 F2 56 63 97 83 1A B4 4A A8 BE 8F E1 DA 75 A2 ..Vc.... J.....u. > [0080] 9B 3F 6D E1 AD 08 57 9B 0F 94 A6 82 E4 19 58 7C .?m...W. ......X| > [0090] BD 3D C4 9A D9 56 C0 AF CB 7D DB F6 A4 7F 03 C2 .=...V.. .}...... > [00A0] 98 77 EF 77 55 F0 FF D3 ED 40 55 2C 76 FF 23 6D .w.wU... .@U,v.#m > [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [00C0] AD 17 1D DE 84 CF F9 66 D4 29 BA 86 19 83 BF 1D .......f .)...... > [00D0] EC C0 47 1D 38 7D 83 82 63 00 6F 00 6D 00 00 00 ..G.8}.. c.o.m... > [00E0] 00 00 00 00 F9 01 00 00 00 00 00 00 22 00 00 00 ........ ...."... >[2025/04/09 07:31:44.229196, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:44.229220, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:31:44.229238, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:44.229271, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 264, data_len 168 >[2025/04/09 07:31:44.229292, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:44.229315, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. >[2025/04/09 07:31:44.229351, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids3: struct lsa_LookupSids3 > out: struct lsa_LookupSids3 > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray2 > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName2 > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > unknown : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:31:44.229585, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:31:44.229609, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:31:44.229640, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:36:44 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:31:44.229690, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:36:44 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:31:44.229726, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:31:44.229816, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:44.229837, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:31:46.420798, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:31:46.420872, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:31:46.420993, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:31:46.421112, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:31:46.421212, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003c (60) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:31:46.421407, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:31:46.421529, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:31:46.421564, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:31:46.422233, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:31:46.422331, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003c (60) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] F1 2C 18 04 00 4D 08 0C 29 93 22 59 E4 28 1B AF .,...M.. )."Y.(.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 68 F7 EC 52 BB C8 B9 71 A5 16 9C C9 6F 67 32 E6 h..R...q ....og2. > [0030] C6 93 5C BC D3 77 2F 64 42 A4 FE 01 EF 1A C9 BA ..\..w/d B....... > [0040] 68 CC E7 54 90 0E EA 2B D0 CA 48 53 E9 A7 7A 12 h..T...+ ..HS..z. >[2025/04/09 07:31:46.422628, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:31:46.422653, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:31:46.422674, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:31:46.422720, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:31:46.422747, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:31:46.422768, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:31:46.422800, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:31:46.422873, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:31:46.422896, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:31:46.423005, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:31:46.423031, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:32:01.387565, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:32:01.387641, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:32:01.387748, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:32:01.387852, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:32:01.388029, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003d (61) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:32:01.388235, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:32:01.388343, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:32:01.388380, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:32:01.390325, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:32:01.390388, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003d (61) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 9A 30 90 62 18 9B FA 0E CF DB D4 4E 6D FA 55 4B .0.b.... ...Nm.UK > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] B0 DE 55 56 F1 5D 4F DB 7E 3D 71 DA 67 5F 9A DD ..UV.]O. ~=q.g_.. > [0030] 25 E7 7A 2A BA 8F B0 BE CF BA EF 3F CC C1 D9 70 %.z*.... ...?...p > [0040] 16 B3 CD DD A4 96 E4 50 02 C2 A4 02 AA A3 5F 87 .......P ......_. >[2025/04/09 07:32:01.390666, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:32:01.390689, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:32:01.390707, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:32:01.390739, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:32:01.390761, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:32:01.390780, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:32:01.390819, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:32:01.390886, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:32:01.390908, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:32:01.391033, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:32:01.391056, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:32:16.399929, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:32:16.400006, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:32:16.400157, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:32:16.400335, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:32:16.400479, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003e (62) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:32:16.400680, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:32:16.400844, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:32:16.400893, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:32:16.402006, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:32:16.402088, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003e (62) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] C3 28 0A ED 86 78 EF AC 3A 04 51 C4 BC 66 04 F5 .(...x.. :.Q..f.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] FC DB 2A E7 FF DA 57 FB AF 9A 63 4F F0 3E 6B EA ..*...W. ..cO.>k. > [0030] A1 B3 15 96 F3 24 23 8D 01 00 00 00 00 00 00 00 .....$#. ........ > [0040] 80 4F 3B B8 F9 01 00 00 A0 4F 3B B8 F9 01 00 00 .O;..... .O;..... >[2025/04/09 07:32:16.402419, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:32:16.402444, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:32:16.402463, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:32:16.402497, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:32:16.402533, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:32:16.402553, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:32:16.402585, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:32:16.402693, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:32:16.402731, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:32:16.402796, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:32:16.402817, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:32:31.391001, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:32:31.391075, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:32:31.391194, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:32:31.391322, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:32:31.391419, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003f (63) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:32:31.391657, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:32:31.391766, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:32:31.391798, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:32:31.392463, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:32:31.392530, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003f (63) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 81 FC 98 E9 54 DE CE F3 C9 09 CB 23 2E 10 F8 E2 ....T... ...#.... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 39 A7 3B 73 BD 8D F1 B6 CA F0 30 02 B4 BA DE 48 9.;s.... ..0....H > [0030] A0 C2 43 C6 A5 D9 31 96 CF BA EF 3F CC C1 D9 70 ..C...1. ...?...p > [0040] 16 B3 CD DD A4 96 E4 50 02 C2 A4 02 AA A3 5F 87 .......P ......_. >[2025/04/09 07:32:31.392827, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:32:31.392850, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:32:31.392868, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:32:31.392900, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:32:31.392922, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:32:31.392994, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:32:31.393033, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:32:31.393105, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:32:31.393138, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:32:31.393206, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:32:31.393227, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:32:49.496979, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:32:49.497084, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:32:49.497264, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:32:49.497422, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:32:49.497523, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000040 (64) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:32:49.497702, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:32:49.497816, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:32:49.497842, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:32:49.498711, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:32:49.498806, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000040 (64) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 0B 9B 0B 03 E6 7C 12 D6 7D C3 62 7B 86 B4 B7 87 .....|.. }.b{.... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] ED 51 8D 71 4B 61 A1 DD 00 9B 0C B0 FE 16 1C 5B .Q.qKa.. .......[ > [0030] 85 FF DA FA 28 E5 C4 5F B5 5E 4C 6E 14 B7 01 08 ....(.._ .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:32:49.499151, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:32:49.499176, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:32:49.499194, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:32:49.499226, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:32:49.499248, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:32:49.499274, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:32:49.499301, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:32:49.499377, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:32:49.499400, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:32:49.499466, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:32:49.499488, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:33:01.393672, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:33:01.393764, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:33:01.393884, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:33:01.394020, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:33:01.394142, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000041 (65) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:33:01.394334, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:33:01.394455, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:33:01.394495, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:33:01.395202, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:33:01.395267, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000041 (65) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 2C 2B 4E F9 A9 DB 03 5D F9 64 9A 63 F2 52 00 7A ,+N....] .d.c.R.z > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 90 30 CE B2 1B 7A 7B A9 FC 41 BB 72 CA 9D C9 51 .0...z{. .A.r...Q > [0030] D4 AE 63 BC 3B 9D 82 37 B5 5E 4C 6E 14 B7 01 08 ..c.;..7 .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:33:01.395551, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:33:01.395598, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:33:01.395619, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:33:01.395655, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:33:01.395687, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:33:01.395709, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:33:01.395749, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:33:01.395828, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:33:01.395851, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:33:01.395924, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:33:01.396030, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:33:16.422098, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:33:16.422151, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:33:16.422263, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:33:16.422398, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:33:16.422543, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000042 (66) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:33:16.422734, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:33:16.422856, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:33:16.422890, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:33:16.423654, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:33:16.423717, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000042 (66) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 2F D6 C8 57 2D 7C E7 B5 F6 8D 49 FE 07 F5 E1 E4 /..W-|.. ..I..... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] C9 23 20 95 26 7F 1A A0 BC 97 75 98 20 7C A2 C9 .# .&... ..u. |.. > [0030] 63 CD FE 63 2A 39 45 94 B5 5E 4C 6E 14 B7 01 08 c..c*9E. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:33:16.424042, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:33:16.424068, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:33:16.424092, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:33:16.424133, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:33:16.424161, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:33:16.424181, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:33:16.424224, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:33:16.424311, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:33:16.424338, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:33:16.424397, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:33:16.424417, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:33:31.435068, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:33:31.435184, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:33:31.435379, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:33:31.435545, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:33:31.435673, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000043 (67) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:33:31.435881, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:33:31.436091, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:33:31.436146, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:33:31.439073, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:33:31.439154, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000043 (67) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 49 3D 29 F8 F3 E1 3E 83 96 3B 4F 71 21 93 91 B0 I=)...>. .;Oq!... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] C3 30 42 D4 63 96 87 D2 24 E4 AF BF 09 5E C0 44 .0B.c... $....^.D > [0030] 6F 4F 26 0F 25 E5 7A A4 00 00 00 00 00 00 00 00 oO&.%.z. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:33:31.439471, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:33:31.439495, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:33:31.439515, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:33:31.439547, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:33:31.439578, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:33:31.439610, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:33:31.439639, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:33:31.439740, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:33:31.439773, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:33:31.439844, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:33:31.439867, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:33:46.424051, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:33:46.424122, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:33:46.424224, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:33:46.424311, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:33:46.424408, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000044 (68) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:33:46.424624, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:33:46.424747, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:33:46.424778, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:33:46.425495, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:33:46.425556, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000044 (68) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] D4 F3 57 E8 64 6B 79 A2 3B 26 A7 43 3B 4D A6 12 ..W.dky. ;&.C;M.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 52 E0 F1 A5 30 40 F4 27 88 1E 71 92 2E 65 86 0A R...0@.' ..q..e.. > [0030] FA 02 82 1D 7D 7E AA D6 00 00 00 00 00 00 00 00 ....}~.. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:33:46.425838, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:33:46.425862, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:33:46.425881, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:33:46.425915, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:33:46.425937, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:33:46.426018, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:33:46.426052, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:33:46.426137, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:33:46.426161, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:33:46.426222, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:33:46.426242, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:34:01.432089, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) > child daemon request 55 >[2025/04/09 07:34:01.432209, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:34:01.432457, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:34:01.432605, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:34:01.432756, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000045 (69) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:34:01.432944, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:34:01.433096, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:34:01.433125, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) > rpc_write_send: data_to_write: 168 >[2025/04/09 07:34:01.433886, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:34:01.433937, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000045 (69) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 58 92 16 8A DA CD D5 D5 AE 21 0B 9E 15 11 AF 38 X....... .!.....8 > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 79 A0 48 08 FF 59 BF FD 31 2B AF A4 5D C2 C9 E6 y.H..Y.. 1+..]... > [0030] D0 6F F9 32 17 07 1E A4 B5 5E 4C 6E 14 B7 01 08 .o.2.... .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:34:01.434338, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:34:01.434374, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:34:01.434394, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:34:01.434440, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:34:01.434462, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:34:01.434482, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:34:01.434516, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:34:01.434590, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:34:01.434613, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:34:01.434721, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) > Finished processing child request 55 >[2025/04/09 07:34:01.434746, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent > >Logs name: log.winbindd.scenario3 >======================== >[2025/04/09 07:45:31.536391, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:31.536595, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:31.536631, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403456)]: request interface version (version = 32) >[2025/04/09 07:45:31.536689, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403456):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:31.536824, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:45:31.536849, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2403456)]: ping >[2025/04/09 07:45:31.536888, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403456):PING]: delivered response to client >[2025/04/09 07:45:31.539296, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:31.558923, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:31.559033, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:31.559062, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403465)]: request interface version (version = 32) >[2025/04/09 07:45:31.559106, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403465):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:31.559251, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:31.559276, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403465)]: request interface version (version = 32) >[2025/04/09 07:45:31.559315, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403465):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:31.559407, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:45:31.559435, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2403465)]: request misc info >[2025/04/09 07:45:31.559494, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403465):INFO]: delivered response to client >[2025/04/09 07:45:31.559587, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:45:31.559610, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2403465)]: request netbios name >[2025/04/09 07:45:31.559660, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403465):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:45:31.559749, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:45:31.559773, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2403465)]: request domain name >[2025/04/09 07:45:31.559809, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403465):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:45:31.559900, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2403465)] Handling async request: DOMAIN_INFO >[2025/04/09 07:45:31.559934, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2403465]: domain_info [ADPROTOCOLX] >[2025/04/09 07:45:31.560019, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2403465):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:45:31.560078, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403465):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:45:31.560181, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2403465)] Handling async request: PING_DC >[2025/04/09 07:45:31.560259, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:31.566536, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:31.566609, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2403465):PING_DC]: NT_STATUS_OK >[2025/04/09 07:45:31.566662, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403465):PING_DC]: delivered response to client >[2025/04/09 07:45:31.569337, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:31.589606, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:45:31.589753, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:45:31.589784, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:45:31.589817, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:45:31.589838, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:45:31.589861, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:45:44.812554, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:44.812760, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:44.812789, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403797)]: request interface version (version = 32) >[2025/04/09 07:45:44.812852, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403797):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:44.813017, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:44.813059, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403797)]: request interface version (version = 32) >[2025/04/09 07:45:44.813101, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403797):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:44.813205, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:45:44.813231, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2403797)]: request misc info >[2025/04/09 07:45:44.813281, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403797):INFO]: delivered response to client >[2025/04/09 07:45:44.813375, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:45:44.813400, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2403797)]: request netbios name >[2025/04/09 07:45:44.813439, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403797):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:45:44.813529, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:45:44.813553, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2403797)]: request domain name >[2025/04/09 07:45:44.813600, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403797):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:45:44.813703, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2403797)] Handling async request: DOMAIN_INFO >[2025/04/09 07:45:44.813731, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2403797]: domain_info [ADPROTOCOLX] >[2025/04/09 07:45:44.813763, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2403797):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:45:44.813805, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403797):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:45:44.813921, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2403797)] Handling async request: PING_DC >[2025/04/09 07:45:44.813995, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:44.816994, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:44.817089, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2403797):PING_DC]: NT_STATUS_OK >[2025/04/09 07:45:44.817141, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403797):PING_DC]: delivered response to client >[2025/04/09 07:45:44.818479, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:44.820641, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:44.820733, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:44.820770, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2403798)]: request interface version (version = 32) >[2025/04/09 07:45:44.820820, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2403798):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:44.820895, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2403798)] Handling async request: GETPWUID >[2025/04/09 07:45:44.820928, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2403798)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:45:44.821011, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:45:44.821103, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:45:44.821159, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:45:44.821218, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:45:44.826510, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:45:44.826595, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:45:44.826618, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:45:44.826648, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:45:44.826672, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:45:44.826710, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:45:44.831377, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:45:44.831466, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:45:44.831493, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:44.831517, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:45:44.831547, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:45:44.831589, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:45:44 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:45:44.831649, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:45:44 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:45:44.831703, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:45:44.831736, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:421(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:44.831764, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:44.831809, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:44.831850, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:45:44.831874, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:45:44.831898, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:44.831926, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:45:44.831947, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:45:44.832001, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:45:44.832025, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:45:44.832045, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:44.832066, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:44.832090, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:44.832113, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:45:44.832132, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:45:44.832172, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:45:44.832242, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:45:44.832267, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:44.832365, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:45:44.832393, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:45:44.832421, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1430(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:45:44.832480, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1473(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:45:44.832524, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:45:44.832560, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:44.861083, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:45:44.861172, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:45:44.861308, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:45:44.861332, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:45:44.861364, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:44.861471, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:45:44.861513, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:44.864071, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:45:44.864256, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:44.864378, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:45:44.864403, 5, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:44.864569, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:45:44.864599, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:45:44.864629, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2403798):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:45:44.864710, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2403798):GETPWUID]: delivered response to client >[2025/04/09 07:45:44.865014, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:46.556004, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:46.557132, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:46.557174, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403814)]: request interface version (version = 32) >[2025/04/09 07:45:46.557232, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403814):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:46.557342, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:45:46.557368, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2403814)]: ping >[2025/04/09 07:45:46.557408, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403814):PING]: delivered response to client >[2025/04/09 07:45:46.563814, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:46.579687, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:46.579808, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:46.579835, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403826)]: request interface version (version = 32) >[2025/04/09 07:45:46.579882, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403826):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:46.579999, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:46.580030, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403826)]: request interface version (version = 32) >[2025/04/09 07:45:46.580073, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403826):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:46.580184, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:45:46.580210, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2403826)]: request misc info >[2025/04/09 07:45:46.580270, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403826):INFO]: delivered response to client >[2025/04/09 07:45:46.580364, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:45:46.580390, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2403826)]: request netbios name >[2025/04/09 07:45:46.580430, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403826):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:45:46.580531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:45:46.580557, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2403826)]: request domain name >[2025/04/09 07:45:46.580596, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403826):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:45:46.580693, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2403826)] Handling async request: DOMAIN_INFO >[2025/04/09 07:45:46.580731, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2403826]: domain_info [ADPROTOCOLX] >[2025/04/09 07:45:46.580779, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2403826):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:45:46.580826, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403826):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:45:46.580927, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2403826)] Handling async request: PING_DC >[2025/04/09 07:45:46.580984, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:46.583780, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:46.583855, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2403826):PING_DC]: NT_STATUS_OK >[2025/04/09 07:45:46.583902, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403826):PING_DC]: delivered response to client >[2025/04/09 07:45:46.586281, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:50.332338, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:50.332570, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:50.332600, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403976)]: request interface version (version = 32) >[2025/04/09 07:45:50.332647, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403976):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:50.332797, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:50.332824, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2403976)]: request interface version (version = 32) >[2025/04/09 07:45:50.332875, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403976):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:50.333001, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:45:50.333032, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2403976)]: request misc info >[2025/04/09 07:45:50.333073, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403976):INFO]: delivered response to client >[2025/04/09 07:45:50.333199, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:45:50.333224, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2403976)]: request netbios name >[2025/04/09 07:45:50.333279, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403976):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:45:50.333400, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:45:50.333424, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2403976)]: request domain name >[2025/04/09 07:45:50.333466, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403976):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:45:50.333555, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2403976)] Handling async request: DOMAIN_INFO >[2025/04/09 07:45:50.333587, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2403976]: domain_info [ADPROTOCOLX] >[2025/04/09 07:45:50.333616, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2403976):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:45:50.333661, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403976):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:45:50.333755, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2403976)] Handling async request: PING_DC >[2025/04/09 07:45:50.333802, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:50.337040, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:50.337111, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2403976):PING_DC]: NT_STATUS_OK >[2025/04/09 07:45:50.337156, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2403976):PING_DC]: delivered response to client >[2025/04/09 07:45:50.338386, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:50.340551, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:50.340621, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:50.340645, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2403977)]: request interface version (version = 32) >[2025/04/09 07:45:50.340686, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2403977):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:50.340784, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2403977)] Handling async request: GETPWUID >[2025/04/09 07:45:50.340812, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2403977)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:45:50.340836, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:45:50.340885, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:45:50.340911, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:45:50.340935, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:45:50.341671, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:45:50.341751, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:45:50.341781, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:45:50.341804, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:45:50.341824, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:45:50.341846, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:45:50.345452, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:45:50.345533, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:45:50.345554, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:50.345575, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:45:50.345594, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:45:50.345621, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:45:50 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:45:50.345664, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:45:50 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:45:50.345697, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:45:50.345716, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:421(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:50.345745, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:50.345783, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:50.345813, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:45:50.345835, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:45:50.345861, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:50.345886, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:45:50.345906, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:45:50.345924, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:45:50.345944, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:45:50.345987, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:50.346010, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:50.346029, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:50.346049, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:45:50.346067, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:45:50.346096, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:45:50.346128, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:45:50.346146, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:50.346241, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:45:50.346262, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:45:50.346280, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1430(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:45:50.346310, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1473(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:45:50.346332, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:45:50.346357, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:50.349938, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:45:50.349993, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:45:50.350076, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:45:50.350096, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:45:50.350117, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:50.350219, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:45:50.350245, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:50.351973, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:45:50.352120, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:50.352229, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:45:50.352248, 5, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:50.352363, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:45:50.352390, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:45:50.352417, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2403977):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:45:50.352459, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2403977):GETPWUID]: delivered response to client >[2025/04/09 07:45:50.352699, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:55.796811, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:55.796973, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:55.797004, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404009)]: request interface version (version = 32) >[2025/04/09 07:45:55.797061, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404009):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:55.797166, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:55.797194, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404009)]: request interface version (version = 32) >[2025/04/09 07:45:55.797232, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404009):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:55.797324, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:45:55.797348, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2404009)]: request misc info >[2025/04/09 07:45:55.797386, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404009):INFO]: delivered response to client >[2025/04/09 07:45:55.797484, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:45:55.797508, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2404009)]: request netbios name >[2025/04/09 07:45:55.797566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404009):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:45:55.797656, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:45:55.797680, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2404009)]: request domain name >[2025/04/09 07:45:55.797717, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404009):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:45:55.797805, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2404009)] Handling async request: DOMAIN_INFO >[2025/04/09 07:45:55.797831, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2404009]: domain_info [ADPROTOCOLX] >[2025/04/09 07:45:55.797870, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2404009):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:45:55.797913, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404009):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:45:55.798025, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2404009)] Handling async request: PING_DC >[2025/04/09 07:45:55.798064, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:55.800729, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:55.800794, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2404009):PING_DC]: NT_STATUS_OK >[2025/04/09 07:45:55.800837, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404009):PING_DC]: delivered response to client >[2025/04/09 07:45:55.801010, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:45:55.804994, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:45:55.805070, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:45:55.805100, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2404010)]: request interface version (version = 32) >[2025/04/09 07:45:55.805144, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2404010):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:45:55.805234, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2404010)] Handling async request: GETPWUID >[2025/04/09 07:45:55.805267, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2404010)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:45:55.805292, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:45:55.805339, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:45:55.805365, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:45:55.805389, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:45:55.806142, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:45:55.806226, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:45:55.806246, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:45:55.806267, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:45:55.806285, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:45:55.806307, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:45:55.808446, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-1-5-21-3967939894-2044440985-2694731363-1104 > result : NT_STATUS_OK >[2025/04/09 07:45:55.808525, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:45:55.808546, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:55.808568, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain *. >[2025/04/09 07:45:55.808587, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) > 0: XID 10001 is out of range. >[2025/04/09 07:45:55.808623, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:45:55 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:45:55.808682, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:45:55 AM 2025 EDT] (604800 seconds ahead) >[2025/04/09 07:45:55.808716, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:45:55.808736, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:421(wb_xids2sids_recv) > 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:55.808764, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) > WB command getpwsid start. > Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:55.808788, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) > WB command queryuser start. > Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:55.808815, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) > Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. >[2025/04/09 07:45:55.808839, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) > WB command sids2xids start. > Resolving 1 SID(s). >[2025/04/09 07:45:55.808872, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) > 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:55.808906, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] >[2025/04/09 07:45:55.808933, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) > Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] >[2025/04/09 07:45:55.808974, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) > Found 1 (out of 1) SID(s) in cache. >[2025/04/09 07:45:55.809012, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) > WB command sids2xids end. >[2025/04/09 07:45:55.809032, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) > 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:55.809060, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) > Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:55.809079, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) > Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. >[2025/04/09 07:45:55.809098, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) > Setting 'homedir' to the template '/home/%D/%U'. >[2025/04/09 07:45:55.809116, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) > Setting 'shell' to the template '/bin/false'. >[2025/04/09 07:45:55.809137, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) > netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:45:55.809165, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) > tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty >[2025/04/09 07:45:55.809183, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) > state->info: struct wbint_userinfo > domain_name : NULL > acct_name : NULL > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:55.809277, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) > Domain name is empty, calling wb_lookupsid_send() to get it. >[2025/04/09 07:45:55.809296, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) > WB command lookupsid start. >[2025/04/09 07:45:55.809314, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1430(find_lookup_domain_from_sid) > find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] >[2025/04/09 07:45:55.809338, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1473(find_lookup_domain_from_sid) > calling find_our_domain >[2025/04/09 07:45:55.809361, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) > Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. >[2025/04/09 07:45:55.809387, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:55.812689, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:45:55.812724, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:45:55.812815, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) > WB command lookupsid end. >[2025/04/09 07:45:55.812834, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) > SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. >[2025/04/09 07:45:55.812855, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:55.813001, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) > About to call dcerpc_wbint_GetNssInfo_send() >[2025/04/09 07:45:55.813030, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > in: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x00000000ffffffff (4294967295) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:55.814718, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_GetNssInfo: struct wbint_GetNssInfo > out: struct wbint_GetNssInfo > info : * > info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 > result : NT_STATUS_OK >[2025/04/09 07:45:55.814872, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:55.815009, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) > WB command queryuser end. >[2025/04/09 07:45:55.815030, 5, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) > state->info: struct wbint_userinfo > domain_name : * > domain_name : 'ADPROTOCOLX' > acct_name : * > acct_name : 'adxuser191' > full_name : NULL > homedir : * > homedir : '/home/%D/%U' > shell : * > shell : '/bin/false' > uid : 0x0000000000002711 (10001) > primary_gid : 0x0000000000004e21 (20001) > primary_group_name : NULL > user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 >[2025/04/09 07:45:55.815142, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) > WB command getpwsid end. > Return status NT_STATUS_OK. >[2025/04/09 07:45:55.815169, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) > Winbind external command GETPWUID end. > (name:passwd:uid:gid:gecos:dir:shell) > ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false >[2025/04/09 07:45:55.815201, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2404010):GETPWUID]: NT_STATUS_OK >[2025/04/09 07:45:55.815249, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2404010):GETPWUID]: delivered response to client >[2025/04/09 07:45:55.815599, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:46:01.285154, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:46:01.285439, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:01.285469, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404219)]: request interface version (version = 32) >[2025/04/09 07:46:01.285519, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404219):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:01.285646, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:01.285673, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404219)]: request interface version (version = 32) >[2025/04/09 07:46:01.285713, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404219):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:01.285810, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:46:01.285836, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2404219)]: request misc info >[2025/04/09 07:46:01.285877, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404219):INFO]: delivered response to client >[2025/04/09 07:46:01.286008, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:46:01.286040, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2404219)]: request netbios name >[2025/04/09 07:46:01.286083, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404219):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:46:01.286179, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:46:01.286205, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2404219)]: request domain name >[2025/04/09 07:46:01.286255, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404219):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:46:01.286351, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2404219)] Handling async request: DOMAIN_INFO >[2025/04/09 07:46:01.286378, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2404219]: domain_info [ADPROTOCOLX] >[2025/04/09 07:46:01.286426, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2404219):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:46:01.286471, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404219):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:46:01.286588, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2404219)] Handling async request: PING_DC >[2025/04/09 07:46:01.286631, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:46:01.290007, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:46:01.290076, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2404219):PING_DC]: NT_STATUS_OK >[2025/04/09 07:46:01.290122, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404219):PING_DC]: delivered response to client >[2025/04/09 07:46:01.291028, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:46:01.293191, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:46:01.293290, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:01.293316, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2404220)]: request interface version (version = 32) >[2025/04/09 07:46:01.293366, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2404220):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:01.293432, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2404220)] Handling async request: GETPWUID >[2025/04/09 07:46:01.293458, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2404220)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:46:01.293483, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:46:01.293539, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:46:01.293567, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:46:01.293608, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:46:01.294903, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:46:01.295022, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:46:01.295046, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:46:01.295068, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:46:01.295093, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:46:01.295117, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:46:01.540610, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:46:01.540744, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:01.540783, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404229)]: request interface version (version = 32) >[2025/04/09 07:46:01.540837, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404229):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:01.543725, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:46:01.543761, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2404229)]: ping >[2025/04/09 07:46:01.543810, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404229):PING]: delivered response to client >[2025/04/09 07:46:01.547311, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:46:01.572182, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:46:01.572297, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:01.572323, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404242)]: request interface version (version = 32) >[2025/04/09 07:46:01.572370, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404242):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:01.572471, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:01.572495, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404242)]: request interface version (version = 32) >[2025/04/09 07:46:01.572547, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404242):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:01.572653, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:46:01.572678, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2404242)]: request misc info >[2025/04/09 07:46:01.572718, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404242):INFO]: delivered response to client >[2025/04/09 07:46:01.572809, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:46:01.572833, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2404242)]: request netbios name >[2025/04/09 07:46:01.572872, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404242):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:46:01.573019, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:46:01.573050, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2404242)]: request domain name >[2025/04/09 07:46:01.573098, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404242):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:46:01.573209, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2404242)] Handling async request: DOMAIN_INFO >[2025/04/09 07:46:01.573236, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2404242]: domain_info [ADPROTOCOLX] >[2025/04/09 07:46:01.573275, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2404242):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:46:01.573318, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404242):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:46:01.573415, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2404242)] Handling async request: PING_DC >[2025/04/09 07:46:01.573455, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:46:01.575872, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:46:01.575942, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2404242):PING_DC]: NT_STATUS_OK >[2025/04/09 07:46:01.576019, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404242):PING_DC]: delivered response to client >[2025/04/09 07:46:01.580156, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:46:01.590290, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:46:01.590434, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:46:01.590460, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:46:01.590484, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:46:01.590508, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:46:01.590531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:46:16.309614, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_IO_TIMEOUT >[2025/04/09 07:46:16.309765, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) > Domain controller not found. Calling wb_dsgetdcname_send() to get it. >[2025/04/09 07:46:16.309803, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) > WB command dsgetdcname start. > Search domain name adprotocolx and site name (null). >[2025/04/09 07:46:16.309862, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:46:16.542254, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:46:16.542388, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:16.542415, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404546)]: request interface version (version = 32) >[2025/04/09 07:46:16.542467, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404546):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:16.542913, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:46:16.542939, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2404546)]: ping >[2025/04/09 07:46:16.543002, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404546):PING]: delivered response to client >[2025/04/09 07:46:16.544840, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:46:16.563887, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:46:16.564007, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:16.564036, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404553)]: request interface version (version = 32) >[2025/04/09 07:46:16.564100, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404553):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:16.564514, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:16.564541, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2404553)]: request interface version (version = 32) >[2025/04/09 07:46:16.564586, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404553):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:16.564677, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:46:16.564701, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2404553)]: request misc info >[2025/04/09 07:46:16.564739, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404553):INFO]: delivered response to client >[2025/04/09 07:46:16.564827, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:46:16.564851, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2404553)]: request netbios name >[2025/04/09 07:46:16.564901, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404553):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:46:16.565082, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:46:16.565112, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2404553)]: request domain name >[2025/04/09 07:46:16.565169, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404553):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:46:16.565837, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2404553)] Handling async request: DOMAIN_INFO >[2025/04/09 07:46:16.565868, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2404553]: domain_info [ADPROTOCOLX] >[2025/04/09 07:46:16.565901, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2404553):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:46:16.565950, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2404553):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:46:16.566107, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2404553)] Handling async request: PING_DC >[2025/04/09 07:46:16.566156, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:46:31.594411, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:46:31.594574, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:46:31.594614, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:46:31.594641, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:46:31.594660, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:46:31.594684, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:46:41.552518, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) > winbind_client_activity[2404553:PING_DC]: client has closed connection - removing client >[2025/04/09 07:46:41.552614, 2, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) > final write to client failed: Broken pipe >[2025/04/09 07:46:41.552891, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) > wb_child_request_cleanup: keep orphaned subreq[0x55cf82599d10] >[2025/04/09 07:46:41.624344, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:46:41.624486, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:41.624515, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2405100)]: request interface version (version = 32) >[2025/04/09 07:46:41.624583, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405100):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:41.624711, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:46:41.624739, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2405100)]: ping >[2025/04/09 07:46:41.624781, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405100):PING]: delivered response to client >[2025/04/09 07:46:41.626058, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:46:41.645752, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:46:41.645840, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:41.645874, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2405103)]: request interface version (version = 32) >[2025/04/09 07:46:41.645920, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405103):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:41.646052, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:46:41.646082, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2405103)]: request interface version (version = 32) >[2025/04/09 07:46:41.646124, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405103):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:46:41.646221, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:46:41.646246, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2405103)]: request misc info >[2025/04/09 07:46:41.646300, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405103):INFO]: delivered response to client >[2025/04/09 07:46:41.646395, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:46:41.646421, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2405103)]: request netbios name >[2025/04/09 07:46:41.646467, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405103):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:46:41.646563, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:46:41.646588, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2405103)]: request domain name >[2025/04/09 07:46:41.646639, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405103):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:46:41.646736, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2405103)] Handling async request: DOMAIN_INFO >[2025/04/09 07:46:41.646772, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2405103]: domain_info [ADPROTOCOLX] >[2025/04/09 07:46:41.646828, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2405103):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:46:41.646889, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405103):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:46:41.647045, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2405103)] Handling async request: PING_DC >[2025/04/09 07:46:41.647148, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:46:41.647299, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1684(fork_domain_child) > fork_domain_child called for domain 'ADPROTOCOLX' >[2025/04/09 07:46:41.649305, 10, pid=2405105, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1758(fork_domain_child) > Child process 2405105 >[2025/04/09 07:46:41.649848, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) > msg_ctdb_ref_destructor: refs=(nil) >[2025/04/09 07:46:41.649932, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) > msg_dgm_ref_destructor: refs=0x55cf82596540 >[2025/04/09 07:46:41.650416, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) > messaging_dgm_ref: messaging_dgm_init returned Success >[2025/04/09 07:46:41.650461, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) > messaging_dgm_ref: unique = 8081820949844588800 >[2025/04/09 07:46:41.650593, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 07:46:41.650755, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 07:46:41.650894, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=4123060171628972689 >[2025/04/09 07:46:41.651096, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2405105 >[2025/04/09 07:46:41.651239, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 >[2025/04/09 07:46:41.651340, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=8081820949844588800 >[2025/04/09 07:46:41.651451, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) > vnn pid 2405105 = 1 >[2025/04/09 07:46:41.651485, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) > messaging_ctdb_ref: messaging_ctdb_init returned Success >[2025/04/09 07:46:41.651559, 5, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) > register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE >[2025/04/09 07:46:41.651681, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 07:46:41.651776, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 07:46:41.651882, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=7278957261039500461 >[2025/04/09 07:46:41.652066, 5, pid=2405105, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:157(make_pdb_method_name) > Attempting to find a passdb backend to match tdbsam (tdbsam) >[2025/04/09 07:46:41.652113, 5, pid=2405105, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:178(make_pdb_method_name) > Found pdb backend tdbsam >[2025/04/09 07:46:41.652208, 5, pid=2405105, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:190(make_pdb_method_name) > pdb backend tdbsam has a valid init >[2025/04/09 07:47:01.596501, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:47:01.596658, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:47:01.596690, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:47:01.596718, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:47:01.596738, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:47:01.596763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:47:06.629709, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) > winbind_client_activity[2405103:PING_DC]: client has closed connection - removing client >[2025/04/09 07:47:06.629823, 2, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) > final write to client failed: Broken pipe >[2025/04/09 07:47:06.629951, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) > wb_child_request_cleanup: keep orphaned subreq[0x55cf825b5c00] >[2025/04/09 07:47:06.668780, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:969(remove_timed_out_clients) > Client request timed out, shutting down sock 27, pid 2404220 >[2025/04/09 07:47:06.668988, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) > wb_child_request_cleanup: keep orphaned subreq[0x55cf8257eaf0] >[2025/04/09 07:47:06.669145, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:47:06.669233, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:06.669261, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2405693)]: request interface version (version = 32) >[2025/04/09 07:47:06.669321, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405693):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:06.669550, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:47:06.669592, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2405693)]: ping >[2025/04/09 07:47:06.669636, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405693):PING]: delivered response to client >[2025/04/09 07:47:06.671214, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:47:06.690584, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:47:06.690675, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:06.690704, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2405695)]: request interface version (version = 32) >[2025/04/09 07:47:06.690751, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405695):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:06.690859, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:06.690888, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2405695)]: request interface version (version = 32) >[2025/04/09 07:47:06.690946, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405695):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:06.691116, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:47:06.691152, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2405695)]: request misc info >[2025/04/09 07:47:06.691199, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405695):INFO]: delivered response to client >[2025/04/09 07:47:06.691361, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:47:06.691416, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2405695)]: request netbios name >[2025/04/09 07:47:06.691508, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405695):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:47:06.691649, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:47:06.691705, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2405695)]: request domain name >[2025/04/09 07:47:06.691766, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405695):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:47:06.691895, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2405695)] Handling async request: DOMAIN_INFO >[2025/04/09 07:47:06.691975, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2405695]: domain_info [ADPROTOCOLX] >[2025/04/09 07:47:06.692060, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2405695):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:47:06.692126, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405695):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:47:06.692306, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2405695)] Handling async request: PING_DC >[2025/04/09 07:47:06.692373, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:47:06.692449, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1684(fork_domain_child) > fork_domain_child called for domain 'ADPROTOCOLX' >[2025/04/09 07:47:06.694502, 10, pid=2405698, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1758(fork_domain_child) > Child process 2405698 >[2025/04/09 07:47:06.695074, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) > msg_ctdb_ref_destructor: refs=(nil) >[2025/04/09 07:47:06.695270, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) > msg_dgm_ref_destructor: refs=0x55cf82596540 >[2025/04/09 07:47:06.695688, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) > messaging_dgm_ref: messaging_dgm_init returned Success >[2025/04/09 07:47:06.695748, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) > messaging_dgm_ref: unique = 16329941230091360097 >[2025/04/09 07:47:06.696098, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 07:47:06.696305, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 07:47:06.696494, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=8060909910973365424 >[2025/04/09 07:47:06.696684, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2405698 >[2025/04/09 07:47:06.696862, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 >[2025/04/09 07:47:06.697094, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=16329941230091360097 >[2025/04/09 07:47:06.697401, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) > vnn pid 2405698 = 1 >[2025/04/09 07:47:06.697444, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) > messaging_ctdb_ref: messaging_ctdb_init returned Success >[2025/04/09 07:47:06.697515, 5, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) > register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE >[2025/04/09 07:47:06.697737, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 07:47:06.697913, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 07:47:06.698107, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=11909729853467258436 >[2025/04/09 07:47:06.698336, 5, pid=2405698, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:157(make_pdb_method_name) > Attempting to find a passdb backend to match tdbsam (tdbsam) >[2025/04/09 07:47:06.698377, 5, pid=2405698, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:178(make_pdb_method_name) > Found pdb backend tdbsam >[2025/04/09 07:47:06.698485, 5, pid=2405698, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:190(make_pdb_method_name) > pdb backend tdbsam has a valid init >[2025/04/09 07:47:11.870390, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:47:11.870588, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:11.870630, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2405714)]: request interface version (version = 32) >[2025/04/09 07:47:11.870713, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405714):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:11.870843, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:11.870888, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2405714)]: request interface version (version = 32) >[2025/04/09 07:47:11.870937, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405714):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:11.871089, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:47:11.871136, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2405714)]: request misc info >[2025/04/09 07:47:11.871196, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405714):INFO]: delivered response to client >[2025/04/09 07:47:11.871317, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:47:11.871367, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2405714)]: request netbios name >[2025/04/09 07:47:11.871416, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405714):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:47:11.871532, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:47:11.871581, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2405714)]: request domain name >[2025/04/09 07:47:11.871627, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405714):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:47:11.871749, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2405714)] Handling async request: DOMAIN_INFO >[2025/04/09 07:47:11.871799, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2405714]: domain_info [ADPROTOCOLX] >[2025/04/09 07:47:11.871842, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2405714):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:47:11.871896, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2405714):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:47:11.872151, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2405714)] Handling async request: PING_DC >[2025/04/09 07:47:11.872232, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:47:11.872323, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1684(fork_domain_child) > fork_domain_child called for domain 'ADPROTOCOLX' >[2025/04/09 07:47:11.873629, 10, pid=2405715, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1758(fork_domain_child) > Child process 2405715 >[2025/04/09 07:47:11.874227, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) > msg_ctdb_ref_destructor: refs=(nil) >[2025/04/09 07:47:11.874310, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) > msg_dgm_ref_destructor: refs=0x55cf82596540 >[2025/04/09 07:47:11.874728, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) > messaging_dgm_ref: messaging_dgm_init returned Success >[2025/04/09 07:47:11.874791, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) > messaging_dgm_ref: unique = 17250037970596681267 >[2025/04/09 07:47:11.874861, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 07:47:11.875058, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 07:47:11.875207, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=16052246599528253588 >[2025/04/09 07:47:11.875336, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2405715 >[2025/04/09 07:47:11.875488, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 >[2025/04/09 07:47:11.875594, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=17250037970596681267 >[2025/04/09 07:47:11.875711, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) > vnn pid 2405715 = 1 >[2025/04/09 07:47:11.875747, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) > messaging_ctdb_ref: messaging_ctdb_init returned Success >[2025/04/09 07:47:11.875811, 5, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) > register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE >[2025/04/09 07:47:11.875936, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 >[2025/04/09 07:47:11.876076, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 >[2025/04/09 07:47:11.876185, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=11166258238532806582 >[2025/04/09 07:47:11.876330, 5, pid=2405715, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:157(make_pdb_method_name) > Attempting to find a passdb backend to match tdbsam (tdbsam) >[2025/04/09 07:47:11.876383, 5, pid=2405715, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:178(make_pdb_method_name) > Found pdb backend tdbsam >[2025/04/09 07:47:11.876477, 5, pid=2405715, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:190(make_pdb_method_name) > pdb backend tdbsam has a valid init >[2025/04/09 07:47:31.600045, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:47:31.600256, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:47:31.600288, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:47:31.600315, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:47:31.600335, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:47:31.600378, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:47:31.678017, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) > winbind_client_activity[2405695:PING_DC]: client has closed connection - removing client >[2025/04/09 07:47:31.678135, 2, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) > final write to client failed: Broken pipe >[2025/04/09 07:47:31.678290, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) > wb_child_request_cleanup: keep orphaned subreq[0x55cf8259d020] >[2025/04/09 07:47:31.718948, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:47:31.719218, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:31.719279, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406077)]: request interface version (version = 32) >[2025/04/09 07:47:31.719340, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406077):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:31.720016, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:47:31.720067, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2406077)]: ping >[2025/04/09 07:47:31.720118, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406077):PING]: delivered response to client >[2025/04/09 07:47:31.722356, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:47:31.743078, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:47:31.743192, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:31.743221, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406086)]: request interface version (version = 32) >[2025/04/09 07:47:31.743268, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406086):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:31.743375, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:31.743403, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406086)]: request interface version (version = 32) >[2025/04/09 07:47:31.743445, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406086):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:31.743556, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:47:31.743584, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2406086)]: request misc info >[2025/04/09 07:47:31.743631, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406086):INFO]: delivered response to client >[2025/04/09 07:47:31.747561, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:47:31.747601, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2406086)]: request netbios name >[2025/04/09 07:47:31.747654, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406086):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:47:31.750502, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:47:31.750544, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2406086)]: request domain name >[2025/04/09 07:47:31.750594, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406086):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:47:31.750732, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2406086)] Handling async request: DOMAIN_INFO >[2025/04/09 07:47:31.750763, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2406086]: domain_info [ADPROTOCOLX] >[2025/04/09 07:47:31.750854, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2406086):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:47:31.750917, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406086):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:47:31.751052, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2406086)] Handling async request: PING_DC >[2025/04/09 07:47:31.751149, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:47:31.993402, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b >[2025/04/09 07:47:31.993512, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2398754 >[2025/04/09 07:47:31.993606, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! >[2025/04/09 07:47:32.002611, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) > wb_child_request_orphaned: cleanup orphaned subreq[0x55cf82599d10] >[2025/04/09 07:47:32.004579, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:47:32.004696, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2406086):PING_DC]: NT_STATUS_OK >[2025/04/09 07:47:32.004763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406086):PING_DC]: delivered response to client >[2025/04/09 07:47:32.004974, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:47:46.576138, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:47:46.576286, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:46.576313, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406500)]: request interface version (version = 32) >[2025/04/09 07:47:46.576373, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406500):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:46.576494, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:47:46.576518, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2406500)]: ping >[2025/04/09 07:47:46.576556, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406500):PING]: delivered response to client >[2025/04/09 07:47:46.580025, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:47:46.603419, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:47:46.603513, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:46.603539, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406510)]: request interface version (version = 32) >[2025/04/09 07:47:46.603587, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406510):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:46.603691, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:47:46.603726, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406510)]: request interface version (version = 32) >[2025/04/09 07:47:46.603767, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406510):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:47:46.603870, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:47:46.603894, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2406510)]: request misc info >[2025/04/09 07:47:46.603942, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406510):INFO]: delivered response to client >[2025/04/09 07:47:46.604061, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:47:46.604089, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2406510)]: request netbios name >[2025/04/09 07:47:46.604134, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406510):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:47:46.604224, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:47:46.604248, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2406510)]: request domain name >[2025/04/09 07:47:46.604286, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406510):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:47:46.604377, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2406510)] Handling async request: DOMAIN_INFO >[2025/04/09 07:47:46.604403, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2406510]: domain_info [ADPROTOCOLX] >[2025/04/09 07:47:46.604464, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2406510):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:47:46.604521, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406510):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:47:46.604626, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2406510)] Handling async request: PING_DC >[2025/04/09 07:47:46.604698, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:47:46.608015, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:47:46.608112, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2406510):PING_DC]: NT_STATUS_OK >[2025/04/09 07:47:46.608170, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406510):PING_DC]: delivered response to client >[2025/04/09 07:47:46.609665, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:48:01.577713, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:48:01.577885, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:01.577913, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406806)]: request interface version (version = 32) >[2025/04/09 07:48:01.578006, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406806):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:01.578164, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:48:01.578189, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2406806)]: ping >[2025/04/09 07:48:01.578229, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406806):PING]: delivered response to client >[2025/04/09 07:48:01.579522, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:48:01.599641, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:48:01.600458, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:48:01.600535, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:48:01.600566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:48:01.600613, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:48:01.600632, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:48:01.600673, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:48:01.600734, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:01.600758, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406818)]: request interface version (version = 32) >[2025/04/09 07:48:01.600807, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406818):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:01.601605, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:01.601636, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2406818)]: request interface version (version = 32) >[2025/04/09 07:48:01.601678, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406818):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:01.601775, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:48:01.601799, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2406818)]: request misc info >[2025/04/09 07:48:01.601853, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406818):INFO]: delivered response to client >[2025/04/09 07:48:01.601947, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:48:01.602000, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2406818)]: request netbios name >[2025/04/09 07:48:01.602043, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406818):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:48:01.602135, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:48:01.602159, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2406818)]: request domain name >[2025/04/09 07:48:01.602198, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406818):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:48:01.602337, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2406818)] Handling async request: DOMAIN_INFO >[2025/04/09 07:48:01.602378, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2406818]: domain_info [ADPROTOCOLX] >[2025/04/09 07:48:01.602416, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2406818):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:48:01.602461, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406818):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:48:01.602573, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2406818)] Handling async request: PING_DC >[2025/04/09 07:48:01.602644, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:48:01.605936, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:48:01.606052, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2406818):PING_DC]: NT_STATUS_OK >[2025/04/09 07:48:01.606103, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2406818):PING_DC]: delivered response to client >[2025/04/09 07:48:01.609356, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:48:16.579370, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:969(remove_timed_out_clients) > Client request timed out, shutting down sock 29, pid 2405714 >[2025/04/09 07:48:16.579603, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) > wb_child_request_cleanup: keep orphaned subreq[0x55cf825d1cc0] >[2025/04/09 07:48:16.579676, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:48:16.579786, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:16.579812, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2407118)]: request interface version (version = 32) >[2025/04/09 07:48:16.579862, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407118):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:16.584384, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:48:16.584437, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2407118)]: ping >[2025/04/09 07:48:16.584502, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407118):PING]: delivered response to client >[2025/04/09 07:48:16.586936, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:48:16.587057, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:48:16.587119, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:16.587143, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2407132)]: request interface version (version = 32) >[2025/04/09 07:48:16.587193, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2407132):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:16.596734, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2407132)] Handling async request: GETPWUID >[2025/04/09 07:48:16.596783, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2407132)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:48:16.596830, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:48:16.596948, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:48:16.597017, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:48:16.597069, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:48:16.598855, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:48:16.598938, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:48:16.598981, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:48:16.599016, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:48:16.599044, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:48:16.599069, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:48:16.606357, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:48:16.606474, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:16.606499, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2407133)]: request interface version (version = 32) >[2025/04/09 07:48:16.606560, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407133):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:16.607543, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:16.607581, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2407133)]: request interface version (version = 32) >[2025/04/09 07:48:16.607635, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407133):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:16.610005, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:48:16.610059, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2407133)]: request misc info >[2025/04/09 07:48:16.610110, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407133):INFO]: delivered response to client >[2025/04/09 07:48:16.610231, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:48:16.610256, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2407133)]: request netbios name >[2025/04/09 07:48:16.610307, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407133):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:48:16.610399, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:48:16.610423, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2407133)]: request domain name >[2025/04/09 07:48:16.610460, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407133):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:48:16.610550, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2407133)] Handling async request: DOMAIN_INFO >[2025/04/09 07:48:16.610589, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2407133]: domain_info [ADPROTOCOLX] >[2025/04/09 07:48:16.610631, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2407133):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:48:16.610673, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407133):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:48:16.610768, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2407133)] Handling async request: PING_DC >[2025/04/09 07:48:16.610826, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:48:16.614298, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:48:16.614391, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2407133):PING_DC]: NT_STATUS_OK >[2025/04/09 07:48:16.614468, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407133):PING_DC]: delivered response to client >[2025/04/09 07:48:16.614780, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:48:24.212140, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 07:48:24.212295, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) > Domain controller not found. Calling wb_dsgetdcname_send() to get it. >[2025/04/09 07:48:24.212331, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) > WB command dsgetdcname start. > Search domain name adprotocolx and site name (null). >[2025/04/09 07:48:24.212403, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:48:31.572763, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:48:31.574124, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:31.574160, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2407426)]: request interface version (version = 32) >[2025/04/09 07:48:31.574238, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407426):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:31.575644, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:48:31.575680, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2407426)]: ping >[2025/04/09 07:48:31.575724, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407426):PING]: delivered response to client >[2025/04/09 07:48:31.580783, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:48:31.599718, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:48:31.599812, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:31.599839, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2407441)]: request interface version (version = 32) >[2025/04/09 07:48:31.599885, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407441):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:31.600348, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:31.600380, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2407441)]: request interface version (version = 32) >[2025/04/09 07:48:31.600425, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407441):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:31.600535, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:48:31.600562, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2407441)]: request misc info >[2025/04/09 07:48:31.600603, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407441):INFO]: delivered response to client >[2025/04/09 07:48:31.600699, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:48:31.600724, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2407441)]: request netbios name >[2025/04/09 07:48:31.600763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407441):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:48:31.600807, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:48:31.600845, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:48:31.600865, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:48:31.600888, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:48:31.600913, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:48:31.600937, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:48:31.601049, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:48:31.601074, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2407441)]: request domain name >[2025/04/09 07:48:31.601114, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407441):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:48:31.601208, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2407441)] Handling async request: DOMAIN_INFO >[2025/04/09 07:48:31.601235, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2407441]: domain_info [ADPROTOCOLX] >[2025/04/09 07:48:31.601274, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2407441):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:48:31.601331, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2407441):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:48:31.601485, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2407441)] Handling async request: PING_DC >[2025/04/09 07:48:31.601538, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:48:56.588935, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) > winbind_client_activity[2407441:PING_DC]: client has closed connection - removing client >[2025/04/09 07:48:56.589144, 2, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) > final write to client failed: Broken pipe >[2025/04/09 07:48:56.668909, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:48:56.669147, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:56.669218, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408149)]: request interface version (version = 32) >[2025/04/09 07:48:56.669299, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408149):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:56.669430, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:48:56.669456, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2408149)]: ping >[2025/04/09 07:48:56.669502, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408149):PING]: delivered response to client >[2025/04/09 07:48:56.670564, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:48:56.690998, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:48:56.691082, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:56.691117, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408151)]: request interface version (version = 32) >[2025/04/09 07:48:56.691162, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408151):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:56.691260, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:48:56.691285, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408151)]: request interface version (version = 32) >[2025/04/09 07:48:56.691325, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408151):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:48:56.691420, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:48:56.691445, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2408151)]: request misc info >[2025/04/09 07:48:56.691500, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408151):INFO]: delivered response to client >[2025/04/09 07:48:56.691596, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:48:56.691621, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2408151)]: request netbios name >[2025/04/09 07:48:56.691668, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408151):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:48:56.691763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:48:56.691788, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2408151)]: request domain name >[2025/04/09 07:48:56.691827, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408151):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:48:56.691934, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2408151)] Handling async request: DOMAIN_INFO >[2025/04/09 07:48:56.692017, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2408151]: domain_info [ADPROTOCOLX] >[2025/04/09 07:48:56.692085, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2408151):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:48:56.692152, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408151):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:48:56.692269, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2408151)] Handling async request: PING_DC >[2025/04/09 07:48:56.692366, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:48:58.009571, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b >[2025/04/09 07:48:58.009664, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2398472 >[2025/04/09 07:48:58.009720, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! >[2025/04/09 07:49:01.604030, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:49:01.604152, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:49:01.604179, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:49:01.604204, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:49:01.604223, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:49:01.604255, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:49:09.213991, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) > wb_child_request_orphaned: cleanup orphaned subreq[0x55cf8257eaf0] >[2025/04/09 07:49:09.216445, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:09.216535, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2408151):PING_DC]: NT_STATUS_OK >[2025/04/09 07:49:09.216600, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408151):PING_DC]: delivered response to client >[2025/04/09 07:49:09.216655, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 12.524360 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:48:56.692267] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:49:09.216627] [12.524360] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 07:48:56.692302] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 07:49:09.216533] [12.524231] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 07:48:56.692327] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 07:49:09.216528] [12.524201] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 07:48:56.692335] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 07:49:09.216526] [12.524191] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:48:56.692354] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:09.216515] [12.524161] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:48:56.692439] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:09.216404] [12.523965] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:48:56.692442] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:49:09.216402] [12.523960] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:48:56.692447] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:49:09.216401] [12.523954] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:09.214106] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:09.216399] [0.002293] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:09.214108] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:09.214109] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:09.214111] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:09.216394] [0.002283] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:09.214111] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:09.214170] [0.000059] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:09.214112] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:09.214168] [0.000056] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:09.214171] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:09.216393] [0.002222] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:09.214177] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:09.216392] [0.002215] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:49:09.216568] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:49:09.216599] [0.000031] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:09.216570] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:09.216594] [0.000024] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:49:09.217381, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:49:21.762049, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:969(remove_timed_out_clients) > Client request timed out, shutting down sock 27, pid 2407132 >[2025/04/09 07:49:21.762249, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) > wb_child_request_cleanup: keep orphaned subreq[0x55cf825d5f00] >[2025/04/09 07:49:25.786737, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:49:25.786978, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:25.787024, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408800)]: request interface version (version = 32) >[2025/04/09 07:49:25.787080, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408800):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:25.787178, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:49:25.787211, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2408800)]: ping >[2025/04/09 07:49:25.787258, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408800):PING]: delivered response to client >[2025/04/09 07:49:25.787406, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:49:25.807784, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:49:25.807926, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:25.807990, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408802)]: request interface version (version = 32) >[2025/04/09 07:49:25.808047, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408802):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:25.808163, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:25.808190, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408802)]: request interface version (version = 32) >[2025/04/09 07:49:25.808233, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408802):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:25.808338, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:49:25.808374, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2408802)]: request misc info >[2025/04/09 07:49:25.808419, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408802):INFO]: delivered response to client >[2025/04/09 07:49:25.808518, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:49:25.808544, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2408802)]: request netbios name >[2025/04/09 07:49:25.808599, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408802):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:49:25.808698, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:49:25.808724, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2408802)]: request domain name >[2025/04/09 07:49:25.808764, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408802):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:49:25.808862, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2408802)] Handling async request: DOMAIN_INFO >[2025/04/09 07:49:25.808898, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2408802]: domain_info [ADPROTOCOLX] >[2025/04/09 07:49:25.808948, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2408802):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:49:25.809033, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408802):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:49:25.809138, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2408802)] Handling async request: PING_DC >[2025/04/09 07:49:25.809185, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:25.812008, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:25.812090, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2408802):PING_DC]: NT_STATUS_OK >[2025/04/09 07:49:25.812148, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408802):PING_DC]: delivered response to client >[2025/04/09 07:49:25.812866, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:49:26.956692, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:49:26.956988, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:26.957022, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408815)]: request interface version (version = 32) >[2025/04/09 07:49:26.957082, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408815):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:26.957197, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:26.957231, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408815)]: request interface version (version = 32) >[2025/04/09 07:49:26.957273, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408815):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:26.957395, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:49:26.957423, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2408815)]: request misc info >[2025/04/09 07:49:26.957467, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408815):INFO]: delivered response to client >[2025/04/09 07:49:26.957566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:49:26.957592, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2408815)]: request netbios name >[2025/04/09 07:49:26.957633, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408815):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:49:26.957740, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:49:26.957766, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2408815)]: request domain name >[2025/04/09 07:49:26.957815, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408815):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:49:26.957913, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2408815)] Handling async request: DOMAIN_INFO >[2025/04/09 07:49:26.957941, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2408815]: domain_info [ADPROTOCOLX] >[2025/04/09 07:49:26.958009, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2408815):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:49:26.958064, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408815):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:49:26.958173, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2408815)] Handling async request: PING_DC >[2025/04/09 07:49:26.958215, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:26.960570, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:26.960660, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2408815):PING_DC]: NT_STATUS_OK >[2025/04/09 07:49:26.960708, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408815):PING_DC]: delivered response to client >[2025/04/09 07:49:26.962031, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:49:26.964214, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:49:26.964293, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:26.964319, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2408816)]: request interface version (version = 32) >[2025/04/09 07:49:26.964363, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2408816):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:26.964481, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2408816)] Handling async request: GETPWUID >[2025/04/09 07:49:26.964522, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2408816)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:49:26.964571, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:49:26.964673, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:49:26.964713, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:49:26.964760, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:49:26.966456, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:49:26.966544, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:49:26.966566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:49:26.966591, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:49:26.966619, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:49:26.966645, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:49:31.595195, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:49:31.596387, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:31.596474, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408856)]: request interface version (version = 32) >[2025/04/09 07:49:31.596546, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408856):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:31.596763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:49:31.596795, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2408856)]: ping >[2025/04/09 07:49:31.596837, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408856):PING]: delivered response to client >[2025/04/09 07:49:31.598882, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:49:31.610659, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:49:31.610798, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:49:31.610824, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:49:31.610850, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:49:31.610869, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:49:31.610893, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:49:31.618828, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:49:31.619538, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:31.619572, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408867)]: request interface version (version = 32) >[2025/04/09 07:49:31.619619, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408867):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:31.619716, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:31.619742, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2408867)]: request interface version (version = 32) >[2025/04/09 07:49:31.619787, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408867):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:31.619883, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:49:31.619908, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2408867)]: request misc info >[2025/04/09 07:49:31.619974, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408867):INFO]: delivered response to client >[2025/04/09 07:49:31.620078, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:49:31.620103, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2408867)]: request netbios name >[2025/04/09 07:49:31.620144, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408867):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:49:31.620238, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:49:31.620263, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2408867)]: request domain name >[2025/04/09 07:49:31.620302, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408867):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:49:31.620397, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2408867)] Handling async request: DOMAIN_INFO >[2025/04/09 07:49:31.620424, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2408867]: domain_info [ADPROTOCOLX] >[2025/04/09 07:49:31.620469, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2408867):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:49:31.620525, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408867):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:49:31.620628, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2408867)] Handling async request: PING_DC >[2025/04/09 07:49:31.620677, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:31.626114, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:31.626185, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2408867):PING_DC]: NT_STATUS_OK >[2025/04/09 07:49:31.626239, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2408867):PING_DC]: delivered response to client >[2025/04/09 07:49:31.628636, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:49:34.868302, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 07:49:34.868445, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) > Domain controller not found. Calling wb_dsgetdcname_send() to get it. >[2025/04/09 07:49:34.868478, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) > WB command dsgetdcname start. > Search domain name adprotocolx and site name (null). >[2025/04/09 07:49:34.868542, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:49:34.871711, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:49:34.871763, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:34.871854, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) > WB command dsgetdcname for adprotocolx end. >[2025/04/09 07:49:34.871879, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:137(wb_dsgetdcname_recv) > Failed for adprotocolx with NT_STATUS_NO_LOGON_SERVERS. >[2025/04/09 07:49:34.871914, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:49:34.871937, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:410(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:34.871991, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:34.872017, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2408816):GETPWUID]: NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:34.872075, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_NO_LOGON_SERVERS. >[2025/04/09 07:49:34.872140, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2408816):GETPWUID]: delivered response to client >[2025/04/09 07:49:34.872198, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 7.907688 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:49:26.964478] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:49:34.872166] [7.907688] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:49:26.964522] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:49:34.871989] [7.907467] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:259 [2025/04/09 07:49:26.964571] ../../source3/winbindd/wb_xids2sids.c:352 [2025/04/09 07:49:34.871909] [7.907338] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:49:26.964663] ../../source3/winbindd/winbindd_idmap.c:175 [2025/04/09 07:49:26.964663] [0.000000] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:26.964672] ../../source3/winbindd/wb_xids2sids.c:194 [2025/04/09 07:49:26.966587] [0.001915] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:26.964751] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:26.966542] [0.001791] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:26.964752] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:26.966541] [0.001789] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:26.964753] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:26.966540] [0.001787] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:26.964922] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:26.966451] [0.001529] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:26.964923] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:26.966451] [0.001528] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:26.964924] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:26.966448] [0.001524] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:26.964925] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:26.964928] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:26.964935] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:26.966444] [0.001509] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:26.964936] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:26.964998] [0.000062] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:26.964936] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:26.964989] [0.000053] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:26.965000] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:26.966443] [0.001443] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:26.965000] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:26.966441] [0.001441] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:26.966590] ../../source3/winbindd/wb_xids2sids.c:209 [2025/04/09 07:49:34.871900] [7.905310] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:26.966642] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:34.868443] [7.901801] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:26.966643] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:34.868434] [7.901791] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:26.966644] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:34.868431] [7.901787] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:26.966728] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:34.868285] [7.901557] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:26.966729] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:34.868282] [7.901553] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:26.966730] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:34.868265] [7.901535] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:26.966732] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:26.966735] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:26.966741] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:34.868230] [7.901489] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:26.966741] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:26.966768] [0.000027] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:26.966743] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:26.966766] [0.000023] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:26.966770] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:34.868229] [7.901459] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:26.966771] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:34.868220] [7.901449] -> TEVENT_REQ_DONE (2 0)) > [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:49:34.868478] ../../source3/winbindd/wb_dsgetdcname.c:119 [2025/04/09 07:49:34.871853] [0.003375] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:49:34.868532] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:49:34.871847] [0.003315] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:49:34.868533] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:49:34.871846] [0.003313] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:34.868540] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:34.871844] [0.003304] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:34.868619] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:34.871760] [0.003141] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:34.868622] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:49:34.871757] [0.003135] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:49:34.868674] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:49:34.871659] [0.002985] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:34.868696] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:34.871657] [0.002961] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:34.868698] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:34.868699] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:34.868707] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:34.871651] [0.002944] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:34.868708] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:34.868743] [0.000035] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:34.868709] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:34.868741] [0.000032] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:34.868744] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:34.871650] [0.002906] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:34.868745] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:34.871648] [0.002903] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:49:34.872056] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:49:34.872139] [0.000083] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:34.872058] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:34.872074] [0.000016] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:49:34.876022, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:49:36.922637, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40c >[2025/04/09 07:49:36.922719, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40c len 12 (num_fds:0) from 1:2405715 >[2025/04/09 07:49:36.922763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:126(winbind_msg_domain_offline) > winbind_msg_domain_offline: Domain ADPROTOCOLX was online, change to offline now. >[2025/04/09 07:49:40.065668, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:49:40.065805, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:40.065837, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409119)]: request interface version (version = 32) >[2025/04/09 07:49:40.065884, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409119):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:40.066573, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:40.066620, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409119)]: request interface version (version = 32) >[2025/04/09 07:49:40.066669, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409119):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:40.066764, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:49:40.066788, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2409119)]: request misc info >[2025/04/09 07:49:40.066827, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409119):INFO]: delivered response to client >[2025/04/09 07:49:40.066923, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:49:40.066947, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2409119)]: request netbios name >[2025/04/09 07:49:40.067035, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409119):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:49:40.067143, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:49:40.067178, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2409119)]: request domain name >[2025/04/09 07:49:40.067216, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409119):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:49:40.067309, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2409119)] Handling async request: DOMAIN_INFO >[2025/04/09 07:49:40.067335, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2409119]: domain_info [ADPROTOCOLX] >[2025/04/09 07:49:40.067407, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2409119):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:49:40.067468, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409119):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:49:40.067588, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2409119)] Handling async request: PING_DC >[2025/04/09 07:49:40.067655, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:40.073197, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:40.073284, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2409119):PING_DC]: NT_STATUS_OK >[2025/04/09 07:49:40.073341, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409119):PING_DC]: delivered response to client >[2025/04/09 07:49:40.075113, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:49:40.076665, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:49:40.076743, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:40.076769, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2409130)]: request interface version (version = 32) >[2025/04/09 07:49:40.076818, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2409130):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:40.076909, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2409130)] Handling async request: GETPWUID >[2025/04/09 07:49:40.076936, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2409130)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:49:40.076992, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:49:40.077049, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:49:40.077075, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:49:40.077100, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:49:40.078069, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:49:40.078156, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:49:40.078178, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:49:40.078200, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:49:40.078219, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:49:40.078246, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:49:41.017314, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b >[2025/04/09 07:49:41.017367, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2405105 >[2025/04/09 07:49:41.017404, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was offline, marking as online now! >[2025/04/09 07:49:41.022034, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) > wb_child_request_orphaned: cleanup orphaned subreq[0x55cf825b5c00] >[2025/04/09 07:49:46.594743, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:49:46.595110, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:46.595160, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409413)]: request interface version (version = 32) >[2025/04/09 07:49:46.595224, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409413):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:46.595361, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:49:46.595387, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2409413)]: ping >[2025/04/09 07:49:46.595435, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409413):PING]: delivered response to client >[2025/04/09 07:49:46.596015, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:49:46.619721, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:49:46.619853, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:46.619882, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409420)]: request interface version (version = 32) >[2025/04/09 07:49:46.619935, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409420):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:46.620768, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:46.620800, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409420)]: request interface version (version = 32) >[2025/04/09 07:49:46.620850, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409420):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:46.620986, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:49:46.621018, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2409420)]: request misc info >[2025/04/09 07:49:46.621076, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409420):INFO]: delivered response to client >[2025/04/09 07:49:46.621179, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:49:46.621210, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2409420)]: request netbios name >[2025/04/09 07:49:46.621252, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409420):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:49:46.621358, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:49:46.621384, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2409420)]: request domain name >[2025/04/09 07:49:46.621425, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409420):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:49:46.621560, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2409420)] Handling async request: DOMAIN_INFO >[2025/04/09 07:49:46.621614, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2409420]: domain_info [ADPROTOCOLX] >[2025/04/09 07:49:46.621668, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2409420):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:49:46.621754, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409420):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:49:46.622074, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2409420)] Handling async request: PING_DC >[2025/04/09 07:49:46.622142, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:46.625465, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:46.625538, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2409420):PING_DC]: NT_STATUS_OK >[2025/04/09 07:49:46.625588, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409420):PING_DC]: delivered response to client >[2025/04/09 07:49:46.627017, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:49:47.155841, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 07:49:47.156034, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) > Domain controller not found. Calling wb_dsgetdcname_send() to get it. >[2025/04/09 07:49:47.156080, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) > WB command dsgetdcname start. > Search domain name adprotocolx and site name (null). >[2025/04/09 07:49:47.156150, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:49:47.159508, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:49:47.159547, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:47.159617, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) > WB command dsgetdcname for adprotocolx end. >[2025/04/09 07:49:47.159641, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:137(wb_dsgetdcname_recv) > Failed for adprotocolx with NT_STATUS_NO_LOGON_SERVERS. >[2025/04/09 07:49:47.159669, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:49:47.159690, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:410(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:47.159712, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:47.159745, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2409130):GETPWUID]: NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:47.159813, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_NO_LOGON_SERVERS. >[2025/04/09 07:49:47.159852, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2409130):GETPWUID]: delivered response to client >[2025/04/09 07:49:47.159913, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 7.082975 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:49:40.076907] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:49:47.159882] [7.082975] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:49:40.076936] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:49:47.159711] [7.082775] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:259 [2025/04/09 07:49:40.076991] ../../source3/winbindd/wb_xids2sids.c:352 [2025/04/09 07:49:47.159663] [7.082672] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:49:40.077044] ../../source3/winbindd/winbindd_idmap.c:175 [2025/04/09 07:49:40.077044] [0.000000] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:40.077049] ../../source3/winbindd/wb_xids2sids.c:194 [2025/04/09 07:49:40.078197] [0.001148] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:40.077096] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:40.078155] [0.001059] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:40.077097] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:40.078154] [0.001057] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:40.077098] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:40.078152] [0.001054] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:40.077216] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:40.078065] [0.000849] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:40.077217] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:40.078064] [0.000847] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:40.077218] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:40.078062] [0.000844] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:40.077219] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:40.077222] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:40.077233] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:40.078058] [0.000825] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:40.077234] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:40.077292] [0.000058] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:40.077234] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:40.077290] [0.000056] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:40.077293] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:40.078058] [0.000765] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:40.077294] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:40.078056] [0.000762] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:40.078199] ../../source3/winbindd/wb_xids2sids.c:209 [2025/04/09 07:49:47.159661] [7.081462] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:40.078244] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:47.156032] [7.077788] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:40.078244] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:47.156023] [7.077779] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:40.078245] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:47.155972] [7.077727] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:40.078324] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:47.155811] [7.077487] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:40.078325] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:47.155807] [7.077482] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:40.078326] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:47.155802] [7.077476] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:40.078327] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:40.078330] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:40.078336] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:47.155793] [7.077457] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:40.078337] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:40.078361] [0.000024] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:40.078337] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:40.078359] [0.000022] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:40.078362] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:47.155792] [7.077430] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:40.078364] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:47.155786] [7.077422] -> TEVENT_REQ_DONE (2 0)) > [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:49:47.156079] ../../source3/winbindd/wb_dsgetdcname.c:119 [2025/04/09 07:49:47.159616] [0.003537] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:49:47.156142] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:49:47.159609] [0.003467] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:49:47.156144] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:49:47.159608] [0.003464] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:47.156146] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:47.159607] [0.003461] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:47.156232] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:47.159545] [0.003313] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:47.156235] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:49:47.159543] [0.003308] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:49:47.156270] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:49:47.159488] [0.003218] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:47.156277] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:47.159487] [0.003210] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:47.156280] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:47.156281] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:47.156288] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:47.159482] [0.003194] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:47.156289] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:47.156322] [0.000033] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:47.156291] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:47.156320] [0.000029] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:47.156324] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:47.159481] [0.003157] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:47.156324] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:47.159479] [0.003155] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:49:47.159775] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:49:47.159851] [0.000076] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:47.159776] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:47.159800] [0.000024] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:49:47.161799, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:49:52.344228, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:49:52.344382, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:52.344411, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409520)]: request interface version (version = 32) >[2025/04/09 07:49:52.344464, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409520):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:52.344567, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:52.344593, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409520)]: request interface version (version = 32) >[2025/04/09 07:49:52.344633, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409520):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:52.344738, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:49:52.344765, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2409520)]: request misc info >[2025/04/09 07:49:52.344816, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409520):INFO]: delivered response to client >[2025/04/09 07:49:52.344915, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:49:52.344940, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2409520)]: request netbios name >[2025/04/09 07:49:52.345005, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409520):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:49:52.345105, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:49:52.345131, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2409520)]: request domain name >[2025/04/09 07:49:52.345169, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409520):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:49:52.345263, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2409520)] Handling async request: DOMAIN_INFO >[2025/04/09 07:49:52.345290, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2409520]: domain_info [ADPROTOCOLX] >[2025/04/09 07:49:52.345321, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2409520):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:49:52.345369, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409520):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:49:52.345502, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2409520)] Handling async request: PING_DC >[2025/04/09 07:49:52.345557, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:52.348526, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:52.348607, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2409520):PING_DC]: NT_STATUS_OK >[2025/04/09 07:49:52.348668, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409520):PING_DC]: delivered response to client >[2025/04/09 07:49:52.349897, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:49:52.352042, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:49:52.352129, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:49:52.352156, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2409521)]: request interface version (version = 32) >[2025/04/09 07:49:52.352209, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2409521):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:49:52.352278, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2409521)] Handling async request: GETPWUID >[2025/04/09 07:49:52.352305, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2409521)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:49:52.352350, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:49:52.352424, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:49:52.352460, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:49:52.352488, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:49:52.353400, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:49:52.353502, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:49:52.353527, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:49:52.353561, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:49:52.353591, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:49:52.353618, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:49:55.032478, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40c >[2025/04/09 07:49:55.032527, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40c len 12 (num_fds:0) from 1:2405698 >[2025/04/09 07:49:55.032571, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:126(winbind_msg_domain_offline) > winbind_msg_domain_offline: Domain ADPROTOCOLX was online, change to offline now. >[2025/04/09 07:49:59.444040, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 07:49:59.444155, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) > Domain controller not found. Calling wb_dsgetdcname_send() to get it. >[2025/04/09 07:49:59.444197, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) > WB command dsgetdcname start. > Search domain name adprotocolx and site name (null). >[2025/04/09 07:49:59.444279, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:50:01.595669, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:50:01.595779, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:01.595805, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409729)]: request interface version (version = 32) >[2025/04/09 07:50:01.595850, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409729):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:01.596030, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:50:01.596072, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2409729)]: ping >[2025/04/09 07:50:01.596119, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409729):PING]: delivered response to client >[2025/04/09 07:50:01.598251, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:50:01.616382, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 29 >[2025/04/09 07:50:01.616436, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:50:01.616490, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:50:01.616519, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:50:01.616544, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:50:01.616562, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline >[2025/04/09 07:50:01.616584, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:50:01.616607, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* >[2025/04/09 07:50:01.616687, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com], timeout=[Wed Apr 9 07:47:34 AM 2025 EDT]) >[2025/04/09 07:50:01.616735, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com], value=[c0000001], timeout=[Wed Apr 9 07:47:34 AM 2025 EDT]) >[2025/04/09 07:50:01.616764, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com]) >[2025/04/09 07:50:01.616851, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:50:55 AM 2025 EDT]) >[2025/04/09 07:50:01.616880, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], value=[c0000194], timeout=[Wed Apr 9 07:50:55 AM 2025 EDT]) >[2025/04/09 07:50:01.616906, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com]) >[2025/04/09 07:50:01.617027, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX >[2025/04/09 07:50:01.617058, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* >[2025/04/09 07:50:01.617147, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com], timeout=[Wed Apr 9 07:47:34 AM 2025 EDT]) >[2025/04/09 07:50:01.617177, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com], value=[c0000001], timeout=[Wed Apr 9 07:47:34 AM 2025 EDT]) >[2025/04/09 07:50:01.617203, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com]) >[2025/04/09 07:50:01.617264, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:50:55 AM 2025 EDT]) >[2025/04/09 07:50:01.617301, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], value=[c0000194], timeout=[Wed Apr 9 07:50:55 AM 2025 EDT]) >[2025/04/09 07:50:01.617328, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com]) >[2025/04/09 07:50:01.617374, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM >[2025/04/09 07:50:01.617417, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:01.617553, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:01.617597, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409740)]: request interface version (version = 32) >[2025/04/09 07:50:01.617643, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409740):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:01.617740, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:01.617765, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2409740)]: request interface version (version = 32) >[2025/04/09 07:50:01.617804, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409740):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:01.617897, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:50:01.617932, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2409740)]: request misc info >[2025/04/09 07:50:01.618001, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409740):INFO]: delivered response to client >[2025/04/09 07:50:01.618114, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:50:01.618139, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2409740)]: request netbios name >[2025/04/09 07:50:01.618177, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409740):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:50:01.618266, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:50:01.618290, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2409740)]: request domain name >[2025/04/09 07:50:01.618327, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409740):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:50:01.618416, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2409740)] Handling async request: DOMAIN_INFO >[2025/04/09 07:50:01.618442, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2409740]: domain_info [ADPROTOCOLX] >[2025/04/09 07:50:01.618481, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2409740):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:50:01.618522, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409740):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:50:01.618631, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2409740)] Handling async request: PING_DC >[2025/04/09 07:50:01.618665, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:01.620839, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:01.620914, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) > wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com >[2025/04/09 07:50:01.622737, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:01.622840, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2409740):PING_DC]: NT_STATUS_OK >[2025/04/09 07:50:01.622899, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2409740):PING_DC]: delivered response to client >[2025/04/09 07:50:01.624222, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 29, client exited >[2025/04/09 07:50:14.466008, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:50:14.466138, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:14.466261, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) > WB command dsgetdcname for adprotocolx end. >[2025/04/09 07:50:14.466285, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:137(wb_dsgetdcname_recv) > Failed for adprotocolx with NT_STATUS_NO_LOGON_SERVERS. >[2025/04/09 07:50:14.466331, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:50:14.466364, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:410(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:14.466386, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:14.466423, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2409521):GETPWUID]: NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:14.466492, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_NO_LOGON_SERVERS. >[2025/04/09 07:50:14.466525, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2409521):GETPWUID]: delivered response to client >[2025/04/09 07:50:14.466593, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 22.114277 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:49:52.352276] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:50:14.466553] [22.114277] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:49:52.352305] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:50:14.466384] [22.114079] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:259 [2025/04/09 07:49:52.352350] ../../source3/winbindd/wb_xids2sids.c:352 [2025/04/09 07:50:14.466326] [22.113976] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:49:52.352414] ../../source3/winbindd/winbindd_idmap.c:175 [2025/04/09 07:49:52.352414] [0.000000] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:52.352423] ../../source3/winbindd/wb_xids2sids.c:194 [2025/04/09 07:49:52.353547] [0.001124] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:52.352484] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:52.353500] [0.001016] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:52.352485] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:52.353499] [0.001014] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:52.352487] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:52.353498] [0.001011] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:52.352603] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:52.353395] [0.000792] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:52.352605] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:52.353394] [0.000789] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:52.352605] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:52.353392] [0.000787] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:52.352606] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:52.352609] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:52.352617] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:52.353386] [0.000769] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:52.352617] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:52.352659] [0.000042] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:52.352618] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:52.352657] [0.000039] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:52.352661] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:52.353386] [0.000725] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:52.352661] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:52.353383] [0.000722] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:52.353560] ../../source3/winbindd/wb_xids2sids.c:209 [2025/04/09 07:50:14.466309] [22.112749] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:52.353614] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:59.444152] [7.090538] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:52.353615] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:59.444150] [7.090535] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:52.353617] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:59.444147] [7.090530] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:52.353703] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:59.444012] [7.090309] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:52.353705] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:59.444009] [7.090304] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:52.353705] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:59.444005] [7.090300] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:52.353707] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:52.353710] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:52.353717] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:59.443989] [7.090272] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:52.353717] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:52.353761] [0.000044] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:52.353728] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:52.353759] [0.000031] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:52.353763] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:59.443988] [7.090225] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:52.353764] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:59.443961] [7.090197] -> TEVENT_REQ_DONE (2 0)) > [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:49:59.444196] ../../source3/winbindd/wb_dsgetdcname.c:119 [2025/04/09 07:50:14.466259] [15.022063] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:49:59.444273] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:50:14.466257] [15.021984] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:49:59.444275] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:50:14.466250] [15.021975] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:59.444277] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:50:14.466247] [15.021970] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:59.444362] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:50:14.466130] [15.021768] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:59.444363] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:50:14.466121] [15.021758] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:49:59.444404] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:50:14.465896] [15.021492] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:59.444410] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:50:14.465893] [15.021483] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:59.444411] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:59.444418] [0.000007] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:59.444426] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:50:14.465879] [15.021453] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:59.444427] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:59.444458] [0.000031] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:59.444428] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:59.444456] [0.000028] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:59.444459] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:50:14.465878] [15.021419] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:59.444460] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:50:14.465873] [15.021413] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:50:14.466459] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:50:14.466524] [0.000065] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:14.466461] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:14.466490] [0.000029] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:50:14.469950, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:50:16.605355, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:50:16.605519, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:16.605547, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410045)]: request interface version (version = 32) >[2025/04/09 07:50:16.605607, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410045):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:16.607453, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:50:16.607486, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2410045)]: ping >[2025/04/09 07:50:16.607535, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410045):PING]: delivered response to client >[2025/04/09 07:50:16.611351, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:50:16.632234, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:50:16.632822, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:16.632853, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410053)]: request interface version (version = 32) >[2025/04/09 07:50:16.632899, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410053):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:16.633053, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:16.633084, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410053)]: request interface version (version = 32) >[2025/04/09 07:50:16.633126, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410053):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:16.633234, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:50:16.633260, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2410053)]: request misc info >[2025/04/09 07:50:16.633301, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410053):INFO]: delivered response to client >[2025/04/09 07:50:16.633396, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:50:16.633426, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2410053)]: request netbios name >[2025/04/09 07:50:16.633465, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410053):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:50:16.633565, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:50:16.633590, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2410053)]: request domain name >[2025/04/09 07:50:16.633629, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410053):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:50:16.633723, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2410053)] Handling async request: DOMAIN_INFO >[2025/04/09 07:50:16.633757, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2410053]: domain_info [ADPROTOCOLX] >[2025/04/09 07:50:16.633789, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2410053):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:50:16.633832, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410053):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:50:16.633947, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2410053)] Handling async request: PING_DC >[2025/04/09 07:50:16.634010, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:16.639263, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:16.639336, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2410053):PING_DC]: NT_STATUS_OK >[2025/04/09 07:50:16.639401, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410053):PING_DC]: delivered response to client >[2025/04/09 07:50:16.642075, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:50:19.653219, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:50:19.653421, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:19.653457, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410136)]: request interface version (version = 32) >[2025/04/09 07:50:19.653515, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410136):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:19.653662, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:19.653689, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410136)]: request interface version (version = 32) >[2025/04/09 07:50:19.653731, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410136):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:19.653840, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:50:19.653865, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2410136)]: request misc info >[2025/04/09 07:50:19.653916, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410136):INFO]: delivered response to client >[2025/04/09 07:50:19.654030, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:50:19.654071, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2410136)]: request netbios name >[2025/04/09 07:50:19.654126, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410136):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:50:19.654232, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:50:19.654268, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2410136)]: request domain name >[2025/04/09 07:50:19.654312, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410136):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:50:19.654486, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2410136)] Handling async request: DOMAIN_INFO >[2025/04/09 07:50:19.654516, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2410136]: domain_info [ADPROTOCOLX] >[2025/04/09 07:50:19.654558, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2410136):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:50:19.654614, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410136):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:50:19.654729, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2410136)] Handling async request: PING_DC >[2025/04/09 07:50:19.654767, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:19.658026, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:19.658099, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2410136):PING_DC]: NT_STATUS_OK >[2025/04/09 07:50:19.658147, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410136):PING_DC]: delivered response to client >[2025/04/09 07:50:19.659659, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:50:19.662192, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:50:19.662291, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:19.662318, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [nss_winbind (2410137)]: request interface version (version = 32) >[2025/04/09 07:50:19.662362, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2410137):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:19.662466, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [nss_winbind (2410137)] Handling async request: GETPWUID >[2025/04/09 07:50:19.662494, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) > [nss_winbind (2410137)] Winbind external command GETPWUID start. > Search UID 10001. >[2025/04/09 07:50:19.662519, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) > WB command xids2sids start. > Looking up 1 XID(s). >[2025/04/09 07:50:19.662608, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain GPFSNMBASH. >[2025/04/09 07:50:19.662651, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:50:19.662686, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'GPFSNMBASH' > domain_sid : S-1-5-21-421916222-1498683389-1809704761 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:50:19.664032, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_OK >[2025/04/09 07:50:19.664132, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) > Processing response for 1 xid(s). >[2025/04/09 07:50:19.664156, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) > 0: XID 10001 mapped to SID S-0-0. >[2025/04/09 07:50:19.664179, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) > Searching for 1 xid(s) in domain adprotocolx. >[2025/04/09 07:50:19.664199, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) > 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). >[2025/04/09 07:50:19.664240, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > in: struct wbint_UnixIDs2Sids > domain_name : * > domain_name : 'adprotocolx' > domain_sid : S-1-5-21-3967939894-2044440985-2694731363 > num_ids : 0x00000001 (1) > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) >[2025/04/09 07:50:27.091979, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids > out: struct wbint_UnixIDs2Sids > xids: ARRAY(1) > xids: struct unixid > id : 0x00002711 (10001) > type : ID_TYPE_UID (1) > sids: ARRAY(1) > sids : S-0-0 > result : NT_STATUS_HOST_UNREACHABLE >[2025/04/09 07:50:27.092109, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) > Domain controller not found. Calling wb_dsgetdcname_send() to get it. >[2025/04/09 07:50:27.092137, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) > WB command dsgetdcname start. > Search domain name adprotocolx and site name (null). >[2025/04/09 07:50:27.092177, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:50:27.101554, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) > wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX >[2025/04/09 07:50:27.101591, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:27.101658, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) > WB command dsgetdcname for adprotocolx end. >[2025/04/09 07:50:27.101692, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:137(wb_dsgetdcname_recv) > Failed for adprotocolx with NT_STATUS_NO_LOGON_SERVERS. >[2025/04/09 07:50:27.101715, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) > WB command xids2sids end. >[2025/04/09 07:50:27.101734, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:410(wb_xids2sids_recv) > wb_sids_to_xids failed: NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:27.101768, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) > Could not convert sid (NULL SID): NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:27.101790, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [nss_winbind(2410137):GETPWUID]: NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:27.101860, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) > Failed with NT_STATUS_NO_LOGON_SERVERS. >[2025/04/09 07:50:27.101901, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [nss_winbind(2410137):GETPWUID]: delivered response to client >[2025/04/09 07:50:27.101976, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) > winbind_client_processed: request took 7.439462 seconds > [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:50:19.662463] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:50:27.101925] [7.439462] -> TEVENT_REQ_DONE (2 0)) > [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:50:19.662493] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:50:27.101766] [7.439273] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:259 [2025/04/09 07:50:19.662519] ../../source3/winbindd/wb_xids2sids.c:352 [2025/04/09 07:50:27.101714] [7.439195] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:50:19.662601] ../../source3/winbindd/winbindd_idmap.c:175 [2025/04/09 07:50:19.662602] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:50:19.662607] ../../source3/winbindd/wb_xids2sids.c:194 [2025/04/09 07:50:19.664176] [0.001569] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:50:19.662682] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:50:19.664131] [0.001449] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:50:19.662683] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:50:19.664130] [0.001447] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:50:19.662684] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:50:19.664128] [0.001444] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:50:19.662790] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:50:19.664026] [0.001236] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:50:19.662798] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:50:19.664025] [0.001227] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:50:19.662798] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:50:19.664023] [0.001225] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:50:19.662800] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:50:19.662803] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:50:19.662826] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:50:19.664018] [0.001192] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:50:19.662826] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:50:19.662862] [0.000036] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:19.662827] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:19.662860] [0.000033] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:50:19.662863] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:50:19.664017] [0.001154] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:50:19.662863] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:50:19.664015] [0.001152] -> TEVENT_REQ_DONE (2 0)) > [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:50:19.664179] ../../source3/winbindd/wb_xids2sids.c:209 [2025/04/09 07:50:27.101712] [7.437533] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:50:19.664226] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:50:27.092107] [7.427881] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:50:19.664227] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:50:27.092105] [7.427878] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:50:19.664238] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:50:27.092102] [7.427864] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:50:19.664344] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:50:27.091935] [7.427591] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:50:19.664346] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:50:27.091933] [7.427587] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:50:19.664346] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:50:27.091929] [7.427583] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:50:19.664348] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:50:19.664351] [0.000003] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:50:19.664357] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:50:27.091906] [7.427549] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:50:19.664358] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:50:19.664391] [0.000033] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:19.664358] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:19.664389] [0.000031] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:50:19.664393] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:50:27.091905] [7.427512] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:50:19.664394] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:50:27.091900] [7.427506] -> TEVENT_REQ_DONE (2 0)) > [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:50:27.092136] ../../source3/winbindd/wb_dsgetdcname.c:119 [2025/04/09 07:50:27.101657] [0.009521] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) > [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:50:27.092171] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:50:27.101656] [0.009485] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:50:27.092173] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:50:27.101655] [0.009482] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:50:27.092174] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:50:27.101653] [0.009479] -> TEVENT_REQ_DONE (2 0)) > [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:50:27.092248] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:50:27.101589] [0.009341] -> TEVENT_REQ_DONE (2 0)) > [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:50:27.092250] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:50:27.101587] [0.009337] -> TEVENT_REQ_DONE (2 0)) > [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:50:27.092286] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:50:27.101539] [0.009253] -> TEVENT_REQ_DONE (2 0)) > [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:50:27.092293] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:50:27.101537] [0.009244] -> TEVENT_REQ_DONE (2 0)) > [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:50:27.092295] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:50:27.092296] [0.000001] -> TEVENT_REQ_DONE (2 0)) > [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:50:27.092309] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:50:27.101531] [0.009222] -> TEVENT_REQ_DONE (2 0)) > [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:50:27.092315] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:50:27.092354] [0.000039] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:27.092317] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:27.092352] [0.000035] -> TEVENT_REQ_DONE (2 0)) > [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:50:27.092357] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:50:27.101530] [0.009173] -> TEVENT_REQ_DONE (2 0)) > [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:50:27.092358] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:50:27.101528] [0.009170] -> TEVENT_REQ_DONE (2 0)) > [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:50:27.101824] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:50:27.101899] [0.000075] -> TEVENT_REQ_DONE (2 0)) > [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:27.101826] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:27.101850] [0.000024] -> TEVENT_REQ_DONE (2 0)) >[2025/04/09 07:50:27.105607, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:50:31.597017, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:50:31.597185, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:31.597229, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410359)]: request interface version (version = 32) >[2025/04/09 07:50:31.597280, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410359):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:31.597401, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:50:31.597436, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2410359)]: ping >[2025/04/09 07:50:31.597488, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410359):PING]: delivered response to client >[2025/04/09 07:50:31.599217, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:50:31.619937, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:50:31.620023, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:50:31.620180, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:50:31.620207, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:50:31.620246, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:50:31.620267, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline >[2025/04/09 07:50:31.620291, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:50:31.620314, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* >[2025/04/09 07:50:31.620450, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:51:24 AM 2025 EDT]) >[2025/04/09 07:50:31.620512, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], value=[c0000017], timeout=[Wed Apr 9 07:51:24 AM 2025 EDT]) >[2025/04/09 07:50:31.620543, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com]) >[2025/04/09 07:50:31.620659, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX >[2025/04/09 07:50:31.620685, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* >[2025/04/09 07:50:31.620818, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:51:24 AM 2025 EDT]) >[2025/04/09 07:50:31.620849, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], value=[c0000017], timeout=[Wed Apr 9 07:51:24 AM 2025 EDT]) >[2025/04/09 07:50:31.620876, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com]) >[2025/04/09 07:50:31.620925, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM >[2025/04/09 07:50:31.620994, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:31.621131, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:31.621157, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410368)]: request interface version (version = 32) >[2025/04/09 07:50:31.621205, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410368):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:31.622331, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:31.622361, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410368)]: request interface version (version = 32) >[2025/04/09 07:50:31.622404, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410368):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:31.622531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:50:31.622569, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2410368)]: request misc info >[2025/04/09 07:50:31.622609, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410368):INFO]: delivered response to client >[2025/04/09 07:50:31.622716, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:50:31.622742, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2410368)]: request netbios name >[2025/04/09 07:50:31.622793, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410368):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:50:31.623945, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:31.624027, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) > wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com >[2025/04/09 07:50:31.624115, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:50:31.624141, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2410368)]: request domain name >[2025/04/09 07:50:31.624187, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410368):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:50:31.624285, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2410368)] Handling async request: DOMAIN_INFO >[2025/04/09 07:50:31.624312, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2410368]: domain_info [ADPROTOCOLX] >[2025/04/09 07:50:31.624341, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2410368):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:50:31.624383, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410368):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:50:31.624503, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2410368)] Handling async request: PING_DC >[2025/04/09 07:50:31.624536, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:31.626801, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:31.626880, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2410368):PING_DC]: NT_STATUS_OK >[2025/04/09 07:50:31.626950, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410368):PING_DC]: delivered response to client >[2025/04/09 07:50:31.629827, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:50:46.589219, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:50:46.589429, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:46.589467, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410802)]: request interface version (version = 32) >[2025/04/09 07:50:46.589535, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410802):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:46.590490, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:50:46.590521, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2410802)]: ping >[2025/04/09 07:50:46.590575, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410802):PING]: delivered response to client >[2025/04/09 07:50:46.595044, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:50:46.622086, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:50:46.622201, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:46.622238, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410807)]: request interface version (version = 32) >[2025/04/09 07:50:46.622288, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410807):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:46.626945, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:50:46.626996, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2410807)]: request interface version (version = 32) >[2025/04/09 07:50:46.627050, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410807):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:50:46.627817, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:50:46.627846, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2410807)]: request misc info >[2025/04/09 07:50:46.627913, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410807):INFO]: delivered response to client >[2025/04/09 07:50:46.630747, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:50:46.630784, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2410807)]: request netbios name >[2025/04/09 07:50:46.630836, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410807):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:50:46.630936, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:50:46.630983, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2410807)]: request domain name >[2025/04/09 07:50:46.631027, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410807):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:50:46.631145, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2410807)] Handling async request: DOMAIN_INFO >[2025/04/09 07:50:46.631177, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2410807]: domain_info [ADPROTOCOLX] >[2025/04/09 07:50:46.631233, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2410807):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:50:46.631292, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410807):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:50:46.632016, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2410807)] Handling async request: PING_DC >[2025/04/09 07:50:46.632106, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:46.635817, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:46.635899, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2410807):PING_DC]: NT_STATUS_OK >[2025/04/09 07:50:46.635967, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2410807):PING_DC]: delivered response to client >[2025/04/09 07:50:46.637360, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:01.586275, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:51:01.586489, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:01.586523, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411105)]: request interface version (version = 32) >[2025/04/09 07:51:01.586588, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411105):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:01.587193, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:51:01.587245, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2411105)]: ping >[2025/04/09 07:51:01.587318, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411105):PING]: delivered response to client >[2025/04/09 07:51:01.593820, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:01.620718, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:51:01.620825, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:01.620851, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411111)]: request interface version (version = 32) >[2025/04/09 07:51:01.620897, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411111):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:01.621031, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:01.621060, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411111)]: request interface version (version = 32) >[2025/04/09 07:51:01.621102, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411111):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:01.621140, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:51:01.621202, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:51:01.621232, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:51:01.621257, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:51:01.621276, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline >[2025/04/09 07:51:01.621298, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:51:01.621342, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* >[2025/04/09 07:51:01.621688, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX >[2025/04/09 07:51:01.621715, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* >[2025/04/09 07:51:01.621872, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM >[2025/04/09 07:51:01.621943, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:01.622170, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:51:01.622202, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2411111)]: request misc info >[2025/04/09 07:51:01.622251, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411111):INFO]: delivered response to client >[2025/04/09 07:51:01.622345, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:51:01.622370, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2411111)]: request netbios name >[2025/04/09 07:51:01.622409, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411111):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:51:01.622501, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:51:01.622526, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2411111)]: request domain name >[2025/04/09 07:51:01.622566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411111):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:51:01.623826, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2411111)] Handling async request: DOMAIN_INFO >[2025/04/09 07:51:01.623870, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2411111]: domain_info [ADPROTOCOLX] >[2025/04/09 07:51:01.623918, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2411111):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:51:01.623999, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411111):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:51:01.624128, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2411111)] Handling async request: PING_DC >[2025/04/09 07:51:01.624170, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:01.626615, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:01.626698, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) > wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com >[2025/04/09 07:51:01.626757, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:01.626832, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2411111):PING_DC]: NT_STATUS_OK >[2025/04/09 07:51:01.626877, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411111):PING_DC]: delivered response to client >[2025/04/09 07:51:01.628257, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:07.032461, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b >[2025/04/09 07:51:07.032536, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2405698 >[2025/04/09 07:51:07.032583, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was offline, marking as online now! >[2025/04/09 07:51:07.042212, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) > wb_child_request_orphaned: cleanup orphaned subreq[0x55cf8259d020] >[2025/04/09 07:51:16.601693, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:51:16.601849, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:16.601876, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411417)]: request interface version (version = 32) >[2025/04/09 07:51:16.601923, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411417):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:16.602239, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:51:16.602270, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2411417)]: ping >[2025/04/09 07:51:16.602311, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411417):PING]: delivered response to client >[2025/04/09 07:51:16.604360, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:16.627104, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:51:16.628042, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:16.628090, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411424)]: request interface version (version = 32) >[2025/04/09 07:51:16.628141, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411424):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:16.628253, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:16.628279, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411424)]: request interface version (version = 32) >[2025/04/09 07:51:16.628317, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411424):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:16.628427, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:51:16.628450, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2411424)]: request misc info >[2025/04/09 07:51:16.628489, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411424):INFO]: delivered response to client >[2025/04/09 07:51:16.628579, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:51:16.628603, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2411424)]: request netbios name >[2025/04/09 07:51:16.628641, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411424):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:51:16.628774, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:51:16.628798, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2411424)]: request domain name >[2025/04/09 07:51:16.628836, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411424):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:51:16.628990, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2411424)] Handling async request: DOMAIN_INFO >[2025/04/09 07:51:16.629021, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2411424]: domain_info [ADPROTOCOLX] >[2025/04/09 07:51:16.629067, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2411424):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:51:16.629121, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411424):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:51:16.629270, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2411424)] Handling async request: PING_DC >[2025/04/09 07:51:16.629324, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:16.634659, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:16.634743, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2411424):PING_DC]: NT_STATUS_OK >[2025/04/09 07:51:16.634792, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411424):PING_DC]: delivered response to client >[2025/04/09 07:51:16.637813, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:31.616791, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:51:31.616926, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:31.616999, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411727)]: request interface version (version = 32) >[2025/04/09 07:51:31.617064, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411727):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:31.617220, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:51:31.617245, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2411727)]: ping >[2025/04/09 07:51:31.617288, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411727):PING]: delivered response to client >[2025/04/09 07:51:31.618489, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:31.626099, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:51:31.626184, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:51:31.626210, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:51:31.626236, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:51:31.626256, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:51:31.626286, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:51:31.639926, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:51:31.640049, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:31.640077, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411736)]: request interface version (version = 32) >[2025/04/09 07:51:31.640132, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411736):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:31.640237, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:31.640263, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2411736)]: request interface version (version = 32) >[2025/04/09 07:51:31.640304, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411736):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:31.640400, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:51:31.640425, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2411736)]: request misc info >[2025/04/09 07:51:31.640483, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411736):INFO]: delivered response to client >[2025/04/09 07:51:31.640590, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:51:31.640622, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2411736)]: request netbios name >[2025/04/09 07:51:31.640692, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411736):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:51:31.640820, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:51:31.640847, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2411736)]: request domain name >[2025/04/09 07:51:31.640887, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411736):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:51:31.641030, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2411736)] Handling async request: DOMAIN_INFO >[2025/04/09 07:51:31.641071, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2411736]: domain_info [ADPROTOCOLX] >[2025/04/09 07:51:31.641126, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2411736):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:51:31.641172, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411736):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:51:31.641272, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2411736)] Handling async request: PING_DC >[2025/04/09 07:51:31.641314, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:31.646310, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:31.646379, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2411736):PING_DC]: NT_STATUS_OK >[2025/04/09 07:51:31.646427, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2411736):PING_DC]: delivered response to client >[2025/04/09 07:51:31.649199, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:47.105711, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:51:47.105930, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:47.105988, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412183)]: request interface version (version = 32) >[2025/04/09 07:51:47.106043, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412183):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:47.106200, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:51:47.106227, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2412183)]: ping >[2025/04/09 07:51:47.106268, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412183):PING]: delivered response to client >[2025/04/09 07:51:47.107444, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:47.128245, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:51:47.128353, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:47.128381, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412189)]: request interface version (version = 32) >[2025/04/09 07:51:47.128427, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412189):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:47.128531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:51:47.128557, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412189)]: request interface version (version = 32) >[2025/04/09 07:51:47.128600, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412189):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:51:47.128698, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:51:47.128735, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2412189)]: request misc info >[2025/04/09 07:51:47.128780, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412189):INFO]: delivered response to client >[2025/04/09 07:51:47.128877, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:51:47.128903, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2412189)]: request netbios name >[2025/04/09 07:51:47.128944, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412189):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:51:47.129076, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:51:47.129103, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2412189)]: request domain name >[2025/04/09 07:51:47.129143, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412189):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:51:47.129244, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2412189)] Handling async request: DOMAIN_INFO >[2025/04/09 07:51:47.129272, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2412189]: domain_info [ADPROTOCOLX] >[2025/04/09 07:51:47.129351, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2412189):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:51:47.129417, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412189):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:51:47.129521, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2412189)] Handling async request: PING_DC >[2025/04/09 07:51:47.129594, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:47.134374, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:47.134453, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2412189):PING_DC]: NT_STATUS_OK >[2025/04/09 07:51:47.134528, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412189):PING_DC]: delivered response to client >[2025/04/09 07:51:47.135019, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:51:50.042140, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b >[2025/04/09 07:51:50.042259, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2398754 >[2025/04/09 07:51:50.042314, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) > winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! >[2025/04/09 07:52:01.608408, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:52:01.608575, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:01.608610, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412341)]: request interface version (version = 32) >[2025/04/09 07:52:01.608668, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412341):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:01.610054, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:52:01.610097, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2412341)]: ping >[2025/04/09 07:52:01.610147, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412341):PING]: delivered response to client >[2025/04/09 07:52:01.611385, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:52:01.627017, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:52:01.627089, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:52:01.627117, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:52:01.627143, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:52:01.627162, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:52:01.627186, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:52:01.632940, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:52:01.633062, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:01.633090, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412347)]: request interface version (version = 32) >[2025/04/09 07:52:01.633137, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412347):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:01.634558, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:01.634592, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412347)]: request interface version (version = 32) >[2025/04/09 07:52:01.634639, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412347):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:01.634748, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:52:01.634790, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2412347)]: request misc info >[2025/04/09 07:52:01.634834, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412347):INFO]: delivered response to client >[2025/04/09 07:52:01.635331, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:52:01.635364, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2412347)]: request netbios name >[2025/04/09 07:52:01.635416, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412347):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:52:01.635517, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:52:01.635544, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2412347)]: request domain name >[2025/04/09 07:52:01.635584, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412347):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:52:01.635690, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2412347)] Handling async request: DOMAIN_INFO >[2025/04/09 07:52:01.635725, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2412347]: domain_info [ADPROTOCOLX] >[2025/04/09 07:52:01.635755, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2412347):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:52:01.635817, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412347):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:52:01.635923, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2412347)] Handling async request: PING_DC >[2025/04/09 07:52:01.636003, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:52:01.640211, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:52:01.640282, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2412347):PING_DC]: NT_STATUS_OK >[2025/04/09 07:52:01.640341, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412347):PING_DC]: delivered response to client >[2025/04/09 07:52:01.641942, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:52:05.045526, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) > wb_child_request_orphaned: cleanup orphaned subreq[0x55cf825d5f00] >[2025/04/09 07:52:16.634669, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:52:16.634908, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:16.634945, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412662)]: request interface version (version = 32) >[2025/04/09 07:52:16.635059, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412662):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:16.642292, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:52:16.642347, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2412662)]: ping >[2025/04/09 07:52:16.642397, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412662):PING]: delivered response to client >[2025/04/09 07:52:16.648291, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:52:16.668103, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:52:16.668271, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:16.668301, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412676)]: request interface version (version = 32) >[2025/04/09 07:52:16.668346, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412676):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:16.668442, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:16.668469, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412676)]: request interface version (version = 32) >[2025/04/09 07:52:16.668509, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412676):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:16.668606, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:52:16.668632, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2412676)]: request misc info >[2025/04/09 07:52:16.668686, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412676):INFO]: delivered response to client >[2025/04/09 07:52:16.668811, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:52:16.668838, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2412676)]: request netbios name >[2025/04/09 07:52:16.668891, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412676):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:52:16.669048, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:52:16.669079, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2412676)]: request domain name >[2025/04/09 07:52:16.669121, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412676):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:52:16.669229, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2412676)] Handling async request: DOMAIN_INFO >[2025/04/09 07:52:16.669271, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2412676]: domain_info [ADPROTOCOLX] >[2025/04/09 07:52:16.669344, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2412676):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:52:16.669404, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412676):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:52:16.669518, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2412676)] Handling async request: PING_DC >[2025/04/09 07:52:16.669580, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:52:16.672500, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:52:16.672581, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2412676):PING_DC]: NT_STATUS_OK >[2025/04/09 07:52:16.672633, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412676):PING_DC]: delivered response to client >[2025/04/09 07:52:16.673946, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:52:31.613060, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:52:31.618721, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:31.618761, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412969)]: request interface version (version = 32) >[2025/04/09 07:52:31.618811, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412969):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:31.618931, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:52:31.618983, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2412969)]: ping >[2025/04/09 07:52:31.619028, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412969):PING]: delivered response to client >[2025/04/09 07:52:31.624888, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:52:31.635813, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:52:31.635904, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:52:31.635944, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:52:31.635991, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:52:31.636013, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is online >[2025/04/09 07:52:31.636037, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:52:31.645212, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:52:31.646307, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:31.646341, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412980)]: request interface version (version = 32) >[2025/04/09 07:52:31.646392, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412980):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:31.646516, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:31.646543, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2412980)]: request interface version (version = 32) >[2025/04/09 07:52:31.646584, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412980):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:31.646679, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:52:31.646704, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2412980)]: request misc info >[2025/04/09 07:52:31.646766, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412980):INFO]: delivered response to client >[2025/04/09 07:52:31.647177, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:52:31.647210, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2412980)]: request netbios name >[2025/04/09 07:52:31.647263, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412980):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:52:31.647356, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:52:31.647406, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2412980)]: request domain name >[2025/04/09 07:52:31.647447, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412980):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:52:31.647550, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2412980)] Handling async request: DOMAIN_INFO >[2025/04/09 07:52:31.647577, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2412980]: domain_info [ADPROTOCOLX] >[2025/04/09 07:52:31.647624, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2412980):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:52:31.647669, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412980):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:52:31.647777, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2412980)] Handling async request: PING_DC >[2025/04/09 07:52:31.647833, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:52:31.650691, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:52:31.650775, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2412980):PING_DC]: NT_STATUS_OK >[2025/04/09 07:52:31.650832, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2412980):PING_DC]: delivered response to client >[2025/04/09 07:52:31.654124, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:52:33.045458, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) > imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40c >[2025/04/09 07:52:33.045540, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) > messaging_recv_cb: Received message 0x40c len 12 (num_fds:0) from 1:2405715 >[2025/04/09 07:52:33.045592, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:126(winbind_msg_domain_offline) > winbind_msg_domain_offline: Domain ADPROTOCOLX was online, change to offline now. >[2025/04/09 07:52:33.045663, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) > wb_child_request_orphaned: cleanup orphaned subreq[0x55cf825d1cc0] >[2025/04/09 07:52:46.627121, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:52:46.628253, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:46.628289, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2413274)]: request interface version (version = 32) >[2025/04/09 07:52:46.628338, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413274):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:46.628471, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:52:46.628497, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2413274)]: ping >[2025/04/09 07:52:46.628536, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413274):PING]: delivered response to client >[2025/04/09 07:52:46.630646, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:52:46.649394, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:52:46.649483, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:46.649509, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2413282)]: request interface version (version = 32) >[2025/04/09 07:52:46.649553, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413282):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:46.649657, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:52:46.649682, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2413282)]: request interface version (version = 32) >[2025/04/09 07:52:46.649739, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413282):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:52:46.649841, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:52:46.649865, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2413282)]: request misc info >[2025/04/09 07:52:46.649916, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413282):INFO]: delivered response to client >[2025/04/09 07:52:46.650030, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:52:46.650058, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2413282)]: request netbios name >[2025/04/09 07:52:46.650118, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413282):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:52:46.650215, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:52:46.650239, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2413282)]: request domain name >[2025/04/09 07:52:46.650277, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413282):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:52:46.650368, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2413282)] Handling async request: DOMAIN_INFO >[2025/04/09 07:52:46.650394, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2413282]: domain_info [ADPROTOCOLX] >[2025/04/09 07:52:46.650441, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2413282):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:52:46.650486, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413282):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:52:46.650582, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2413282)] Handling async request: PING_DC >[2025/04/09 07:52:46.650618, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:52:46.654184, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:52:46.654253, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2413282):PING_DC]: NT_STATUS_OK >[2025/04/09 07:52:46.654301, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413282):PING_DC]: delivered response to client >[2025/04/09 07:52:46.656673, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:53:01.616058, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:53:01.616266, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:01.616294, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2413715)]: request interface version (version = 32) >[2025/04/09 07:53:01.616339, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413715):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:01.616468, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:53:01.616493, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2413715)]: ping >[2025/04/09 07:53:01.616531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413715):PING]: delivered response to client >[2025/04/09 07:53:01.618605, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:53:01.645030, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:53:01.645136, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:53:01.645240, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:53:01.645265, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:53:01.645289, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:53:01.645308, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline >[2025/04/09 07:53:01.645330, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:53:01.645355, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* >[2025/04/09 07:53:01.645627, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:53:33 AM 2025 EDT]) >[2025/04/09 07:53:01.645692, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], value=[c000020d], timeout=[Wed Apr 9 07:53:33 AM 2025 EDT]) >[2025/04/09 07:53:01.645723, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com]) >[2025/04/09 07:53:01.645886, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX >[2025/04/09 07:53:01.645913, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* >[2025/04/09 07:53:01.646083, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:53:33 AM 2025 EDT]) >[2025/04/09 07:53:01.646141, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) > Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], value=[c000020d], timeout=[Wed Apr 9 07:53:33 AM 2025 EDT]) >[2025/04/09 07:53:01.646171, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com]) >[2025/04/09 07:53:01.646220, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM >[2025/04/09 07:53:01.646301, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:01.646455, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:01.646481, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2413720)]: request interface version (version = 32) >[2025/04/09 07:53:01.646524, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413720):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:01.647033, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:01.647064, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2413720)]: request interface version (version = 32) >[2025/04/09 07:53:01.647106, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413720):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:01.647200, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:53:01.647234, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2413720)]: request misc info >[2025/04/09 07:53:01.647276, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413720):INFO]: delivered response to client >[2025/04/09 07:53:01.647707, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:53:01.647735, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2413720)]: request netbios name >[2025/04/09 07:53:01.647782, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413720):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:53:01.647876, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:53:01.647900, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2413720)]: request domain name >[2025/04/09 07:53:01.647938, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413720):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:53:01.648061, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2413720)] Handling async request: DOMAIN_INFO >[2025/04/09 07:53:01.648088, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2413720]: domain_info [ADPROTOCOLX] >[2025/04/09 07:53:01.648128, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2413720):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:53:01.648180, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413720):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:53:01.648277, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2413720)] Handling async request: PING_DC >[2025/04/09 07:53:01.648317, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:01.653217, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:01.653284, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2413720):PING_DC]: NT_STATUS_OK >[2025/04/09 07:53:01.653330, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2413720):PING_DC]: delivered response to client >[2025/04/09 07:53:01.653397, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:01.653467, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) > wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com >[2025/04/09 07:53:01.657165, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:53:16.641264, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:53:16.642311, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:16.642357, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2414025)]: request interface version (version = 32) >[2025/04/09 07:53:16.642421, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414025):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:16.642536, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:53:16.642562, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2414025)]: ping >[2025/04/09 07:53:16.642601, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414025):PING]: delivered response to client >[2025/04/09 07:53:16.644792, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:53:16.664616, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:53:16.664759, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:16.664786, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2414034)]: request interface version (version = 32) >[2025/04/09 07:53:16.664841, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414034):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:16.664944, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:16.664996, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2414034)]: request interface version (version = 32) >[2025/04/09 07:53:16.665039, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414034):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:16.665139, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:53:16.665181, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2414034)]: request misc info >[2025/04/09 07:53:16.665245, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414034):INFO]: delivered response to client >[2025/04/09 07:53:16.665389, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:53:16.665414, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2414034)]: request netbios name >[2025/04/09 07:53:16.665460, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414034):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:53:16.665550, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:53:16.665574, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2414034)]: request domain name >[2025/04/09 07:53:16.665612, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414034):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:53:16.665703, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2414034)] Handling async request: DOMAIN_INFO >[2025/04/09 07:53:16.665729, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2414034]: domain_info [ADPROTOCOLX] >[2025/04/09 07:53:16.665791, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2414034):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:53:16.665847, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414034):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:53:16.665943, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2414034)] Handling async request: PING_DC >[2025/04/09 07:53:16.666030, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:16.669754, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:16.669831, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2414034):PING_DC]: NT_STATUS_OK >[2025/04/09 07:53:16.669887, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414034):PING_DC]: delivered response to client >[2025/04/09 07:53:16.672656, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:53:31.641086, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:53:31.641286, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:31.641319, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2414326)]: request interface version (version = 32) >[2025/04/09 07:53:31.641383, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414326):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:31.641932, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn PING >[2025/04/09 07:53:31.642006, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) > winbindd_ping: [wbinfo (2414326)]: ping >[2025/04/09 07:53:31.642065, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414326):PING]: delivered response to client >[2025/04/09 07:53:31.644696, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited >[2025/04/09 07:53:31.655342, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain BUILTIN is online >[2025/04/09 07:53:31.655615, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:53:31.655651, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain GPFSNMBASH is online >[2025/04/09 07:53:31.655678, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:53:31.655698, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) > winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline >[2025/04/09 07:53:31.655721, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:53:31.655773, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* >[2025/04/09 07:53:31.656171, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX >[2025/04/09 07:53:31.656205, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) > Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* >[2025/04/09 07:53:31.656357, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) > flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM >[2025/04/09 07:53:31.656445, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:31.663997, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:31.664072, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) > wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com >[2025/04/09 07:53:31.673526, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) > Accepted client socket 27 >[2025/04/09 07:53:31.673600, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:31.673624, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2414343)]: request interface version (version = 32) >[2025/04/09 07:53:31.673667, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414343):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:31.673759, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INTERFACE_VERSION >[2025/04/09 07:53:31.673784, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) > winbindd_interface_version: [wbinfo (2414343)]: request interface version (version = 32) >[2025/04/09 07:53:31.673826, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414343):INTERFACE_VERSION]: delivered response to client >[2025/04/09 07:53:31.673918, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn INFO >[2025/04/09 07:53:31.673942, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) > winbindd_info: [wbinfo (2414343)]: request misc info >[2025/04/09 07:53:31.674019, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414343):INFO]: delivered response to client >[2025/04/09 07:53:31.674114, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn NETBIOS_NAME >[2025/04/09 07:53:31.674139, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) > winbindd_netbios_name: [wbinfo (2414343)]: request netbios name >[2025/04/09 07:53:31.674177, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414343):NETBIOS_NAME]: delivered response to client >[2025/04/09 07:53:31.674268, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) > process_request_send: process_request: request fn DOMAIN_NAME >[2025/04/09 07:53:31.674292, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) > winbindd_domain_name: [wbinfo (2414343)]: request domain name >[2025/04/09 07:53:31.674335, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414343):DOMAIN_NAME]: delivered response to client >[2025/04/09 07:53:31.674427, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2414343)] Handling async request: DOMAIN_INFO >[2025/04/09 07:53:31.674471, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) > [2414343]: domain_info [ADPROTOCOLX] >[2025/04/09 07:53:31.674517, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2414343):DOMAIN_INFO]: NT_STATUS_OK >[2025/04/09 07:53:31.674561, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414343):DOMAIN_INFO]: delivered response to client >[2025/04/09 07:53:31.674672, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) > process_request_send: [wbinfo (2414343)] Handling async request: PING_DC >[2025/04/09 07:53:31.674712, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:31.676763, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:31.676828, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) > process_request_done: [wbinfo(2414343):PING_DC]: NT_STATUS_OK >[2025/04/09 07:53:31.676874, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) > process_request_written: [wbinfo(2414343):PING_DC]: delivered response to client >[2025/04/09 07:53:31.679607, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) > closing socket 27, client exited > >Logs name: log.wb-ADPROTOCOLX.scenario3 >======================== >[2025/04/09 07:45:31.561055, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:45:31.561123, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:45:31.561278, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:31.561449, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:45:31.561625, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000001b (27) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:31.561845, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:31.562017, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:31.562126, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:31.565688, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:45:31.565741, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000001b (27) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] DB 9B D5 1D BF 78 1B D6 CC AE 64 E9 43 6D 5C 15 .....x.. ..d.Cm\. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 02 2B C4 94 BA AD D0 4D B7 C5 B4 C6 85 FF 9A 7B .+.....M .......{ > [0030] 73 EC B6 E9 A5 8F C3 2D 00 00 00 00 00 00 00 00 s......- ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:45:31.566039, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:31.566065, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:45:31.566084, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:31.566120, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:45:31.566143, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:31.566170, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:45:31.566200, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:45:31.566304, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:45:31.566335, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:31.566406, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:45:31.566427, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:45:44.814224, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:45:44.814337, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:45:44.814439, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:44.814542, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:45:44.814663, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000001c (28) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:44.814882, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:44.815056, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:44.815134, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:44.816169, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:45:44.816217, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000001c (28) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 7D 48 09 30 32 C3 86 A8 8C E4 67 33 09 C1 AE 04 }H.02... ..g3.... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 08 24 67 39 3E 7A F2 20 6F 84 74 FC D8 3D AD A7 .$g9>z. o.t..=.. > [0030] 11 B8 44 5C 56 98 91 E5 00 00 00 00 00 00 00 00 ..D\V... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:45:44.816488, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:44.816511, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:45:44.816531, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:44.816563, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:45:44.816585, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:44.816613, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:45:44.816644, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:45:44.816732, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:45:44.816755, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:44.816814, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:45:44.816834, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:45:44.832707, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:45:44.832756, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:45:44.832780, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:45:44.832841, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:44.832921, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:45:44.832975, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:45:44.833013, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:45:44.833040, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:45:44.833077, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:203(winbindd_domain_init_backend) > winbindd_domain_init_backend: Setting MS-RPC methods for domain ADPROTOCOLX >[2025/04/09 07:45:44.833114, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:45:44.833547, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:44.834803, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 07:45:44.834870, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc1.adprotocolx.com auth_type 9, auth_level 6 >[2025/04/09 07:45:44.834912, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 07:45:44.835009, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 07:45:44.841421, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf82595480]: subreq: 0x55cf825a79f0 >[2025/04/09 07:45:44.841454, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf825cca90]: subreq: 0x55cf8258ff90 >[2025/04/09 07:45:44.841488, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf82595480]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825a79f0/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] >[2025/04/09 07:45:44.841578, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf825cca90]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf8258ff90/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf82590170)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:45:44.841618, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=2887 > [0000] 60 82 0B 43 06 06 2B 06 01 05 05 02 A0 82 0B 37 `..C..+. .......7 > [0010] 30 82 0B 33 A0 24 30 22 06 09 2A 86 48 82 F7 12 0..3.$0" ..*.H... > [0020] 01 02 02 06 09 2A 86 48 86 F7 12 01 02 02 06 0A .....*.H ........ > [0030] 2B 06 01 04 01 82 37 02 02 0A A2 82 0B 09 04 82 +.....7. ........ > [0040] 0B 05 6E 82 0B 01 30 82 0A FD A0 03 02 01 05 A1 ..n...0. ........ > [0050] 03 02 01 0E A2 07 03 05 00 20 00 00 00 A3 82 04 ........ . ...... > [0060] 4C 61 82 04 48 30 82 04 44 A0 03 02 01 05 A1 11 La..H0.. D....... > [0070] 1B 0F 41 44 50 52 4F 54 4F 43 4F 4C 58 2E 43 4F ..ADPROT OCOLX.CO > [0080] 4D A2 29 30 27 A0 03 02 01 01 A1 20 30 1E 1B 04 M.)0'... ... 0... > [0090] 68 6F 73 74 1B 16 77 69 6E 64 63 31 2E 61 64 70 host..wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 2E 63 6F 6D A3 82 03 FD rotocolx .com.... > [00B0] 30 82 03 F9 A0 03 02 01 12 A1 03 02 01 03 A2 82 0....... ........ > [00C0] 03 EB 04 82 03 E7 06 1F 8F 84 74 CE 99 4A 3D 11 ........ ..t..J=. > [00D0] 93 20 46 0C AA A0 44 62 76 31 3E FA D7 52 8C EA . F...Db v1>..R.. > [00E0] 8D F3 05 CE A6 76 84 C4 2C BC DB 1D 92 97 B5 F6 .....v.. ,....... > [00F0] BF 7B 85 BF EF 76 1B 99 1F CA BB 30 0A C0 B7 45 .{...v.. ...0...E > [0100] D7 81 FF 33 26 AD 92 6D 08 95 8C 6F 2E D3 ED 1B ...3&..m ...o.... > [0110] 48 8E 7D E2 AD 61 FB 69 C8 04 F1 90 DF 10 80 61 H.}..a.i .......a > [0120] 55 40 95 9B D6 48 55 D4 A9 E8 88 5A 60 BA C3 6B U@...HU. ...Z`..k > [0130] 77 ED 93 29 A7 85 A5 96 61 BD 66 0F AD 0F 32 80 w..).... a.f...2. > [0140] EA A5 01 D7 31 F6 4A 8C A6 16 E8 F6 3D 98 E6 BE ....1.J. ....=... > [0150] B8 FA 0F 88 7F 00 67 C5 A9 9E F8 BC C6 43 FD 18 ......g. .....C.. > [0160] 68 FF 95 F0 19 CB D0 4F 33 BA D6 33 BE 4A A4 E3 h......O 3..3.J.. > [0170] 96 00 D3 04 CA 7A CA 37 25 07 CF 19 52 82 CD 4F .....z.7 %...R..O > [0180] 2F E8 F5 B9 EB 1B 53 1D FB 52 77 65 8F 25 86 95 /.....S. .Rwe.%.. > [0190] F0 25 A9 FB 67 2F 56 12 41 58 E5 5A BB 73 7B A5 .%..g/V. AX.Z.s{. > [01A0] 9D 75 CF 52 38 53 22 66 19 8C 2B DE BA FE 98 86 .u.R8S"f ..+..... > [01B0] 51 A9 12 61 52 28 34 F1 A4 5B 60 ED C5 44 95 11 Q..aR(4. .[`..D.. > [01C0] 42 FD E5 23 80 50 77 22 7A 2E 45 CD 92 3B A2 1B B..#.Pw" z.E..;.. > [01D0] 25 E9 DB 19 FC 17 11 9E 3A CA 6C 91 14 58 39 D5 %....... :.l..X9. > [01E0] BC 14 F2 4D F6 90 B8 55 79 C7 7A 16 70 03 B5 74 ...M...U y.z.p..t > [01F0] 1B 1E 14 4E 20 E5 D0 99 4C CA A2 60 4F FB 70 7F ...N ... L..`O.p. > [0200] F2 09 33 91 F4 83 B1 1B D0 A2 02 A7 66 F0 93 24 ..3..... ....f..$ > [0210] C5 FE C8 A0 A7 65 14 1C 0D 8F 59 C1 5D 6C 1B 70 .....e.. ..Y.]l.p > [0220] 89 31 C7 6F D2 E4 5F 04 C1 8D 3D 19 74 84 B5 2B .1.o.._. ..=.t..+ > [0230] 16 2F 81 E1 03 3A 1B 8C 9C 93 04 03 06 06 22 2D ./...:.. ......"- > [0240] 9B C1 32 0B B6 AD 01 70 BD 81 F0 4B 2A 3B B5 79 ..2....p ...K*;.y > [0250] 28 78 2D CC 31 1E BB 73 BB 93 CA 5E 23 0D 8D 2C (x-.1..s ...^#.., > [0260] DE D5 DC 79 1F 71 DA 9C 80 5C 02 BA C4 8F DB 9B ...y.q.. .\...... > [0270] E2 6F 16 35 B3 8C CD CF 4B 82 50 BB 81 92 E1 BD .o.5.... K.P..... > [0280] 42 19 03 2A 41 A8 B2 4C CA 58 97 71 93 8F 16 58 B..*A..L .X.q...X > [0290] 14 39 03 D2 EC 9A 99 78 82 70 3A 94 E5 F2 AB CB .9.....x .p:..... > [02A0] FA 04 0E 70 35 D0 04 F7 26 A7 9E 83 D6 0A 03 8A ...p5... &....... > [02B0] 2C 49 76 C3 03 C2 FA E2 02 DE 5D 72 9E BA A0 AD ,Iv..... ..]r.... > [02C0] CE 0F BD F2 FE C4 00 27 43 06 D7 6D AB 08 C3 9B .......' C..m.... > [02D0] D3 16 44 A9 79 46 60 1D A4 96 FF 89 FA 0E 21 F3 ..D.yF`. ......!. > [02E0] 32 89 B7 5E BB 5E 1A 64 0E 72 D2 4E 97 F2 27 48 2..^.^.d .r.N..'H > [02F0] 24 4A 85 C9 87 04 9F 12 E1 A0 A6 B4 71 0E 34 0B $J...... ....q.4. > [0300] 2A 66 48 52 F5 0A 26 10 C4 2B 74 A3 B8 87 74 6C *fHR..&. .+t...tl > [0310] C5 BB 40 A1 5C F1 E4 20 90 AC DF D8 A2 50 EE 65 ..@.\.. .....P.e > [0320] CC 40 56 2E AF 93 39 00 21 CF F5 CD 82 96 E7 57 .@V...9. !......W > [0330] E7 92 6F 69 A3 CF 9D CB E7 81 11 10 E4 DA 25 8B ..oi.... ......%. > [0340] EA 1A 9E 66 5B F8 A3 1F 27 48 86 F1 39 5E DB 56 ...f[... 'H..9^.V > [0350] E2 7A 3A 7F 0B E9 2F ED 65 89 ED EF 65 D3 C8 8B .z:.../. e...e... > [0360] 79 35 C8 DB F1 D0 57 98 17 02 0C D8 CE AE 98 D4 y5....W. ........ > [0370] DC 74 24 64 A8 34 13 EB 8B BD 07 AA 6A 1D BE 8D .t$d.4.. ....j... > [0380] A3 48 22 C8 29 E2 EF CC 44 98 5D C5 6C 5C 70 DB .H".)... D.].l\p. > [0390] 1F 75 FD D8 50 9B 9F 7A 35 26 1D B1 11 2B 00 AB .u..P..z 5&...+.. > [03A0] 91 25 F0 C5 70 01 E5 D4 DF 3C 7D E5 50 69 C1 95 .%..p... .<}.Pi.. > [03B0] E6 2E BE 86 CF 50 57 F8 BE 5B 71 4D 09 AF C2 16 .....PW. .[qM.... > [03C0] D5 55 86 D7 79 B6 6D F1 24 69 D9 13 65 64 E7 41 .U..y.m. $i..ed.A > [03D0] 37 01 72 B3 BF B0 7A CB BE 5A D0 9D 0B AA 41 BF 7.r...z. .Z....A. > [03E0] 5B B5 05 05 20 95 DB 9D 5E 4E BC 4F 05 0F BE 08 [... ... ^N.O.... > [03F0] E1 DC 08 CB 70 16 F4 5F 20 85 77 7A 06 43 EC B2 ....p.._ .wz.C.. > [0400] A6 6D 1D F1 01 0E 14 8A 9D 27 2F E0 E2 BD 5C CF .m...... .'/...\. > [0410] C3 5A 8F 63 81 43 CF 87 5E EC E8 10 57 5C 26 5A .Z.c.C.. ^...W\&Z > [0420] 77 30 12 AC 51 C5 A8 84 FC 74 54 C0 A6 51 04 0E w0..Q... .tT..Q.. > [0430] AB 03 14 66 9C 5F C9 B4 85 47 4B 76 AF BC 14 48 ...f._.. .GKv...H > [0440] F2 E2 38 FB E4 E2 8C DE 5E 99 15 72 A4 39 9B 4D ..8..... ^..r.9.M > [0450] 4E 31 DE CE 98 72 33 73 8F D4 3A C2 7F 3F 03 D3 N1...r3s ..:..?.. > [0460] 04 52 27 FA 01 E6 65 10 D3 88 FF 65 8C B8 AE 36 .R'...e. ...e...6 > [0470] E7 BD 11 28 F6 43 B2 41 4A BD 90 18 3C 09 A9 22 ...(.C.A J...<.." > [0480] B9 2E 8A BD 41 39 00 5E 4B 56 0F B4 E5 05 87 49 ....A9.^ KV.....I > [0490] 71 9F 00 C1 F7 BD B0 6B 9D 5B A0 C1 B8 34 0D F6 q......k .[...4.. > [04A0] 87 41 8B 4A 03 CC 6B A5 2F D2 80 C3 6E A4 82 06 .A.J..k. /...n... > [04B0] 96 30 82 06 92 A0 03 02 01 12 A2 82 06 89 04 82 .0...... ........ > [04C0] 06 85 83 10 A4 96 24 2E CC 42 D3 F6 59 19 6F 2F ......$. .B..Y.o/ > [04D0] CF 30 EF E3 CA 03 C2 C8 73 73 36 B5 A8 C4 55 CD .0...... ss6...U. > [04E0] 6B CA 52 C1 4C F2 10 33 6A 94 A0 6E B1 94 1C B3 k.R.L..3 j..n.... > [04F0] 39 ED 13 E3 D7 72 60 2A 09 D8 13 35 60 9E CF 18 9....r`* ...5`... > [0500] 97 E7 AA E2 D7 D6 58 5B 82 29 B2 D6 DE 12 C4 B8 ......X[ .)...... > [0510] DB 32 38 99 55 79 B0 C2 B1 9F 6F 03 E2 3B 53 17 .28.Uy.. ..o..;S. > [0520] C6 26 BE 8A EA B2 E1 55 F7 A6 FE 86 0F 06 73 91 .&.....U ......s. > [0530] 6B B1 4D 04 F1 D1 96 DE FF 61 C2 DC 91 5E 6D 1F k.M..... .a...^m. > [0540] 9C 9C 87 90 03 E7 28 69 92 C6 C4 54 54 39 75 7A ......(i ...TT9uz > [0550] 7B F2 4A 3B C2 D7 EE 53 3B FE 86 AB 05 94 65 75 {.J;...S ;.....eu > [0560] 81 B3 2A 2F 64 0A 0A CB C6 88 F3 4E 3D 59 9B 78 ..*/d... ...N=Y.x > [0570] 87 0A AE 93 A6 F2 E9 7B 13 45 17 B6 73 20 83 EC .......{ .E..s .. > [0580] AB 23 3A 4B 1D CF 55 5D F5 49 C4 DF B9 01 C5 5D .#:K..U] .I.....] > [0590] A3 5A 08 C8 22 82 CC 77 68 E0 11 BD 2A C6 B1 8A .Z.."..w h...*... > [05A0] 55 E9 22 BC 5E 16 91 62 69 62 13 FC 41 10 29 73 U.".^..b ib..A.)s > [05B0] EE E3 E4 94 CF 5D 3B FF AF 21 E6 8A AA 63 15 20 .....];. .!...c. > [05C0] C3 F5 6D 66 3D BA 63 55 4C 60 0B CB A7 93 53 A3 ..mf=.cU L`....S. > [05D0] A6 C4 CE 49 D8 11 39 F8 08 DC A6 BF C9 46 69 58 ...I..9. .....FiX > [05E0] 91 E8 88 DE 15 C0 33 52 DF 25 2C A1 08 03 34 57 ......3R .%,...4W > [05F0] 2C E4 BA 05 CC D4 92 90 04 C0 A3 FC A2 D0 44 43 ,....... ......DC > [0600] 34 BF EF 2B 24 41 82 83 A9 CA 0B 9E DD C9 7F 37 4..+$A.. .......7 > [0610] D0 65 B2 B3 70 58 FA 41 81 B9 1F E7 39 8E A0 70 .e..pX.A ....9..p > [0620] C5 BA E6 FF BA 98 35 EA 1A 27 46 19 3A 5B 31 EF ......5. .'F.:[1. > [0630] 3C 95 B2 FE 83 4F E4 8B 2D D1 E1 F4 5E D4 AA 49 <....O.. -...^..I > [0640] E0 14 D8 22 B6 34 18 C5 C9 F4 8E 77 2D E9 EC 56 ...".4.. ...w-..V > [0650] 39 CF 44 71 9E 51 21 21 52 07 6F 94 52 7A EF F3 9.Dq.Q!! R.o.Rz.. > [0660] 00 D0 42 5F 56 43 CF 3E 3A CC 88 D1 AC FC 12 66 ..B_VC.> :......f > [0670] BE A0 BB 40 BF 52 46 68 12 0F 07 6D 81 1F 25 55 ...@.RFh ...m..%U > [0680] 71 49 90 ED AE 14 2D 6C D5 BB DE A9 36 DB 26 1C qI....-l ....6.&. > [0690] 76 C3 13 C5 BD AB A5 CC C6 6C EB F7 27 9A A4 5D v....... .l..'..] > [06A0] ED 98 88 F5 FD 07 EE D3 71 22 1F 03 03 68 A3 4A ........ q"...h.J > [06B0] D0 68 60 75 C8 94 C8 0A 58 0F 8B 13 03 18 C6 11 .h`u.... X....... > [06C0] FC C4 E8 E8 7B 2A 8C 30 94 7A 45 EA D9 FB D8 0C ....{*.0 .zE..... > [06D0] 93 E5 07 3A 20 68 66 96 93 F5 BE B4 73 7E D4 70 ...: hf. ....s~.p > [06E0] 93 71 8C C7 FC 58 27 FF B1 1B 2C 85 9E 51 3B 07 .q...X'. ..,..Q;. > [06F0] B9 1A D2 4C DB 7A D2 D1 28 61 55 D9 6F B2 45 E2 ...L.z.. (aU.o.E. > [0700] FD 94 8E C7 81 66 C0 AB 3A 1B B3 C5 D9 CA B5 93 .....f.. :....... > [0710] 79 56 26 8E 05 50 68 AC D8 D4 5E 84 5C 64 B3 62 yV&..Ph. ..^.\d.b > [0720] 84 81 55 06 DF 51 F6 0E 1B 41 A5 DA 12 95 9F AB ..U..Q.. .A...... > [0730] 2C C1 3F 5B E4 D6 1F 76 CD 55 70 CD 07 1D CC 7D ,.?[...v .Up....} > [0740] DE 5F 2F DE 7C 98 1B 3B 5E 27 D0 7E 95 46 54 77 ._/.|..; ^'.~.FTw > [0750] AA B9 17 21 C7 AB F8 32 5A D1 1C D0 8A DA B2 FB ...!...2 Z....... > [0760] 05 CB FC CE 08 B0 83 05 C7 85 A1 E4 9C 96 03 D7 ........ ........ > [0770] BD BA CF 83 8D D7 71 21 8B 0C 08 AC 38 AA 87 EC ......q! ....8... > [0780] 84 91 DB 29 66 0C A1 14 23 1D BB E6 78 92 1A 51 ...)f... #...x..Q > [0790] 0F 55 70 14 20 60 56 E5 EB B1 C8 B3 3E 78 49 DB .Up. `V. ....>xI. > [07A0] 5A EE 61 B4 74 FE 8C 7D A5 45 A2 59 35 EA B0 78 Z.a.t..} .E.Y5..x > [07B0] 2A 6E 03 12 05 0F 60 69 C6 C0 79 4A 09 AD 1F 06 *n....`i ..yJ.... > [07C0] 46 1B 3C 10 CB 99 FC E0 E5 E4 B0 57 32 5E B9 E0 F.<..... ...W2^.. > [07D0] E4 9D F7 F2 BD 5A A9 57 12 37 25 79 24 2E 84 74 .....Z.W .7%y$..t > [07E0] 20 8A 50 01 76 5E B8 A5 63 73 D1 08 88 50 EA 65 .P.v^.. cs...P.e > [07F0] D1 48 ED 0C B8 4B 76 71 54 89 1D D6 AF 36 59 9B .H...Kvq T....6Y. > [0800] 7D 7C F2 C6 A6 E8 33 ED 1D BE 05 45 AB 7C 13 22 }|....3. ...E.|." > [0810] F3 3D 06 10 BE EB 1E 7D 02 12 6F E5 6F 28 3D 8B .=.....} ..o.o(=. > [0820] FB 34 E4 53 B1 C0 D2 6C 09 1A 90 D6 01 7E 9C 39 .4.S...l .....~.9 > [0830] 60 86 02 A1 FE 56 D4 65 C3 AB 36 9E 99 EF 9D 6D `....V.e ..6....m > [0840] 6C 5C 8D EA 2D 12 ED 25 B2 32 37 E4 CF D4 4A 83 l\..-..% .27...J. > [0850] E2 C8 8D 89 FB E6 AC C2 82 B4 77 F7 A3 EB EF 6F ........ ..w....o > [0860] 4A 91 62 C2 CE 81 4E 6B 40 CD 30 14 67 46 7B 8D J.b...Nk @.0.gF{. > [0870] 8F 8D 2E 6C 77 DF 99 2A DA C2 C7 30 33 15 18 2E ...lw..* ...03... > [0880] B7 1A 2B 21 66 37 6E FA 37 9A 08 A7 C1 51 06 EA ..+!f7n. 7....Q.. > [0890] C3 AE 7C 00 A8 E8 2E 33 CE 25 B7 C3 CF 4F 62 76 ..|....3 .%...Obv > [08A0] 46 5F DC 1D B8 1F 68 31 5C 71 93 E1 02 8B 3C F7 F_....h1 \q....<. > [08B0] 07 9C F4 3C EF E7 A2 AB 65 2F DD 79 E0 8B 50 C0 ...<.... e/.y..P. > [08C0] E2 3D A9 B8 1A 52 F0 DE 4A 72 B9 88 0C DF 49 ED .=...R.. Jr....I. > [08D0] ED AE C4 7F F5 1D B3 D9 76 6F 57 B4 7B B1 36 A5 ........ voW.{.6. > [08E0] 10 53 54 65 4F 26 34 20 58 D5 EE 22 1B F8 6F 8F .STeO&4 X.."..o. > [08F0] 7F B3 77 06 27 86 62 AE 9A C3 D5 AD 1A 90 14 82 ..w.'.b. ........ > [0900] 3B 92 B4 02 3B 48 B6 05 BB B7 DA A8 20 DB DC B6 ;...;H.. .... ... > [0910] 93 EB 0E 08 0C 6B B2 3D DE F7 B4 A9 1B 8F B8 21 .....k.= .......! > [0920] 85 BA 2D A6 50 92 AD 99 65 08 D3 3B 36 6D BE A8 ..-.P... e..;6m.. > [0930] 89 EA D3 2A A0 E6 7C D2 71 20 31 12 0A 89 68 5A ...*..|. q 1...hZ > [0940] CF 4F 28 07 BB E3 89 94 10 07 2B 4F A1 A4 C3 74 .O(..... ..+O...t > [0950] CF 83 D8 B6 37 D6 13 00 53 8B 8B 5C 86 FA 76 2B ....7... S..\..v+ > [0960] 53 C0 96 39 29 E3 7E FA 89 24 14 23 39 3D 67 D8 S..9).~. .$.#9=g. > [0970] 3A 11 38 51 19 DE CB 1E 84 B4 96 09 92 D0 01 E1 :.8Q.... ........ > [0980] 49 D5 64 B6 33 42 5B EC 7F 9A 84 57 02 1A 93 EF I.d.3B[. ...W.... > [0990] DC AF 92 7B 7F D5 71 0E 0B 71 CE 48 D7 A8 5B 88 ...{..q. .q.H..[. > [09A0] 11 31 9A 59 99 4C 49 0A 4E D2 27 81 95 42 7F E1 .1.Y.LI. N.'..B.. > [09B0] D4 46 D3 BD 12 9E 8E 40 4B 1A AE 54 54 53 26 C4 .F.....@ K..TTS&. > [09C0] 41 CF 08 48 97 2F F7 3D FA 64 85 89 B4 23 D4 15 A..H./.= .d...#.. > [09D0] F1 27 86 B7 FF 1F D2 83 1D BF A3 8E BB 95 F6 90 .'...... ........ > [09E0] A5 A7 0D 52 DF C0 71 93 CD EA 5A 76 51 FD 27 07 ...R..q. ..ZvQ.'. > [09F0] A7 6E 6C B7 4D 01 5C 29 3D 99 51 2E 84 1B 86 22 .nl.M.\) =.Q...." > [0A00] 95 45 A9 5A 3C 81 31 E0 62 73 BE 8A DB 8B AF 25 .E.Z<.1. bs.....% > [0A10] 2A 64 53 B4 A0 8A 25 6C 6F D2 2C B4 2C B1 15 EE *dS...%l o.,.,... > [0A20] 0A 5D DC 49 53 6A 1F 4E 3E 8A 14 4D F9 85 F6 92 .].ISj.N >..M.... > [0A30] A1 14 C9 00 7E 30 CD 21 48 3B 80 27 F3 A3 0D CE ....~0.! H;.'.... > [0A40] B2 30 F6 21 56 A5 5B 65 3A 75 39 B3 0F A9 3E 48 .0.!V.[e :u9...>H > [0A50] 14 1A D3 00 1B 52 C4 64 6E AD E0 DD 61 08 33 4D .....R.d n...a.3M > [0A60] 3F 26 4C BB 95 48 AA BD 0F 9D 0A 8B C1 00 DA DC ?&L..H.. ........ > [0A70] AF 14 4C 05 7A 17 F6 73 0D 02 65 BA 47 C4 D0 73 ..L.z..s ..e.G..s > [0A80] FC 06 40 6B 2C 01 BB A6 D4 EF E7 42 0E 1F 1D 78 ..@k,... ...B...x > [0A90] FD CD B9 A5 F7 D8 0D 6B 01 B2 47 19 82 61 C1 DB .......k ..G..a.. > [0AA0] 64 EF 93 7D AA A7 DB C6 50 67 2B B5 83 F4 3B 54 d..}.... Pg+...;T > [0AB0] 47 D9 C7 75 A1 03 FF 21 2B EE 11 B7 D1 A4 E9 1D G..u...! +....... > [0AC0] 0C 05 7E 4C 3E B9 8A EB 7A 13 76 9F D6 B8 4F 64 ..~L>... z.v...Od > [0AD0] A2 F8 F2 EF EE C8 5B 67 EA 08 02 93 AE 90 EF A2 ......[g ........ > [0AE0] 43 FF 12 49 9F 88 2D 08 89 23 67 5A 68 9E 18 1E C..I..-. .#gZh... > [0AF0] 51 59 2F B7 48 50 7E 8D 4E 31 0B E9 1C CB 39 AA QY/.HP~. N1....9. > [0B00] CB 69 88 8E 6C 45 2C C7 F5 E7 85 F5 2A E3 52 45 .i..lE,. ....*.RE > [0B10] 55 C3 26 B1 ED 40 03 D5 2C 52 00 28 BB FD B3 E4 U.&..@.. ,R.(.... > [0B20] 61 2E 60 25 94 0F 62 DC 80 DD A0 D7 4B 30 64 FE a.`%..b. ....K0d. > [0B30] 0F FF DD 23 4F D4 AF 96 08 F1 0F 8A 5F BF 09 89 ...#O... ...._... > [0B40] 86 C5 1B 7A DE 60 C1 ...z.`. >[2025/04/09 07:45:44.844652, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0b97 (2967) > auth_length : 0x0b47 (2887) > call_id : 0x0000001d (29) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345778-1234-abcd-ef00-0123456789ab > if_version : 0x00000000 (0) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=2895 > [0000] 09 06 00 00 01 00 00 00 60 82 0B 43 06 06 2B 06 ........ `..C..+. > [0010] 01 05 05 02 A0 82 0B 37 30 82 0B 33 A0 24 30 22 .......7 0..3.$0" > [0020] 06 09 2A 86 48 82 F7 12 01 02 02 06 09 2A 86 48 ..*.H... .....*.H > [0030] 86 F7 12 01 02 02 06 0A 2B 06 01 04 01 82 37 02 ........ +.....7. > [0040] 02 0A A2 82 0B 09 04 82 0B 05 6E 82 0B 01 30 82 ........ ..n...0. > [0050] 0A FD A0 03 02 01 05 A1 03 02 01 0E A2 07 03 05 ........ ........ > [0060] 00 20 00 00 00 A3 82 04 4C 61 82 04 48 30 82 04 . ...... La..H0.. > [0070] 44 A0 03 02 01 05 A1 11 1B 0F 41 44 50 52 4F 54 D....... ..ADPROT > [0080] 4F 43 4F 4C 58 2E 43 4F 4D A2 29 30 27 A0 03 02 OCOLX.CO M.)0'... > [0090] 01 01 A1 20 30 1E 1B 04 68 6F 73 74 1B 16 77 69 ... 0... host..wi > [00A0] 6E 64 63 31 2E 61 64 70 72 6F 74 6F 63 6F 6C 78 ndc1.adp rotocolx > [00B0] 2E 63 6F 6D A3 82 03 FD 30 82 03 F9 A0 03 02 01 .com.... 0....... > [00C0] 12 A1 03 02 01 03 A2 82 03 EB 04 82 03 E7 06 1F ........ ........ > [00D0] 8F 84 74 CE 99 4A 3D 11 93 20 46 0C AA A0 44 62 ..t..J=. . F...Db > [00E0] 76 31 3E FA D7 52 8C EA 8D F3 05 CE A6 76 84 C4 v1>..R.. .....v.. > [00F0] 2C BC DB 1D 92 97 B5 F6 BF 7B 85 BF EF 76 1B 99 ,....... .{...v.. > [0100] 1F CA BB 30 0A C0 B7 45 D7 81 FF 33 26 AD 92 6D ...0...E ...3&..m > [0110] 08 95 8C 6F 2E D3 ED 1B 48 8E 7D E2 AD 61 FB 69 ...o.... H.}..a.i > [0120] C8 04 F1 90 DF 10 80 61 55 40 95 9B D6 48 55 D4 .......a U@...HU. > [0130] A9 E8 88 5A 60 BA C3 6B 77 ED 93 29 A7 85 A5 96 ...Z`..k w..).... > [0140] 61 BD 66 0F AD 0F 32 80 EA A5 01 D7 31 F6 4A 8C a.f...2. ....1.J. > [0150] A6 16 E8 F6 3D 98 E6 BE B8 FA 0F 88 7F 00 67 C5 ....=... ......g. > [0160] A9 9E F8 BC C6 43 FD 18 68 FF 95 F0 19 CB D0 4F .....C.. h......O > [0170] 33 BA D6 33 BE 4A A4 E3 96 00 D3 04 CA 7A CA 37 3..3.J.. .....z.7 > [0180] 25 07 CF 19 52 82 CD 4F 2F E8 F5 B9 EB 1B 53 1D %...R..O /.....S. > [0190] FB 52 77 65 8F 25 86 95 F0 25 A9 FB 67 2F 56 12 .Rwe.%.. .%..g/V. > [01A0] 41 58 E5 5A BB 73 7B A5 9D 75 CF 52 38 53 22 66 AX.Z.s{. .u.R8S"f > [01B0] 19 8C 2B DE BA FE 98 86 51 A9 12 61 52 28 34 F1 ..+..... Q..aR(4. > [01C0] A4 5B 60 ED C5 44 95 11 42 FD E5 23 80 50 77 22 .[`..D.. B..#.Pw" > [01D0] 7A 2E 45 CD 92 3B A2 1B 25 E9 DB 19 FC 17 11 9E z.E..;.. %....... > [01E0] 3A CA 6C 91 14 58 39 D5 BC 14 F2 4D F6 90 B8 55 :.l..X9. ...M...U > [01F0] 79 C7 7A 16 70 03 B5 74 1B 1E 14 4E 20 E5 D0 99 y.z.p..t ...N ... > [0200] 4C CA A2 60 4F FB 70 7F F2 09 33 91 F4 83 B1 1B L..`O.p. ..3..... > [0210] D0 A2 02 A7 66 F0 93 24 C5 FE C8 A0 A7 65 14 1C ....f..$ .....e.. > [0220] 0D 8F 59 C1 5D 6C 1B 70 89 31 C7 6F D2 E4 5F 04 ..Y.]l.p .1.o.._. > [0230] C1 8D 3D 19 74 84 B5 2B 16 2F 81 E1 03 3A 1B 8C ..=.t..+ ./...:.. > [0240] 9C 93 04 03 06 06 22 2D 9B C1 32 0B B6 AD 01 70 ......"- ..2....p > [0250] BD 81 F0 4B 2A 3B B5 79 28 78 2D CC 31 1E BB 73 ...K*;.y (x-.1..s > [0260] BB 93 CA 5E 23 0D 8D 2C DE D5 DC 79 1F 71 DA 9C ...^#.., ...y.q.. > [0270] 80 5C 02 BA C4 8F DB 9B E2 6F 16 35 B3 8C CD CF .\...... .o.5.... > [0280] 4B 82 50 BB 81 92 E1 BD 42 19 03 2A 41 A8 B2 4C K.P..... B..*A..L > [0290] CA 58 97 71 93 8F 16 58 14 39 03 D2 EC 9A 99 78 .X.q...X .9.....x > [02A0] 82 70 3A 94 E5 F2 AB CB FA 04 0E 70 35 D0 04 F7 .p:..... ...p5... > [02B0] 26 A7 9E 83 D6 0A 03 8A 2C 49 76 C3 03 C2 FA E2 &....... ,Iv..... > [02C0] 02 DE 5D 72 9E BA A0 AD CE 0F BD F2 FE C4 00 27 ..]r.... .......' > [02D0] 43 06 D7 6D AB 08 C3 9B D3 16 44 A9 79 46 60 1D C..m.... ..D.yF`. > [02E0] A4 96 FF 89 FA 0E 21 F3 32 89 B7 5E BB 5E 1A 64 ......!. 2..^.^.d > [02F0] 0E 72 D2 4E 97 F2 27 48 24 4A 85 C9 87 04 9F 12 .r.N..'H $J...... > [0300] E1 A0 A6 B4 71 0E 34 0B 2A 66 48 52 F5 0A 26 10 ....q.4. *fHR..&. > [0310] C4 2B 74 A3 B8 87 74 6C C5 BB 40 A1 5C F1 E4 20 .+t...tl ..@.\.. > [0320] 90 AC DF D8 A2 50 EE 65 CC 40 56 2E AF 93 39 00 .....P.e .@V...9. > [0330] 21 CF F5 CD 82 96 E7 57 E7 92 6F 69 A3 CF 9D CB !......W ..oi.... > [0340] E7 81 11 10 E4 DA 25 8B EA 1A 9E 66 5B F8 A3 1F ......%. ...f[... > [0350] 27 48 86 F1 39 5E DB 56 E2 7A 3A 7F 0B E9 2F ED 'H..9^.V .z:.../. > [0360] 65 89 ED EF 65 D3 C8 8B 79 35 C8 DB F1 D0 57 98 e...e... y5....W. > [0370] 17 02 0C D8 CE AE 98 D4 DC 74 24 64 A8 34 13 EB ........ .t$d.4.. > [0380] 8B BD 07 AA 6A 1D BE 8D A3 48 22 C8 29 E2 EF CC ....j... .H".)... > [0390] 44 98 5D C5 6C 5C 70 DB 1F 75 FD D8 50 9B 9F 7A D.].l\p. .u..P..z > [03A0] 35 26 1D B1 11 2B 00 AB 91 25 F0 C5 70 01 E5 D4 5&...+.. .%..p... > [03B0] DF 3C 7D E5 50 69 C1 95 E6 2E BE 86 CF 50 57 F8 .<}.Pi.. .....PW. > [03C0] BE 5B 71 4D 09 AF C2 16 D5 55 86 D7 79 B6 6D F1 .[qM.... .U..y.m. > [03D0] 24 69 D9 13 65 64 E7 41 37 01 72 B3 BF B0 7A CB $i..ed.A 7.r...z. > [03E0] BE 5A D0 9D 0B AA 41 BF 5B B5 05 05 20 95 DB 9D .Z....A. [... ... > [03F0] 5E 4E BC 4F 05 0F BE 08 E1 DC 08 CB 70 16 F4 5F ^N.O.... ....p.._ > [0400] 20 85 77 7A 06 43 EC B2 A6 6D 1D F1 01 0E 14 8A .wz.C.. .m...... > [0410] 9D 27 2F E0 E2 BD 5C CF C3 5A 8F 63 81 43 CF 87 .'/...\. .Z.c.C.. > [0420] 5E EC E8 10 57 5C 26 5A 77 30 12 AC 51 C5 A8 84 ^...W\&Z w0..Q... > [0430] FC 74 54 C0 A6 51 04 0E AB 03 14 66 9C 5F C9 B4 .tT..Q.. ...f._.. > [0440] 85 47 4B 76 AF BC 14 48 F2 E2 38 FB E4 E2 8C DE .GKv...H ..8..... > [0450] 5E 99 15 72 A4 39 9B 4D 4E 31 DE CE 98 72 33 73 ^..r.9.M N1...r3s > [0460] 8F D4 3A C2 7F 3F 03 D3 04 52 27 FA 01 E6 65 10 ..:..?.. .R'...e. > [0470] D3 88 FF 65 8C B8 AE 36 E7 BD 11 28 F6 43 B2 41 ...e...6 ...(.C.A > [0480] 4A BD 90 18 3C 09 A9 22 B9 2E 8A BD 41 39 00 5E J...<.." ....A9.^ > [0490] 4B 56 0F B4 E5 05 87 49 71 9F 00 C1 F7 BD B0 6B KV.....I q......k > [04A0] 9D 5B A0 C1 B8 34 0D F6 87 41 8B 4A 03 CC 6B A5 .[...4.. .A.J..k. > [04B0] 2F D2 80 C3 6E A4 82 06 96 30 82 06 92 A0 03 02 /...n... .0...... > [04C0] 01 12 A2 82 06 89 04 82 06 85 83 10 A4 96 24 2E ........ ......$. > [04D0] CC 42 D3 F6 59 19 6F 2F CF 30 EF E3 CA 03 C2 C8 .B..Y.o/ .0...... > [04E0] 73 73 36 B5 A8 C4 55 CD 6B CA 52 C1 4C F2 10 33 ss6...U. k.R.L..3 > [04F0] 6A 94 A0 6E B1 94 1C B3 39 ED 13 E3 D7 72 60 2A j..n.... 9....r`* > [0500] 09 D8 13 35 60 9E CF 18 97 E7 AA E2 D7 D6 58 5B ...5`... ......X[ > [0510] 82 29 B2 D6 DE 12 C4 B8 DB 32 38 99 55 79 B0 C2 .)...... .28.Uy.. > [0520] B1 9F 6F 03 E2 3B 53 17 C6 26 BE 8A EA B2 E1 55 ..o..;S. .&.....U > [0530] F7 A6 FE 86 0F 06 73 91 6B B1 4D 04 F1 D1 96 DE ......s. k.M..... > [0540] FF 61 C2 DC 91 5E 6D 1F 9C 9C 87 90 03 E7 28 69 .a...^m. ......(i > [0550] 92 C6 C4 54 54 39 75 7A 7B F2 4A 3B C2 D7 EE 53 ...TT9uz {.J;...S > [0560] 3B FE 86 AB 05 94 65 75 81 B3 2A 2F 64 0A 0A CB ;.....eu ..*/d... > [0570] C6 88 F3 4E 3D 59 9B 78 87 0A AE 93 A6 F2 E9 7B ...N=Y.x .......{ > [0580] 13 45 17 B6 73 20 83 EC AB 23 3A 4B 1D CF 55 5D .E..s .. .#:K..U] > [0590] F5 49 C4 DF B9 01 C5 5D A3 5A 08 C8 22 82 CC 77 .I.....] .Z.."..w > [05A0] 68 E0 11 BD 2A C6 B1 8A 55 E9 22 BC 5E 16 91 62 h...*... U.".^..b > [05B0] 69 62 13 FC 41 10 29 73 EE E3 E4 94 CF 5D 3B FF ib..A.)s .....];. > [05C0] AF 21 E6 8A AA 63 15 20 C3 F5 6D 66 3D BA 63 55 .!...c. ..mf=.cU > [05D0] 4C 60 0B CB A7 93 53 A3 A6 C4 CE 49 D8 11 39 F8 L`....S. ...I..9. > [05E0] 08 DC A6 BF C9 46 69 58 91 E8 88 DE 15 C0 33 52 .....FiX ......3R > [05F0] DF 25 2C A1 08 03 34 57 2C E4 BA 05 CC D4 92 90 .%,...4W ,....... > [0600] 04 C0 A3 FC A2 D0 44 43 34 BF EF 2B 24 41 82 83 ......DC 4..+$A.. > [0610] A9 CA 0B 9E DD C9 7F 37 D0 65 B2 B3 70 58 FA 41 .......7 .e..pX.A > [0620] 81 B9 1F E7 39 8E A0 70 C5 BA E6 FF BA 98 35 EA ....9..p ......5. > [0630] 1A 27 46 19 3A 5B 31 EF 3C 95 B2 FE 83 4F E4 8B .'F.:[1. <....O.. > [0640] 2D D1 E1 F4 5E D4 AA 49 E0 14 D8 22 B6 34 18 C5 -...^..I ...".4.. > [0650] C9 F4 8E 77 2D E9 EC 56 39 CF 44 71 9E 51 21 21 ...w-..V 9.Dq.Q!! > [0660] 52 07 6F 94 52 7A EF F3 00 D0 42 5F 56 43 CF 3E R.o.Rz.. ..B_VC.> > [0670] 3A CC 88 D1 AC FC 12 66 BE A0 BB 40 BF 52 46 68 :......f ...@.RFh > [0680] 12 0F 07 6D 81 1F 25 55 71 49 90 ED AE 14 2D 6C ...m..%U qI....-l > [0690] D5 BB DE A9 36 DB 26 1C 76 C3 13 C5 BD AB A5 CC ....6.&. v....... > [06A0] C6 6C EB F7 27 9A A4 5D ED 98 88 F5 FD 07 EE D3 .l..'..] ........ > [06B0] 71 22 1F 03 03 68 A3 4A D0 68 60 75 C8 94 C8 0A q"...h.J .h`u.... > [06C0] 58 0F 8B 13 03 18 C6 11 FC C4 E8 E8 7B 2A 8C 30 X....... ....{*.0 > [06D0] 94 7A 45 EA D9 FB D8 0C 93 E5 07 3A 20 68 66 96 .zE..... ...: hf. > [06E0] 93 F5 BE B4 73 7E D4 70 93 71 8C C7 FC 58 27 FF ....s~.p .q...X'. > [06F0] B1 1B 2C 85 9E 51 3B 07 B9 1A D2 4C DB 7A D2 D1 ..,..Q;. ...L.z.. > [0700] 28 61 55 D9 6F B2 45 E2 FD 94 8E C7 81 66 C0 AB (aU.o.E. .....f.. > [0710] 3A 1B B3 C5 D9 CA B5 93 79 56 26 8E 05 50 68 AC :....... yV&..Ph. > [0720] D8 D4 5E 84 5C 64 B3 62 84 81 55 06 DF 51 F6 0E ..^.\d.b ..U..Q.. > [0730] 1B 41 A5 DA 12 95 9F AB 2C C1 3F 5B E4 D6 1F 76 .A...... ,.?[...v > [0740] CD 55 70 CD 07 1D CC 7D DE 5F 2F DE 7C 98 1B 3B .Up....} ._/.|..; > [0750] 5E 27 D0 7E 95 46 54 77 AA B9 17 21 C7 AB F8 32 ^'.~.FTw ...!...2 > [0760] 5A D1 1C D0 8A DA B2 FB 05 CB FC CE 08 B0 83 05 Z....... ........ > [0770] C7 85 A1 E4 9C 96 03 D7 BD BA CF 83 8D D7 71 21 ........ ......q! > [0780] 8B 0C 08 AC 38 AA 87 EC 84 91 DB 29 66 0C A1 14 ....8... ...)f... > [0790] 23 1D BB E6 78 92 1A 51 0F 55 70 14 20 60 56 E5 #...x..Q .Up. `V. > [07A0] EB B1 C8 B3 3E 78 49 DB 5A EE 61 B4 74 FE 8C 7D ....>xI. Z.a.t..} > [07B0] A5 45 A2 59 35 EA B0 78 2A 6E 03 12 05 0F 60 69 .E.Y5..x *n....`i > [07C0] C6 C0 79 4A 09 AD 1F 06 46 1B 3C 10 CB 99 FC E0 ..yJ.... F.<..... > [07D0] E5 E4 B0 57 32 5E B9 E0 E4 9D F7 F2 BD 5A A9 57 ...W2^.. .....Z.W > [07E0] 12 37 25 79 24 2E 84 74 20 8A 50 01 76 5E B8 A5 .7%y$..t .P.v^.. > [07F0] 63 73 D1 08 88 50 EA 65 D1 48 ED 0C B8 4B 76 71 cs...P.e .H...Kvq > [0800] 54 89 1D D6 AF 36 59 9B 7D 7C F2 C6 A6 E8 33 ED T....6Y. }|....3. > [0810] 1D BE 05 45 AB 7C 13 22 F3 3D 06 10 BE EB 1E 7D ...E.|." .=.....} > [0820] 02 12 6F E5 6F 28 3D 8B FB 34 E4 53 B1 C0 D2 6C ..o.o(=. .4.S...l > [0830] 09 1A 90 D6 01 7E 9C 39 60 86 02 A1 FE 56 D4 65 .....~.9 `....V.e > [0840] C3 AB 36 9E 99 EF 9D 6D 6C 5C 8D EA 2D 12 ED 25 ..6....m l\..-..% > [0850] B2 32 37 E4 CF D4 4A 83 E2 C8 8D 89 FB E6 AC C2 .27...J. ........ > [0860] 82 B4 77 F7 A3 EB EF 6F 4A 91 62 C2 CE 81 4E 6B ..w....o J.b...Nk > [0870] 40 CD 30 14 67 46 7B 8D 8F 8D 2E 6C 77 DF 99 2A @.0.gF{. ...lw..* > [0880] DA C2 C7 30 33 15 18 2E B7 1A 2B 21 66 37 6E FA ...03... ..+!f7n. > [0890] 37 9A 08 A7 C1 51 06 EA C3 AE 7C 00 A8 E8 2E 33 7....Q.. ..|....3 > [08A0] CE 25 B7 C3 CF 4F 62 76 46 5F DC 1D B8 1F 68 31 .%...Obv F_....h1 > [08B0] 5C 71 93 E1 02 8B 3C F7 07 9C F4 3C EF E7 A2 AB \q....<. ...<.... > [08C0] 65 2F DD 79 E0 8B 50 C0 E2 3D A9 B8 1A 52 F0 DE e/.y..P. .=...R.. > [08D0] 4A 72 B9 88 0C DF 49 ED ED AE C4 7F F5 1D B3 D9 Jr....I. ........ > [08E0] 76 6F 57 B4 7B B1 36 A5 10 53 54 65 4F 26 34 20 voW.{.6. .STeO&4 > [08F0] 58 D5 EE 22 1B F8 6F 8F 7F B3 77 06 27 86 62 AE X.."..o. ..w.'.b. > [0900] 9A C3 D5 AD 1A 90 14 82 3B 92 B4 02 3B 48 B6 05 ........ ;...;H.. > [0910] BB B7 DA A8 20 DB DC B6 93 EB 0E 08 0C 6B B2 3D .... ... .....k.= > [0920] DE F7 B4 A9 1B 8F B8 21 85 BA 2D A6 50 92 AD 99 .......! ..-.P... > [0930] 65 08 D3 3B 36 6D BE A8 89 EA D3 2A A0 E6 7C D2 e..;6m.. ...*..|. > [0940] 71 20 31 12 0A 89 68 5A CF 4F 28 07 BB E3 89 94 q 1...hZ .O(..... > [0950] 10 07 2B 4F A1 A4 C3 74 CF 83 D8 B6 37 D6 13 00 ..+O...t ....7... > [0960] 53 8B 8B 5C 86 FA 76 2B 53 C0 96 39 29 E3 7E FA S..\..v+ S..9).~. > [0970] 89 24 14 23 39 3D 67 D8 3A 11 38 51 19 DE CB 1E .$.#9=g. :.8Q.... > [0980] 84 B4 96 09 92 D0 01 E1 49 D5 64 B6 33 42 5B EC ........ I.d.3B[. > [0990] 7F 9A 84 57 02 1A 93 EF DC AF 92 7B 7F D5 71 0E ...W.... ...{..q. > [09A0] 0B 71 CE 48 D7 A8 5B 88 11 31 9A 59 99 4C 49 0A .q.H..[. .1.Y.LI. > [09B0] 4E D2 27 81 95 42 7F E1 D4 46 D3 BD 12 9E 8E 40 N.'..B.. .F.....@ > [09C0] 4B 1A AE 54 54 53 26 C4 41 CF 08 48 97 2F F7 3D K..TTS&. A..H./.= > [09D0] FA 64 85 89 B4 23 D4 15 F1 27 86 B7 FF 1F D2 83 .d...#.. .'...... > [09E0] 1D BF A3 8E BB 95 F6 90 A5 A7 0D 52 DF C0 71 93 ........ ...R..q. > [09F0] CD EA 5A 76 51 FD 27 07 A7 6E 6C B7 4D 01 5C 29 ..ZvQ.'. .nl.M.\) > [0A00] 3D 99 51 2E 84 1B 86 22 95 45 A9 5A 3C 81 31 E0 =.Q...." .E.Z<.1. > [0A10] 62 73 BE 8A DB 8B AF 25 2A 64 53 B4 A0 8A 25 6C bs.....% *dS...%l > [0A20] 6F D2 2C B4 2C B1 15 EE 0A 5D DC 49 53 6A 1F 4E o.,.,... .].ISj.N > [0A30] 3E 8A 14 4D F9 85 F6 92 A1 14 C9 00 7E 30 CD 21 >..M.... ....~0.! > [0A40] 48 3B 80 27 F3 A3 0D CE B2 30 F6 21 56 A5 5B 65 H;.'.... .0.!V.[e > [0A50] 3A 75 39 B3 0F A9 3E 48 14 1A D3 00 1B 52 C4 64 :u9...>H .....R.d > [0A60] 6E AD E0 DD 61 08 33 4D 3F 26 4C BB 95 48 AA BD n...a.3M ?&L..H.. > [0A70] 0F 9D 0A 8B C1 00 DA DC AF 14 4C 05 7A 17 F6 73 ........ ..L.z..s > [0A80] 0D 02 65 BA 47 C4 D0 73 FC 06 40 6B 2C 01 BB A6 ..e.G..s ..@k,... > [0A90] D4 EF E7 42 0E 1F 1D 78 FD CD B9 A5 F7 D8 0D 6B ...B...x .......k > [0AA0] 01 B2 47 19 82 61 C1 DB 64 EF 93 7D AA A7 DB C6 ..G..a.. d..}.... > [0AB0] 50 67 2B B5 83 F4 3B 54 47 D9 C7 75 A1 03 FF 21 Pg+...;T G..u...! > [0AC0] 2B EE 11 B7 D1 A4 E9 1D 0C 05 7E 4C 3E B9 8A EB +....... ..~L>... > [0AD0] 7A 13 76 9F D6 B8 4F 64 A2 F8 F2 EF EE C8 5B 67 z.v...Od ......[g > [0AE0] EA 08 02 93 AE 90 EF A2 43 FF 12 49 9F 88 2D 08 ........ C..I..-. > [0AF0] 89 23 67 5A 68 9E 18 1E 51 59 2F B7 48 50 7E 8D .#gZh... QY/.HP~. > [0B00] 4E 31 0B E9 1C CB 39 AA CB 69 88 8E 6C 45 2C C7 N1....9. .i..lE,. > [0B10] F5 E7 85 F5 2A E3 52 45 55 C3 26 B1 ED 40 03 D5 ....*.RE U.&..@.. > [0B20] 2C 52 00 28 BB FD B3 E4 61 2E 60 25 94 0F 62 DC ,R.(.... a.`%..b. > [0B30] 80 DD A0 D7 4B 30 64 FE 0F FF DD 23 4F D4 AF 96 ....K0d. ...#O... > [0B40] 08 F1 0F 8A 5F BF 09 89 86 C5 1B 7A DE 60 C1 ...._... ...z.`. >[2025/04/09 07:45:44.847990, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:44.848129, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:44.849865, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 230 >[2025/04/09 07:45:44.850078, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x00f6 (246) > auth_length : 0x00aa (170) > call_id : 0x0000001d (29) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b60 (2912) > secondary_address_size : 0x000c (12) > secondary_address : '\pipe\lsass' > _pad1 : DATA_BLOB length=2 > [0000] D1 11 .. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=178 > [0000] 09 06 00 00 01 00 00 00 A1 81 A7 30 81 A4 A0 03 ........ ...0.... > [0010] 0A 01 01 A1 0B 06 09 2A 86 48 82 F7 12 01 02 02 .......* .H...... > [0020] A2 81 8F 04 81 8C 6F 81 89 30 81 86 A0 03 02 01 ......o. .0...... > [0030] 05 A1 03 02 01 0F A2 7A 30 78 A0 03 02 01 12 A2 .......z 0x...... > [0040] 71 04 6F E7 58 8B 0F A5 24 B4 83 7B A2 28 39 FC q.o.X... $..{.(9. > [0050] FE D6 2D 1F 95 A5 29 96 1C AB 15 B2 9C F5 D2 69 ..-...). .......i > [0060] DC EF 60 BE FB 32 06 D8 CE 81 B5 0B EF EC 04 6D ..`..2.. .......m > [0070] D3 53 DA D7 62 49 30 23 7D 1C 59 AC D8 9D 0C 2E .S..bI0# }.Y..... > [0080] A3 8B 6B F6 42 10 AC 7B 70 A5 6B 1A 1E AF AF 54 ..k.B..{ p.k....T > [0090] 45 4D 1D 8C C5 D3 8C FC B6 02 74 E0 78 68 CF A1 EM...... ..t.xh.. > [00A0] 38 53 CB 5C F4 77 E3 FB 9A 2E BD F0 FD 5D ED B1 8S.\.w.. .....].. > [00B0] 2B D9 +. >[2025/04/09 07:45:44.850595, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 246 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:44.850624, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 246 bytes. >[2025/04/09 07:45:44.850651, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:45:44.850674, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:45:44.851038, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf82595480]: subreq: 0x55cf825a79f0 >[2025/04/09 07:45:44.851069, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf825cca90]: subreq: 0x55cf826034d0 >[2025/04/09 07:45:44.851098, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf82595480]: NT_STATUS_OK tevent_req[0x55cf825a79f0/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:994] >[2025/04/09 07:45:44.851206, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf825cca90]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf826034d0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf826036b0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:45:44.851259, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=135 > [0000] A1 81 84 30 81 81 A2 5F 04 5D 6F 5B 30 59 A0 03 ...0..._ .]o[0Y.. > [0010] 02 01 05 A1 03 02 01 0F A2 4D 30 4B A0 03 02 01 ........ .M0K.... > [0020] 12 A2 44 04 42 EF 31 D7 65 30 45 83 1A 45 3E C4 ..D.B.1. e0E..E>. > [0030] 74 D0 D3 62 58 1A 48 BB B2 78 3B 06 05 0B E8 48 t..bX.H. .x;....H > [0040] 8C 02 A7 2A 63 5C 38 E2 D7 20 B8 CE B5 94 A2 9A ...*c\8. . ...... > [0050] 69 E8 49 32 90 DF AB 02 EF 76 7E 3E DD 2A 69 DE i.I2.... .v~>.*i. > [0060] E9 F4 F3 C8 58 F8 3C A3 1E 04 1C 04 04 04 FF FF ....X.<. ........ > [0070] FF FF FF 00 00 00 00 0C 8A 7B 01 18 09 75 3C 67 ........ .{...u<g > [0080] FB 67 6E 7B B2 BC 8E .gn{... >[2025/04/09 07:45:44.851477, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_ALTER (14) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x00d7 (215) > auth_length : 0x0087 (135) > call_id : 0x0000001d (29) > u : union dcerpc_payload(case 14) > alter: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345778-1234-abcd-ef00-0123456789ab > if_version : 0x00000000 (0) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=143 > [0000] 09 06 00 00 01 00 00 00 A1 81 84 30 81 81 A2 5F ........ ...0..._ > [0010] 04 5D 6F 5B 30 59 A0 03 02 01 05 A1 03 02 01 0F .]o[0Y.. ........ > [0020] A2 4D 30 4B A0 03 02 01 12 A2 44 04 42 EF 31 D7 .M0K.... ..D.B.1. > [0030] 65 30 45 83 1A 45 3E C4 74 D0 D3 62 58 1A 48 BB e0E..E>. t..bX.H. > [0040] B2 78 3B 06 05 0B E8 48 8C 02 A7 2A 63 5C 38 E2 .x;....H ...*c\8. > [0050] D7 20 B8 CE B5 94 A2 9A 69 E8 49 32 90 DF AB 02 . ...... i.I2.... > [0060] EF 76 7E 3E DD 2A 69 DE E9 F4 F3 C8 58 F8 3C A3 .v~>.*i. ....X.<. > [0070] 1E 04 1C 04 04 04 FF FF FF FF FF 00 00 00 00 0C ........ ........ > [0080] 8A 7B 01 18 09 75 3C 67 FB 67 6E 7B B2 BC 8E .{...u<g .gn{... >[2025/04/09 07:45:44.851881, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:44.851934, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:44.853075, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 89 >[2025/04/09 07:45:44.853139, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_ALTER_RESP (15) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0069 (105) > auth_length : 0x0029 (41) > call_id : 0x0000001d (29) > u : union dcerpc_payload(case 15) > alter_resp: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b60 (2912) > secondary_address_size : 0x0000 (0) > secondary_address : '' > _pad1 : DATA_BLOB length=2 > [0000] 5C 70 \p > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=49 > [0000] 09 06 00 00 01 00 00 00 A1 27 30 25 A0 03 0A 01 ........ .'0%.... > [0010] 00 A3 1E 04 1C 04 04 05 FF FF FF FF FF 00 00 00 ........ ........ > [0020] 00 13 FD 8B C6 D7 F6 59 9F F4 8B 2A D3 7C 5A CC .......Y ...*.|Z. > [0030] 9E . >[2025/04/09 07:45:44.853461, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 105 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:44.853485, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 105 bytes. >[2025/04/09 07:45:44.853508, 4, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1665(check_bind_response) > Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly) >[2025/04/09 07:45:44.853528, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:45:44.853549, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:45:44.853656, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf825cca90]: subreq: 0x55cf826028e0 >[2025/04/09 07:45:44.853702, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf825cca90]: NT_STATUS_OK tevent_req[0x55cf826028e0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf82602ac0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:45:44.853775, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3486(cli_rpc_pipe_open_with_creds) > cli_rpc_pipe_open_with_creds: opened pipe lsarpc to machine windc1.adprotocolx.com and bound as user ADPROTOCOLX\GPFSNMBASH$. >[2025/04/09 07:45:44.853847, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2980(cm_connect_lsa) > cm_connect_lsa: connected to LSA pipe for domain ADPROTOCOLX using NTLMSSP authenticated pipe: user ADPROTOCOLX\GPFSNMBASH$ >[2025/04/09 07:45:44.853921, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_OpenPolicy: struct lsa_OpenPolicy > in: struct lsa_OpenPolicy > system_name : * > system_name : 0x005c (92) > attr : * > attr: struct lsa_ObjectAttribute > len : 0x00000018 (24) > root_dir : NULL > object_name : NULL > attributes : 0x00000000 (0) > sec_desc : NULL > sec_qos : * > sec_qos: struct lsa_QosInfo > len : 0x0000000c (12) > impersonation_level : LSA_SECURITY_IMPERSONATION (2) > context_mode : 0x01 (1) > effective_only : 0x00 (0) > access_mask : 0x02000000 (33554432) > 0: LSA_POLICY_VIEW_LOCAL_INFORMATION > 0: LSA_POLICY_VIEW_AUDIT_INFORMATION > 0: LSA_POLICY_GET_PRIVATE_INFORMATION > 0: LSA_POLICY_TRUST_ADMIN > 0: LSA_POLICY_CREATE_ACCOUNT > 0: LSA_POLICY_CREATE_SECRET > 0: LSA_POLICY_CREATE_PRIVILEGE > 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS > 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS > 0: LSA_POLICY_AUDIT_LOG_ADMIN > 0: LSA_POLICY_SERVER_ADMIN > 0: LSA_POLICY_LOOKUP_NAMES > 0: LSA_POLICY_NOTIFICATION >[2025/04/09 07:45:44.854219, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345778-1234-abcd-ef00-0123456789ab > if_version : 0x00000000 (0) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:45:44.854451, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x004c (76) > call_id : 0x0000001e (30) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000068 (104) > context_id : 0x0000 (0) > opnum : 0x0006 (6) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:44.854642, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:44.854751, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) > Sealed 112 bytes, and got 76 bytes header/signature. >[2025/04/09 07:45:44.854798, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:44.854846, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:44.856793, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 124 >[2025/04/09 07:45:44.856881, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x008c (140) > auth_length : 0x004c (76) > call_id : 0x0000001e (30) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000018 (24) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=116 > [0000] 88 F6 C8 DC 49 E0 F2 C0 83 5A 84 84 97 DA 92 76 ....I... .Z.....v > [0010] 29 F2 1B 33 74 0E F4 3B 73 62 EF F4 88 91 99 13 )..3t..; sb...... > [0020] 09 06 08 00 01 00 00 00 05 04 07 FF 00 10 00 1C ........ ........ > [0030] 00 00 00 00 13 FD 8B C7 BF C6 0C 7C A7 48 F2 29 ........ ...|.H.) > [0040] CA 1F C9 B1 7D 46 24 0C A2 12 7B 64 AA D1 37 99 ....}F$. ..{d..7. > [0050] BC C4 AC DA 38 B4 7E 74 B5 44 FB A8 2B B5 65 37 ....8.~t .D..+.e7 > [0060] 35 78 F3 5E A6 E5 D9 71 C4 AD B1 95 5D 13 E6 6F 5x.^...q ....]..o > [0070] 04 60 C1 E6 .`.. >[2025/04/09 07:45:44.857230, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:44.857255, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:45:44.857275, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:44.857359, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:306(gssapi_unseal_packet) > Unsealed 32 bytes, with 76 bytes header/signature. >[2025/04/09 07:45:44.857386, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 140, data_len 24 >[2025/04/09 07:45:44.857406, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 140 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:44.857427, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 24 bytes. >[2025/04/09 07:45:44.857460, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_OpenPolicy: struct lsa_OpenPolicy > out: struct lsa_OpenPolicy > handle : * > handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 > result : NT_STATUS_OK >[2025/04/09 07:45:44.857591, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:458(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:45:44.857655, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids: struct lsa_LookupSids > in: struct lsa_LookupSids > handle : * > handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) >[2025/04/09 07:45:44.857886, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x004c (76) > call_id : 0x0000001f (31) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000054 (84) > context_id : 0x0000 (0) > opnum : 0x000f (15) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:44.858103, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:44.858205, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) > Sealed 96 bytes, and got 76 bytes header/signature. >[2025/04/09 07:45:44.858232, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:44.858272, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:44.859271, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 268 >[2025/04/09 07:45:44.859327, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x011c (284) > auth_length : 0x004c (76) > call_id : 0x0000001f (31) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a4 (164) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=260 > [0000] F1 91 57 59 F1 73 C9 F4 46 5D 2F A0 55 3E EC FC ..WY.s.. F]/.U>.. > [0010] 3B E7 BC DD 8C 17 F1 4C 1A DF 78 88 01 B3 FB 63 ;......L ..x....c > [0020] 58 EE 80 16 AE 06 90 6C 37 72 7B CE 85 8F CF B4 X......l 7r{..... > [0030] EF DD 72 67 7D EE 49 60 00 AD 04 78 96 37 48 0E ..rg}.I` ...x.7H. > [0040] 4C 3A C2 70 9F D4 EE 1D F3 00 EF E0 D8 8D BD 20 L:.p.... ....... > [0050] 90 8A 70 19 EE 14 E5 40 20 5F 1E 3E F0 0B 9C 1E ..p....@ _.>.... > [0060] C5 CC 32 68 7E EA 40 C3 AC 5C 15 3D F5 BF 5A 1F ..2h~.@. .\.=..Z. > [0070] E0 A9 D8 A7 D3 93 71 4F 2B 8A B1 D2 BD 26 FE D1 ......qO +....&.. > [0080] 4E C4 CF D2 E0 84 92 27 4D CC 3C D8 23 96 25 17 N......' M.<.#.%. > [0090] 43 70 D3 BC 80 A8 EC 68 BE AD D2 FE 56 00 08 17 Cp.....h ....V... > [00A0] 1C 41 45 AE 11 C0 0F 60 EA 08 11 44 F8 A9 6C 9E .AE....` ...D..l. > [00B0] 09 06 0C 00 01 00 00 00 05 04 07 FF 00 10 00 1C ........ ........ > [00C0] 00 00 00 00 13 FD 8B C8 CA 55 8B 59 76 74 30 79 ........ .U.Yvt0y > [00D0] 18 78 69 4C E2 2F B1 B0 A0 E3 CA 22 17 41 84 2D .xiL./.. ...".A.- > [00E0] CA 52 E2 D7 A5 19 A4 B7 91 7F A6 76 11 6D 46 41 .R...... ...v.mFA > [00F0] 98 89 DD A7 44 9B A2 9B 3E 2C 70 E2 67 9A 52 99 ....D... >,p.g.R. > [0100] D0 78 DC F8 .x.. >[2025/04/09 07:45:44.859807, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:44.859831, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 12 >[2025/04/09 07:45:44.859851, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:44.859899, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:306(gssapi_unseal_packet) > Unsealed 176 bytes, with 76 bytes header/signature. >[2025/04/09 07:45:44.859923, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 284, data_len 164 >[2025/04/09 07:45:44.859942, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 284 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:44.859998, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 164 bytes. >[2025/04/09 07:45:44.860103, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids: struct lsa_LookupSids > out: struct lsa_LookupSids > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:45:44.860399, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:300(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:45:44.860430, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:45:44.860480, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:50:44 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:45:44.860572, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:50:44 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:45:44.860615, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:45:44.860763, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:45:44.860786, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:45:46.581182, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:45:46.581241, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:45:46.581337, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:46.581427, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:45:46.581520, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000020 (32) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:46.581822, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:46.581925, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:46.582025, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:46.582932, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:45:46.583013, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000020 (32) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] EB 5D 03 88 62 27 3F AB 1C 18 72 0D 8C 60 7C 0A .]..b'?. ..r..`|. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 47 22 9E ED 60 52 69 2A 37 BE 9C 2E 5B AD 43 65 G"..`Ri* 7...[.Ce > [0030] FF 78 69 2B E9 40 77 45 00 00 00 00 00 00 00 00 .xi+.@wE ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:45:46.583333, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:46.583359, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:45:46.583379, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:46.583419, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:45:46.583442, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:46.583462, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:45:46.583491, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:45:46.583568, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:45:46.583590, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:46.583650, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:45:46.583671, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:45:50.333977, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:45:50.334041, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:45:50.334121, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:50.334204, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:45:50.334289, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000021 (33) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:50.334477, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:50.334575, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:50.334625, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:50.336277, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:45:50.336332, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000021 (33) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 36 E4 03 AA 2C 4F F9 DE C5 65 6C 63 37 E0 E7 B4 6...,O.. .elc7... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 28 CD C0 36 DB A3 29 4E 3E AE 86 CA 37 AB 8C E1 (..6..)N >...7... > [0030] 70 0A 4C B4 79 B5 A5 1E 00 00 00 00 00 00 00 00 p.L.y... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:45:50.336611, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:50.336634, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:45:50.336653, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:50.336691, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:45:50.336713, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:50.336731, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:45:50.336757, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:45:50.336834, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:45:50.336856, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:50.336912, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:45:50.336932, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:45:50.346471, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:45:50.346510, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:45:50.346531, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:45:50.346568, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:50.346618, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:45:50.346648, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:45:50.346669, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:45:50.346686, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:45:50.346704, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 07:45:50.346728, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:458(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:45:50.346759, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids: struct lsa_LookupSids > in: struct lsa_LookupSids > handle : * > handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) >[2025/04/09 07:45:50.346931, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x004c (76) > call_id : 0x00000022 (34) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000054 (84) > context_id : 0x0000 (0) > opnum : 0x000f (15) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:50.347150, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:50.347263, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) > Sealed 96 bytes, and got 76 bytes header/signature. >[2025/04/09 07:45:50.347292, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:50.347335, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:50.348613, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 268 >[2025/04/09 07:45:50.348663, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x011c (284) > auth_length : 0x004c (76) > call_id : 0x00000022 (34) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a4 (164) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=260 > [0000] F3 A7 58 B6 D0 3E 38 E0 3A DE 2A 08 11 3C E5 7C ..X..>8. :.*..<.| > [0010] CF 5A E5 39 7B 67 D8 DC D0 BD 19 BD 6E 79 F8 6A .Z.9{g.. ....ny.j > [0020] 69 6D 60 81 83 2C BD 4B 8F 8F A7 E2 EC D3 48 6A im`..,.K ......Hj > [0030] 7B B8 34 DA 2B 00 7A 7D FB 34 62 0C 42 AB C5 26 {.4.+.z} .4b.B..& > [0040] A4 76 6B 86 A7 A0 02 A8 FF 80 1B 57 BD 6B AE 27 .vk..... ...W.k.' > [0050] 11 24 A3 CE F5 E7 F3 16 B2 43 58 D9 9D 00 D9 59 .$...... .CX....Y > [0060] D8 35 96 66 CB EC AE 6F D0 FE E6 96 C9 A2 CB 69 .5.f...o .......i > [0070] F2 4D BA 4C 48 12 9D AB 0C 9C FA BC CD 98 82 63 .M.LH... .......c > [0080] 4D E7 91 81 86 F5 43 9D CE 20 CF F1 E8 9A DD 47 M.....C. . .....G > [0090] DD 61 28 E6 EB 3C E9 87 F3 E1 63 F7 97 78 EC 61 .a(..<.. ..c..x.a > [00A0] C8 F1 8D AF 10 7E E0 34 B2 09 A4 36 DC AF 5F E2 .....~.4 ...6.._. > [00B0] 09 06 0C 00 01 00 00 00 05 04 07 FF 00 10 00 1C ........ ........ > [00C0] 00 00 00 00 13 FD 8B C9 23 9A 3A B6 4A 7A E4 DE ........ #.:.Jz.. > [00D0] CC 9E AF 28 C6 9F A1 68 F9 77 8A 52 4C DA 96 B7 ...(...h .w.RL... > [00E0] 2A 82 F3 EA C0 2A 11 EF 21 35 43 CB 14 28 AE 44 *....*.. !5C..(.D > [00F0] FA E1 B9 71 D3 90 4A FC 66 7B 1A 1F 9E 1D B2 C6 ...q..J. f{...... > [0100] CE 05 77 F2 ..w. >[2025/04/09 07:45:50.349196, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:50.349220, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 12 >[2025/04/09 07:45:50.349239, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:50.349274, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:306(gssapi_unseal_packet) > Unsealed 176 bytes, with 76 bytes header/signature. >[2025/04/09 07:45:50.349297, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 284, data_len 164 >[2025/04/09 07:45:50.349315, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 284 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:50.349333, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 164 bytes. >[2025/04/09 07:45:50.349366, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids: struct lsa_LookupSids > out: struct lsa_LookupSids > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:45:50.349599, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:300(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:45:50.349624, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:45:50.349657, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:50:50 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:45:50.349700, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:50:50 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:45:50.349733, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:45:50.349828, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:45:50.349849, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:45:55.798221, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:45:55.798286, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:45:55.798367, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:45:55.798444, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:45:55.798530, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000023 (35) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:55.798717, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:55.798831, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:55.798900, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:55.799940, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:45:55.800020, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000023 (35) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] B4 D3 CF 50 B0 FA BA 80 DC CF 98 3F 5C E0 1E 6E ...P.... ...?\..n > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 07 FF B5 50 95 E2 98 59 57 D5 68 3B 8D 47 95 47 ...P...Y W.h;.G.G > [0030] 0F DD E0 D3 3A D0 4E ED 80 AA 3F F6 DB AE DB 01 ....:.N. ..?..... > [0040] 80 6A 5B CD 5B A9 DB 01 00 00 00 00 00 00 00 00 .j[.[... ........ >[2025/04/09 07:45:55.800326, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:55.800353, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:45:55.800377, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:55.800408, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:45:55.800429, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:55.800463, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:45:55.800490, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:45:55.800557, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:45:55.800577, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:45:55.800633, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:45:55.800652, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:45:55.809513, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 28 extra bytes >[2025/04/09 07:45:55.809557, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:45:55.809578, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') >[2025/04/09 07:45:55.809615, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > in: struct wbint_LookupSid > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 >[2025/04/09 07:45:55.809675, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:45:55.809722, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) > namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed >[2025/04/09 07:45:55.809753, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) > wcache_sid_to_name: namemap_cache_find_name failed >[2025/04/09 07:45:55.809772, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) > wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX >[2025/04/09 07:45:55.809790, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) > msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX >[2025/04/09 07:45:55.809821, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:458(dcerpc_lsa_lookup_sids_generic) > rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. >[2025/04/09 07:45:55.809855, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids: struct lsa_LookupSids > in: struct lsa_LookupSids > handle : * > handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 > sids : * > sids: struct lsa_SidArray > num_sids : 0x00000001 (1) > sids : * > sids: ARRAY(1) > sids: struct lsa_SidPtr > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363-1104 > names : * > names: struct lsa_TransNameArray > count : 0x00000000 (0) > names : NULL > level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) > count : * > count : 0x00000000 (0) >[2025/04/09 07:45:55.810055, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x004c (76) > call_id : 0x00000024 (36) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000054 (84) > context_id : 0x0000 (0) > opnum : 0x000f (15) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:45:55.810255, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:45:55.810366, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) > Sealed 96 bytes, and got 76 bytes header/signature. >[2025/04/09 07:45:55.810393, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:45:55.810425, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:45:55.811340, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 268 >[2025/04/09 07:45:55.811392, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x011c (284) > auth_length : 0x004c (76) > call_id : 0x00000024 (36) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x000000a4 (164) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=260 > [0000] 11 D7 17 36 B5 5F D2 5D F5 1A DA 91 2E CE 42 19 ...6._.] ......B. > [0010] 3E B1 7D 15 DF 25 7D 73 83 69 04 3B 14 31 A5 86 >.}..%}s .i.;.1.. > [0020] 54 30 14 59 3E 97 4A 20 17 5D FC B0 F0 79 87 94 T0.Y>.J .]...y.. > [0030] 24 DB 62 00 31 48 2C 11 C6 8D 58 47 D3 29 AA C0 $.b.1H,. ..XG.).. > [0040] 15 BA 12 24 8C 04 40 E8 D1 DF EB 45 E6 81 7F 0E ...$..@. ...E.... > [0050] 26 44 48 20 93 00 77 03 CC 99 47 03 8F 89 14 80 &DH ..w. ..G..... > [0060] 4B 38 6F D7 F0 7A 2E E6 13 4C CB 61 F0 9D 43 2F K8o..z.. .L.a..C/ > [0070] 40 59 62 D1 56 C0 B0 0A 2A 6C BB 67 86 96 BD 8D @Yb.V... *l.g.... > [0080] 69 23 CE BA 88 E1 69 85 4A 7E C6 1E 33 D3 37 5E i#....i. J~..3.7^ > [0090] DA 89 70 4A 81 0B A6 4E D3 C8 8C BE E8 50 61 B4 ..pJ...N .....Pa. > [00A0] F3 7B 8A 43 85 1E F9 FE 0C 41 DB 28 1A 4A 14 B2 .{.C.... .A.(.J.. > [00B0] 09 06 0C 00 01 00 00 00 05 04 07 FF 00 10 00 1C ........ ........ > [00C0] 00 00 00 00 13 FD 8B CA 19 D2 57 A6 09 A3 98 B8 ........ ..W..... > [00D0] 15 C3 4A 04 D4 22 D7 FD 42 F6 6A D1 78 72 AC 20 ..J..".. B.j.xr. > [00E0] B7 11 B3 C8 AB 30 28 86 2B F7 CC 36 FC A1 3A A4 .....0(. +..6..:. > [00F0] 43 81 8D 18 02 02 AF 1B B3 31 2E 3A 63 FB F8 51 C....... .1.:c..Q > [0100] 30 EF 6F D6 0.o. >[2025/04/09 07:45:55.811896, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:45:55.811919, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 12 >[2025/04/09 07:45:55.811943, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:45:55.812012, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:306(gssapi_unseal_packet) > Unsealed 176 bytes, with 76 bytes header/signature. >[2025/04/09 07:45:55.812037, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 284, data_len 164 >[2025/04/09 07:45:55.812055, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 284 at offset 0: NT_STATUS_OK >[2025/04/09 07:45:55.812077, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 164 bytes. >[2025/04/09 07:45:55.812112, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_LookupSids: struct lsa_LookupSids > out: struct lsa_LookupSids > domains : * > domains : * > domains: struct lsa_RefDomainList > count : 0x00000001 (1) > domains : * > domains: ARRAY(1) > domains: struct lsa_DomainInfo > name: struct lsa_StringLarge > length : 0x0016 (22) > size : 0x0018 (24) > string : * > string : 'ADPROTOCOLX' > sid : * > sid : S-1-5-21-3967939894-2044440985-2694731363 > max_size : 0x00000020 (32) > names : * > names: struct lsa_TransNameArray > count : 0x00000001 (1) > names : * > names: ARRAY(1) > names: struct lsa_TranslatedName > sid_type : SID_NAME_USER (1) > name: struct lsa_String > length : 0x0014 (20) > size : 0x0014 (20) > string : * > string : 'adxuser191' > sid_index : 0x00000000 (0) > count : * > count : 0x00000001 (1) > result : NT_STATUS_OK >[2025/04/09 07:45:55.812355, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:300(dcerpc_lsa_lookup_sids_noalloc) > LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' >[2025/04/09 07:45:55.812378, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) > Mapped sid to [ADPROTOCOLX]\[adxuser191] >[2025/04/09 07:45:55.812413, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:50:55 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:45:55.812462, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:50:55 AM 2025 EDT] (300 seconds ahead) >[2025/04/09 07:45:55.812497, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_LookupSid: struct wbint_LookupSid > out: struct wbint_LookupSid > type : * > type : SID_NAME_USER (1) > domain : * > domain : * > domain : 'ADPROTOCOLX' > name : * > name : * > name : 'adxuser191' > result : NT_STATUS_OK >[2025/04/09 07:45:55.812581, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:45:55.812602, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4072 bytes to parent >[2025/04/09 07:46:01.286825, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:46:01.286897, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:46:01.287056, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:46:01.287179, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:46:01.287287, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000025 (37) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:46:01.287488, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:46:01.287597, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:46:01.287668, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:46:01.289219, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:46:01.289273, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000025 (37) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 40 6A 0E 1E 9B D7 83 1B 27 FF 08 13 D2 BE 96 39 @j...... '......9 > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 36 08 F0 50 32 EE 6D 5E 6E EA AF 85 DB C7 95 58 6..P2.m^ n......X > [0030] 30 1D E4 27 06 13 3D 92 00 00 00 00 00 00 00 00 0..'..=. ........ > [0040] 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:46:01.289528, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:46:01.289552, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:46:01.289575, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:46:01.289609, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:46:01.289632, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:46:01.289651, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:46:01.289686, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:46:01.289781, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:46:01.289804, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:46:01.289867, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:46:01.289887, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:46:01.573613, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:46:01.573659, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:46:01.573729, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:46:01.573801, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:46:01.573887, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000026 (38) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:46:01.574145, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:46:01.574249, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:46:01.574305, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:46:01.575120, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:46:01.575175, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000026 (38) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] FB 81 52 2B 77 B9 CD 19 92 87 48 83 D0 F7 B2 44 ..R+w... ..H....D > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 2E 80 F3 23 D3 54 F9 03 86 96 75 D4 0A F3 37 15 ...#.T.. ..u...7. > [0030] 76 AB 69 8E 0C 55 8D 84 BF C6 0C 7C A7 48 F2 29 v.i..U.. ...|.H.) > [0040] CA 1F C9 B1 7D 46 24 0C A2 12 7B 64 AA D1 37 99 ....}F$. ..{d..7. >[2025/04/09 07:46:01.575436, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:46:01.575466, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:46:01.575486, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:46:01.575520, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:46:01.575542, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:46:01.575562, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. >[2025/04/09 07:46:01.575599, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:46:01.575683, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:46:01.575707, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc1.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:46:01.575766, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:46:01.575787, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:46:16.310135, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 36 extra bytes >[2025/04/09 07:46:16.310247, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:46:16.310289, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') >[2025/04/09 07:46:16.310429, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:46:16.310589, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > in: struct netr_GetAnyDCName > logon_server : * > logon_server : 'windc1.adprotocolx.com' > domainname : * > domainname : 'adprotocolx' >[2025/04/09 07:46:16.310707, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000027 (39) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000068 (104) > context_id : 0x0000 (0) > opnum : 0x000d (13) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:46:16.310903, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:46:16.311050, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:46:16.311155, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:46:16.567617, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:46:16.567764, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:46:16.568019, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:46:16.568320, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc1.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:46:16.568446, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:46:16.568668, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000006 (6) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000088 (136) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:46:16.568859, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:46:16.568997, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:46:16.569105, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:46:26.576209, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:46:27.577517, 1, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/tstream_smbXcli_np.c:139(tstream_smbXcli_np_destructor) > tstream_smbXcli_np_destructor: cli_close failed on pipe netlogon. Error was NT_STATUS_IO_TIMEOUT >[2025/04/09 07:46:27.577760, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) > cli_api_pipe failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 07:46:27.577830, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 10000 (ms) to 1000 (ms). >[2025/04/09 07:46:27.577939, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 1000 (ms) to 500 (ms). >[2025/04/09 07:46:27.578055, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 500 (ms) to 500 (ms). >[2025/04/09 07:46:27.578157, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:46:28.079017, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1956(connection_ok) > connection_ok: Connection to windc1.adprotocolx.com for domain ADPROTOCOLX is not connected >[2025/04/09 07:46:28.079118, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1770(cm_open_connection) > Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. >[2025/04/09 07:46:28.079157, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) > Attempt 0/3: DC 'windc1.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 07:46:28.079180, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 07:46:28.079275, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc1.adprotocolx.com" for "ADPROTOCOLX" domain >[2025/04/09 07:46:28.079302, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com >[2025/04/09 07:46:28.079325, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1446(connect_preferred_dc) > connect_preferred_dc: saf_servername is 'windc1.adprotocolx.com' for domain ADPROTOCOLX >[2025/04/09 07:46:28.079361, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:46:28.079391, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:46:28.079441, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc1.adprotocolx.com#20 found. >[2025/04/09 07:46:28.079487, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:28.079524, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. >[2025/04/09 07:46:28.079576, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.92'. >[2025/04/09 07:46:28.079613, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: ADPROTOCOLX.COM) >[2025/04/09 07:46:34.082211, 2, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/cldap.c:417(ads_cldap_netlogon) > ads_cldap_netlogon: did not get a reply >[2025/04/09 07:46:34.082303, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:387(ads_try_connect) > ads_try_connect: ads_cldap_netlogon_5(10.28.1.92, ADPROTOCOLX.COM) failed. >[2025/04/09 07:46:34.082398, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com] and timeout=[Wed Apr 9 07:47:34 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 07:46:34.082546, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX (windc1.adprotocolx.com) to failed conn cache >[2025/04/09 07:46:34.082619, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) >[2025/04/09 07:46:34.082655, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) >[2025/04/09 07:46:34.082691, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [ADPROTOCOLX] >[2025/04/09 07:46:34.082721, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com] and timeout=[Wed Apr 9 07:47:34 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 07:46:34.082773, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX.COM (windc1.adprotocolx.com) to failed conn cache >[2025/04/09 07:46:34.082797, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 07:46:34.082827, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 07:46:34.082860, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [ADPROTOCOLX.COM] >[2025/04/09 07:46:34.082889, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1549(find_dc) > Retrieving a list of IP addresses for DCs. >[2025/04/09 07:46:34.082950, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:46:34.083037, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) > ads_dc_name: domain=ADPROTOCOLX >[2025/04/09 07:46:34.083089, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:46:34.083115, 6, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) > resolve_and_ping_dns: (cldap) looking for realm 'ADPROTOCOLX.COM' >[2025/04/09 07:46:34.083135, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) >[2025/04/09 07:46:34.083174, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:46:34.083199, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:46:34.083223, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) >[2025/04/09 07:46:34.083276, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/ADPROTOCOLX.COM#1C] and timeout=[Wed Dec 31 07:00:00 PM 1969 EST] (-1744199194 seconds in the past) >[2025/04/09 07:46:34.083331, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:324(namecache_fetch) > namecache_fetch: no entry for ADPROTOCOLX.COM#1C found. >[2025/04/09 07:46:34.083377, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2509(resolve_ads) > resolve_ads: Attempting to resolve DCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:46:34.083438, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _ldap._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:46:34.083562, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:46:34.083592, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:34.083842, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] F3 E4 01 00 00 01 00 00 00 00 00 00 05 5F 6C 64 ........ ....._ld > [0010] 61 70 04 5F 74 63 70 17 44 65 66 61 75 6C 74 2D ap._tcp. Default- > [0020] 46 69 72 73 74 2D 53 69 74 65 2D 4E 61 6D 65 06 First-Si te-Name. > [0030] 5F 73 69 74 65 73 02 64 63 06 5F 6D 73 64 63 73 _sites.d c._msdcs > [0040] 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 03 43 4F 4D .ADPROTO COLX.COM > [0050] 00 00 21 00 01 ..!.. >[2025/04/09 07:46:35.085199, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:46:35.085281, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:46:35.085308, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:35.085436, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] BC 33 01 00 00 01 00 00 00 00 00 00 05 5F 6C 64 .3...... ....._ld > [0010] 61 70 04 5F 74 63 70 17 44 65 66 61 75 6C 74 2D ap._tcp. Default- > [0020] 46 69 72 73 74 2D 53 69 74 65 2D 4E 61 6D 65 06 First-Si te-Name. > [0030] 5F 73 69 74 65 73 02 64 63 06 5F 6D 73 64 63 73 _sites.d c._msdcs > [0040] 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 03 43 4F 4D .ADPROTO COLX.COM > [0050] 00 00 21 00 01 ..!.. >[2025/04/09 07:46:35.085577, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:46:35.086112, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] BC 33 85 80 00 01 00 02 00 00 00 06 05 5F 6C 64 .3...... ....._ld > [0010] 61 70 04 5F 74 63 70 17 44 65 66 61 75 6C 74 2D ap._tcp. Default- > [0020] 46 69 72 73 74 2D 53 69 74 65 2D 4E 61 6D 65 06 First-Si te-Name. > [0030] 5F 73 69 74 65 73 02 64 63 06 5F 6D 73 64 63 73 _sites.d c._msdcs > [0040] 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 03 43 4F 4D .ADPROTO COLX.COM > [0050] 00 00 21 00 01 C0 0C 00 21 00 01 00 00 02 58 00 ..!..... !.....X. > [0060] 1E 00 00 00 64 01 85 06 77 69 6E 64 63 32 0B 61 ....d... windc2.a > [0070] 64 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 dprotoco lx.com.. > [0080] 0C 00 21 00 01 00 00 02 58 00 1E 00 00 00 64 01 ..!..... X.....d. > [0090] 85 06 77 69 6E 64 63 31 0B 61 64 70 72 6F 74 6F ..windc1 .adproto > [00A0] 63 6F 6C 78 03 63 6F 6D 00 C0 67 00 01 00 01 00 colx.com ..g..... > [00B0] 00 0E 10 00 04 0A 1C 01 5D C0 67 00 01 00 01 00 ........ ].g..... > [00C0] 00 0E 10 00 04 C0 A8 7A CE C0 67 00 1C 00 01 00 .......z ..g..... > [00D0] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. > [00E0] D7 81 C8 0F 00 C0 91 00 01 00 01 00 00 0E 10 00 ........ ........ > [00F0] 04 0A 1C 01 5C C0 91 00 01 00 01 00 00 0E 10 00 ....\... ........ > [0100] 04 C0 A8 7A 85 C0 91 00 1C 00 01 00 00 0E 10 00 ...z.... ........ > [0110] 10 20 01 01 92 00 00 00 00 65 6A 03 48 28 E1 00 . ...... .ej.H(.. > [0120] D1 . >[2025/04/09 07:46:35.086544, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:46:35.086575, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:46:35.086594, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:35.086613, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:46:35.086638, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:46:35.086656, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:35.086677, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:35.086696, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 6 addresses for ADPROTOCOLX.COM#1c: 10.28.1.93,192.168.122.206,[2001:192::c973:d0d7:81c8:f00],10.28.1.92,192.168.122.133,[2001:192::656a:348:28e1:d1] >[2025/04/09 07:46:35.086745, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/ADPROTOCOLX.COM#1C] and timeout=[Wed Apr 9 07:57:35 AM 2025 EDT] (660 seconds ahead) > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:35.086837, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:46:35.086868, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:46:35.086899, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:46:35.086936, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:35.087010, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:46:35.087044, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:46:35.087086, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:35.087107, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:35.087138, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:46:35.087160, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:35.087189, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:46:35.087215, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:46:35.087239, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:46:35.087262, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:46:35.087286, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:35.087318, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:35.087340, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) > cldap_ping_list: Try to create 6 netlogon connections for domain 'ADPROTOCOLX.COM' (provided count of addresses was 6). >[2025/04/09 07:46:35.088353, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:46:35.088779, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:46:35.088806, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477604 seconds ahead) >[2025/04/09 07:46:35.088848, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:46:35.088868, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477604 seconds ahead) >[2025/04/09 07:46:35.088901, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) > cldap_ping_list: realm[ADPROTOCOLX.COM]: selected 10.28.1.93 => windc2.adprotocolx.com >[2025/04/09 07:46:35.088921, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) > cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:46:35.089279, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:46:35.089316, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:46:35.089341, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:46:35.089418, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:46:35.089447, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:46:35.089469, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:46:35.089487, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:46:35.089529, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:46:35.089551, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:46:35.089699, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:46:35.089723, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:35.089801, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 1D 9F 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:46:36.091008, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:46:36.091092, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:46:36.091116, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:36.091246, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 04 54 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .T...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:46:36.091364, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:46:36.091973, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 04 54 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .T...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... > [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. > [0120] D7 81 C8 0F 00 ..... >[2025/04/09 07:46:36.092355, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:46:36.092384, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:46:36.092403, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:36.092423, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:46:36.092441, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:46:36.092458, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:36.092479, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:36.092539, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:46:36.092577, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:46:36.092600, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:46:36.092622, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:36.092643, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:46:36.092664, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:46:36.092685, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:36.092703, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:36.092725, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:46:36.092742, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:36.092765, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:46:36.092789, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:46:36.092810, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:46:36.092828, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:46:36.092850, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:46:36.092868, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:46:36.092938, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:46:36.092988, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:36.093059, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] B3 91 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:46:37.094247, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:46:37.094359, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:46:37.094388, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:37.094585, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 75 2D 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 u-...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:46:37.094700, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:46:37.095244, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 75 2D 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 u-...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s > [0100] D0 D7 81 C8 0F 00 ...... >[2025/04/09 07:46:37.095612, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:46:37.095643, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:46:37.095663, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:37.095684, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:46:37.095703, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:46:37.095721, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:37.095743, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:37.095801, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:46:37.095835, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:46:37.095859, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:46:37.095881, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:37.095904, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:46:37.095926, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:46:37.095948, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:37.096023, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:37.096046, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:46:37.096065, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:37.096100, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:46:37.096125, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:46:37.297771, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:46:40.097438, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:46:40.097619, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:46:40.097665, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) > ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 >[2025/04/09 07:46:40.097718, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:46:40.097739, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) >[2025/04/09 07:46:40.097764, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:46:40.097787, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:46:40.097806, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) >[2025/04/09 07:46:40.097831, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:46:40.097866, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:40.097886, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:46:40.097909, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:46:40.097945, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:46:40.097999, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:40.098035, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:46:40.098057, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:46:40.098079, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:40.098097, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:40.098116, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:46:40.098144, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:40.098181, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:46:40.098213, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:46:40.098257, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:46:40.098307, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:46:40.098334, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:40.098408, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:40.098446, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename NULL) >[2025/04/09 07:46:40.098481, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:46:40.098503, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:46:40.098522, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename (null)) >[2025/04/09 07:46:40.098557, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:46:40.098592, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:40.098659, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:46:40.098701, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:46:40.098729, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:46:40.098761, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:40.098782, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:46:40.098803, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:46:40.098823, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:40.098841, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:40.098859, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:46:40.098876, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:40.098901, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:46:40.098923, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:46:40.098944, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:46:40.098998, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:46:40.099055, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:40.099081, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:40.099112, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1553(find_dc) > Retrieved IP addresses for 6 DCs. >[2025/04/09 07:46:40.099148, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1574(find_dc) > Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). >[2025/04/09 07:46:40.099246, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 445 >[2025/04/09 07:46:40.100019, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1589(find_dc) > Successfully connected to DC '10.28.1.93'. >[2025/04/09 07:46:40.100065, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. >[2025/04/09 07:46:40.100109, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.93'. >[2025/04/09 07:46:40.100134, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) >[2025/04/09 07:46:40.100814, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:46:40.101210, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:46:40.101250, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477599 seconds ahead) >[2025/04/09 07:46:40.101300, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:46:40.101321, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477599 seconds ahead) >[2025/04/09 07:46:40.101358, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:46:40.101382, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 >[2025/04/09 07:46:40.101406, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:57:40 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 07:46:40.101462, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f1fc >[2025/04/09 07:46:40.101486, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:46:40.101508, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:46:40.101551, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:46:40.101582, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:46:40.101619, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:46:40.101649, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:46:40.101670, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:46:40.101690, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:46:40.101745, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:46:40.101766, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:40.101826, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 72 5C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 r\...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:46:41.103078, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:46:41.103162, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:46:41.103186, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:41.103302, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 08 5C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .\...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:46:41.103423, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:46:41.103918, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 08 5C 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .\...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 07:46:41.104320, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:46:41.104351, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:46:41.104370, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:41.104400, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:46:41.104419, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:46:41.104437, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:41.104462, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:41.104506, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:46:41.104546, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:46:41.104569, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:46:41.104591, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:41.104634, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:46:41.104660, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:46:41.104683, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:41.104702, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:41.104732, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:46:41.104749, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:41.104771, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:46:41.104796, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:46:41.104818, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:46:41.104836, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:46:41.104857, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:46:41.104881, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:46:41.104952, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:46:41.105020, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:41.105094, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 6F CF 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 o....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:46:42.106038, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:46:42.106109, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:46:42.106136, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:46:42.106243, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] A3 5A 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .Z...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:46:42.106344, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:46:42.106713, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] A3 5A 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .Z...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej > [0100] 03 48 28 E1 00 D1 .H(... >[2025/04/09 07:46:42.107084, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:46:42.107126, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:46:42.107156, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:42.107179, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:46:42.107199, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:46:42.107218, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:42.107241, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:42.107289, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:46:42.107323, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:46:42.107348, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:46:42.107372, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:46:42.107399, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:46:42.107421, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:46:42.107445, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:42.107465, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:46:42.107486, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:46:42.107505, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:46:42.107530, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:46:42.107554, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:46:42.208821, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:46:45.108821, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:46:45.109066, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:46:45.109167, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200105] >[2025/04/09 07:46:45.109200, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:01:45 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:46:45.109249, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200105] >[2025/04/09 07:46:45.109270, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:01:45 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:46:45.109301, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' >[2025/04/09 07:46:45.109337, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 07:46:45.109625, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). >[2025/04/09 07:46:45.109762, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1019(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:46:45.111205, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:861(cm_prepare_connection) > connecting to windc2.adprotocolx.com (ADPROTOCOLX, ADPROTOCOLX.COM) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] >[2025/04/09 07:46:45.111267, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com >[2025/04/09 07:46:45.111517, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] >[2025/04/09 07:46:45.111612, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199205.111493: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:46:45.112882, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199205.111495: Sending unauthenticated request >[2025/04/09 07:46:45.112940, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199205.111496: Sending request (182 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:46:45.113271, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199205.111497: Resolving hostname 10.28.1.93 >[2025/04/09 07:46:45.113479, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199205.111498: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 07:46:45.114492, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199205.111499: Received answer (219 bytes) from dgram 10.28.1.93:88 >[2025/04/09 07:46:45.114594, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199205.111500: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:46:50.118703, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199210.118683: No URI records found >[2025/04/09 07:46:50.119065, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199210.118684: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. >[2025/04/09 07:46:51.346546, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:46:52.347871, 1, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/tstream_smbXcli_np.c:139(tstream_smbXcli_np_destructor) > tstream_smbXcli_np_destructor: cli_close failed on pipe netlogon. Error was NT_STATUS_IO_TIMEOUT >[2025/04/09 07:46:52.348076, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) > cli_api_pipe failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 07:46:52.348195, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 10000 (ms) to 1000 (ms). >[2025/04/09 07:46:52.348276, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > lsa_Close: struct lsa_Close > in: struct lsa_Close > handle : * > handle: struct policy_handle > handle_type : 0x00000000 (0) > uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 >[2025/04/09 07:46:52.348448, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x004c (76) > call_id : 0x00000028 (40) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000014 (20) > context_id : 0x0000 (0) > opnum : 0x0000 (0) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:46:52.348684, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:46:52.349092, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) > Sealed 32 bytes, and got 76 bytes header/signature. >[2025/04/09 07:46:52.349141, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc1.adprotocolx.com >[2025/04/09 07:46:52.349204, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:46:55.125075, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199215.125063: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:46:58.195697, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195681: No SRV records found >[2025/04/09 07:46:58.195795, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195682: Response was not from master KDC >[2025/04/09 07:46:58.195887, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195683: Received error from KDC: -1765328359/Additional pre-authentication required >[2025/04/09 07:46:58.196079, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195686: Preauthenticating using KDC method data >[2025/04/09 07:46:58.196123, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195687: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) >[2025/04/09 07:46:58.196163, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195688: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:46:58.200235, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195689: AS key obtained for encrypted timestamp: aes256-cts/C8D8 >[2025/04/09 07:46:58.200312, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195691: Encrypted timestamp (for 1744210003.931221): plain 301AA011180F32303235303430393134343634335AA10502030E3595, encrypted 484453365B41F286ADC256916C113D9F9BF7E81782D91E17ACCF99F8148FDC19CB1E023B3386B7D3146B949A40571F81F9220BBD92C1F36A >[2025/04/09 07:46:58.200358, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195692: Preauth module encrypted_timestamp (2) (real) returned: 0/Success >[2025/04/09 07:46:58.200385, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195693: Produced preauth for next request: PA-ENC-TIMESTAMP (2) >[2025/04/09 07:46:58.200454, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195694: Sending request (261 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:46:58.200545, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195695: Resolving hostname 10.28.1.93 >[2025/04/09 07:46:58.200665, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195696: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 07:46:58.203587, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195697: Received answer (102 bytes) from dgram 10.28.1.93:88 >[2025/04/09 07:46:58.203689, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199218.195698: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:47:01.267995, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199221.267940: No URI records found >[2025/04/09 07:47:01.268179, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199221.267941: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. >[2025/04/09 07:47:02.359510, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:47:03.360713, 1, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/tstream_smbXcli_np.c:139(tstream_smbXcli_np_destructor) > tstream_smbXcli_np_destructor: cli_close failed on pipe lsarpc. Error was NT_STATUS_IO_TIMEOUT >[2025/04/09 07:47:03.360808, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) > cli_api_pipe failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 07:47:03.361299, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 1000 (ms) to 500 (ms). >[2025/04/09 07:47:03.361344, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 500 (ms) to 500 (ms). >[2025/04/09 07:47:03.361423, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:47:03.862190, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1956(connection_ok) > connection_ok: Connection to windc1.adprotocolx.com for domain ADPROTOCOLX is not connected >[2025/04/09 07:47:03.862263, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1770(cm_open_connection) > Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. >[2025/04/09 07:47:03.862287, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) > Attempt 0/3: DC 'windc1.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 07:47:03.862306, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 07:47:03.862372, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX" domain >[2025/04/09 07:47:03.862400, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc2.adprotocolx.com >[2025/04/09 07:47:03.862421, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1446(connect_preferred_dc) > connect_preferred_dc: saf_servername is 'windc2.adprotocolx.com' for domain ADPROTOCOLX >[2025/04/09 07:47:03.862464, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:03.862490, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:47:03.862528, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:47:03.862559, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:03.862587, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. >[2025/04/09 07:47:03.862612, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.93'. >[2025/04/09 07:47:03.862644, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) >[2025/04/09 07:47:03.863554, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:47:03.863926, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:47:03.863977, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477576 seconds ahead) >[2025/04/09 07:47:03.864061, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:47:03.864085, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477576 seconds ahead) >[2025/04/09 07:47:03.864124, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:47:03.864153, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 >[2025/04/09 07:47:03.864178, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:58:03 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 07:47:03.864222, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f1fc >[2025/04/09 07:47:03.864250, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:47:03.864273, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:03.864322, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:47:03.864350, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:03.864374, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc2.adprotocolx.com, *" >[2025/04/09 07:47:03.864396, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:47:03.864418, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:47:03.864450, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:47:03.864525, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:47:03.864550, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:03.864622, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 0E 34 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .4...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:47:04.339669, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199224.339646: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:47:04.865818, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:47:04.865919, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:47:04.865945, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:04.866153, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] CB 23 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .#...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:47:04.866296, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:47:04.866903, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] CB 23 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .#...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... > [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. > [0120] D7 81 C8 0F 00 ..... >[2025/04/09 07:47:04.867330, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:47:04.867361, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:47:04.867381, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:04.867411, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:47:04.867446, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:47:04.867465, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:04.867487, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:04.867551, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:04.867606, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:04.867636, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:47:04.867660, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:47:04.867685, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:04.867709, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:04.867733, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:04.867754, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:04.867776, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:04.867798, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:04.867818, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:04.867839, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:04.867858, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:04.867877, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:04.867899, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 10.28.1.92 192.168.122.133 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:04.867924, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:47:04.867948, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:04.867997, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc2.adprotocolx.com, *" >[2025/04/09 07:47:04.868039, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:47:04.868061, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:47:04.868080, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:47:04.868144, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:47:04.868165, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:04.868223, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] E5 E1 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:47:05.869394, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:47:05.869491, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:47:05.869523, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:05.869667, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 12 FC 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:47:05.869770, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:47:05.870272, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 12 FC 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s > [0100] D0 D7 81 C8 0F 00 ...... >[2025/04/09 07:47:05.870658, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:47:05.870689, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:47:05.870709, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:05.870729, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:47:05.870748, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:47:05.870767, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:05.870788, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:05.870834, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:05.870882, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:05.870905, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:47:05.870930, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:47:05.870955, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:05.871012, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:05.871051, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:05.871076, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:05.871108, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:05.871132, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:05.871154, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:05.871176, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:05.871195, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:05.871215, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:05.871233, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 10.28.1.92 192.168.122.133 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:05.871257, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:47:05.871278, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:47:06.072734, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:47:07.411569, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411559: No SRV records found >[2025/04/09 07:47:07.411640, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411560: Response was not from master KDC >[2025/04/09 07:47:07.411730, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411561: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP >[2025/04/09 07:47:07.411769, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411562: Request or response is too big for UDP; retrying with TCP >[2025/04/09 07:47:07.411796, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411563: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) >[2025/04/09 07:47:07.411908, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411564: Resolving hostname 10.28.1.93 >[2025/04/09 07:47:07.412113, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411565: Initiating TCP connection to stream 10.28.1.93:88 >[2025/04/09 07:47:07.412466, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411566: Sending TCP request to stream 10.28.1.93:88 >[2025/04/09 07:47:07.413875, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411567: Received answer (1596 bytes) from stream 10.28.1.93:88 >[2025/04/09 07:47:07.413918, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411568: Terminating TCP connection to stream 10.28.1.93:88 >[2025/04/09 07:47:07.414048, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199227.411569: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:47:08.872429, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:47:08.872661, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:47:08.872730, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200128] >[2025/04/09 07:47:08.872768, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:02:08 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:47:08.872819, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200128] >[2025/04/09 07:47:08.872840, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:02:08 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:47:08.872872, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' >[2025/04/09 07:47:08.872903, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc2.adprotocolx.com >[2025/04/09 07:47:08.873000, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 445 >[2025/04/09 07:47:08.873702, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 07:47:10.483863, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199230.483850: No URI records found >[2025/04/09 07:47:10.484068, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199230.483851: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:47:13.555644, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555627: No SRV records found >[2025/04/09 07:47:13.555735, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555628: Response was not from master KDC >[2025/04/09 07:47:13.555934, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555629: Processing preauth types: PA-ETYPE-INFO2 (19) >[2025/04/09 07:47:13.556015, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555630: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:47:13.556052, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555631: Produced preauth for next request: (empty) >[2025/04/09 07:47:13.556110, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555632: AS key determined by preauth: aes256-cts/C8D8 >[2025/04/09 07:47:13.556243, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555633: Decrypted AS reply; session key is: aes256-cts/3391 >[2025/04/09 07:47:13.556292, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555634: FAST negotiation: unavailable >[2025/04/09 07:47:13.556414, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:47:13.556448, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555635: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:47:13.556485, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199233.555636: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect >[2025/04/09 07:47:13.556555, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos >[2025/04/09 07:47:13.556588, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) > cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO >[2025/04/09 07:47:13.556910, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 07:47:13.557036, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 07:47:31.694331, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) >[2025/04/09 07:47:31.694388, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) > tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb >[2025/04/09 07:47:31.694561, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) > Could not get the lock for windc2.adprotocolx.com >[2025/04/09 07:47:31.694655, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) > cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com >[2025/04/09 07:47:31.694708, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK >[2025/04/09 07:47:31.988594, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf826037d0]: subreq: 0x55cf825c8e50 >[2025/04/09 07:47:31.988668, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf826034c0]: subreq: 0x55cf825af290 >[2025/04/09 07:47:31.988725, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf826037d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8e50/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825c9030)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] >[2025/04/09 07:47:31.988846, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf826034c0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825af290/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf825af470)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:47:31.991865, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf826037d0]: subreq: 0x55cf825c8930 >[2025/04/09 07:47:31.991908, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf826034c0]: subreq: 0x55cf825af290 >[2025/04/09 07:47:31.991943, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf826037d0]: NT_STATUS_OK tevent_req[0x55cf825c8930/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825c8b10)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:994] >[2025/04/09 07:47:31.992032, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf826034c0]: NT_STATUS_OK tevent_req[0x55cf825af290/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf825af470)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:47:31.992357, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:47:31.992762, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200151] >[2025/04/09 07:47:31.992793, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:02:31 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:47:31.992871, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200151] >[2025/04/09 07:47:31.992896, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:02:31 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:47:31.993016, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) > set_domain_online: called for domain ADPROTOCOLX >[2025/04/09 07:47:31.993067, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:47:31.993215, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) > messaging_dgm_send: Sending message to 2398430 >[2025/04/09 07:47:31.993272, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403284396 seconds ahead) >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:47:31.993685, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=13, vnn=4026531841, opcode=18, srvid=0 >[2025/04/09 07:47:31.993908, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=14, vnn=4026531841, opcode=4, srvid=0 >[2025/04/09 07:47:31.994073, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=15, vnn=4026531841, opcode=149, srvid=0 >[2025/04/09 07:47:31.994314, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) > db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:47:31.995561, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > session_key : 6927d03bace8352078671274da7f767c > sequence : 0x67f65e44 (1744199236) > seed: struct netr_Credential > data : 5ae434c6f197d07b > client: struct netr_Credential > data : 7b2f5a59c67e107d > server: struct netr_Credential > data : 780a45edba62c4b2 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > ex : * > ex: struct netlogon_creds_CredentialState_extra_info > magic : 0x00000601 (1537) > reserved : 0x00000000 (0) > client_requested_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > auth_time : Wed Apr 9 07:47:15 AM 2025 EDT > client_sid : S-1-0-1108 >[2025/04/09 07:47:31.996261, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:47:31.996305, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:47:31.996342, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:47:31.996436, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:47:31.996485, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:47:31.996515, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:47:31.996540, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:47:31.996655, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:47:31.997282, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > session_key : 6927d03bace8352078671274da7f767c > sequence : 0x67f65e44 (1744199236) > seed: struct netr_Credential > data : 5ae434c6f197d07b > client: struct netr_Credential > data : 7b2f5a59c67e107d > server: struct netr_Credential > data : 780a45edba62c4b2 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > ex : * > ex: struct netlogon_creds_CredentialState_extra_info > magic : 0x00000601 (1537) > reserved : 0x00000000 (0) > client_requested_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > auth_time : Wed Apr 9 07:47:15 AM 2025 EDT > client_sid : S-1-0-1108 >[2025/04/09 07:47:31.998059, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 07:47:31.998115, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 07:47:31.998147, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 07:47:31.998243, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55cf825b00d0]: subreq: 0x55cf825c8e50 >[2025/04/09 07:47:31.998276, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55cf825b00d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8e50/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825c9030)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] >[2025/04/09 07:47:31.998312, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 07:47:31.998438, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x00000007 (7) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 07:47:31.998787, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:47:31.998845, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:47:31.999373, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 72 >[2025/04/09 07:47:31.999446, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0058 (88) > auth_length : 0x000c (12) > call_id : 0x00000007 (7) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b4c (2892) > secondary_address_size : 0x000c (12) > secondary_address : '\pipe\lsass' > _pad1 : DATA_BLOB length=2 > [0000] 63 00 c. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 07:47:31.999767, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 88 at offset 0: NT_STATUS_OK >[2025/04/09 07:47:31.999790, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 88 bytes. >[2025/04/09 07:47:31.999818, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:47:31.999840, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:47:31.999869, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55cf825b00d0]: subreq: 0x55cf825c8e50 >[2025/04/09 07:47:31.999895, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55cf825b00d0]: NT_STATUS_OK tevent_req[0x55cf825c8e50/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825c9030)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] >[2025/04/09 07:47:31.999932, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:47:31.999986, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:47:32.000018, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:47:32.000043, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 07:47:32.000065, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=17, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 07:47:32.000100, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:47:32.000129, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:47:32.000148, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:47:32.000171, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:47:32.000255, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:47:32.000341, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:47:32.000575, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000008 (8) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000088 (136) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:47:32.000768, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:47:32.000861, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:47:32.000904, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:47:32.001603, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:47:32.001650, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000008 (8) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] A6 AC 84 DA F5 B2 16 21 42 38 F7 99 F9 E4 ED 80 .......! B8...... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] EB AC 18 33 EB 61 89 C1 9C 51 0C 0D 0F CF CE 5D ...3.a.. .Q.....] > [0030] A2 C6 7A E9 7B 2F 69 83 B5 5E 4C 6E 14 B7 01 08 ..z.{/i. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:47:32.001914, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:47:32.001937, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:47:32.001983, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:47:32.002032, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:47:32.002057, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:47:32.002077, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:47:32.002110, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:47:32.002249, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:47:32.002299, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:47:32.002431, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:47:32.002479, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:47:32.002763, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:47:32.002791, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:47:32.002903, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:47:32.002980, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:47:32.003053, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000009 (9) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:47:32.003252, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:47:32.003331, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:47:32.003368, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:47:32.003799, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:47:32.003841, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000009 (9) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 06 36 F3 39 8D 1A B9 0D 37 2F F9 CA BA 11 E1 41 .6.9.... 7/.....A > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 19 55 C0 2E 27 B8 D4 90 41 7D 00 B9 5E B8 64 AB .U..'... A}..^.d. > [0030] 84 3F 57 CB BE 6C A1 E7 B5 5E 4C 6E 14 B7 01 08 .?W..l.. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:47:32.004139, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:47:32.004164, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:47:32.004184, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:47:32.004219, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:47:32.004242, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:47:32.004262, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:47:32.004303, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:47:32.004370, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:47:32.004392, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:47:32.004450, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:47:32.004482, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:47:46.604931, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:47:46.605008, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:47:46.605141, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:47:46.605285, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:47:46.605397, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000000a (10) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:47:46.605618, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:47:46.605745, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:47:46.605837, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:47:46.607131, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:47:46.607194, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000000a (10) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 36 17 D8 99 86 DC AC E8 2F 98 D6 4C 24 41 10 A7 6....... /..L$A.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] A5 5F 4F B0 7B 2C FE 67 95 71 A3 35 FB 2A B5 37 ._O.{,.g .q.5.*.7 > [0030] 2D B2 13 72 3E C1 4D 3C B5 5E 4C 6E 14 B7 01 08 -..r>.M< .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:47:46.607459, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:47:46.607493, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:47:46.607517, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:47:46.607555, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:47:46.607581, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:47:46.607601, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:47:46.607639, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:47:46.607742, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:47:46.607794, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:47:46.607864, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:47:46.607886, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:47:48.874108, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_brlock failed (fd=19) at offset 560 rw_type=1 flags=1 len=1 >[2025/04/09 07:47:48.874315, 1, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) >[2025/04/09 07:47:48.874378, 0, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) > tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb >[2025/04/09 07:47:48.874716, 1, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/server_mutex.c:97(grab_named_mutex) > Could not get the lock for windc2.adprotocolx.com >[2025/04/09 07:47:48.874899, 0, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) > cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com >[2025/04/09 07:47:48.875006, 1, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK >[2025/04/09 07:47:48.875110, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:48:48 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 07:47:48.875222, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX (windc2.adprotocolx.com) to failed conn cache >[2025/04/09 07:47:48.875272, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) >[2025/04/09 07:47:48.875300, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) >[2025/04/09 07:47:48.875360, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [ADPROTOCOLX] >[2025/04/09 07:47:48.875398, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:48:48 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 07:47:48.875453, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX.COM (windc2.adprotocolx.com) to failed conn cache >[2025/04/09 07:47:48.875481, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 07:47:48.875512, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 07:47:48.875549, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [ADPROTOCOLX.COM] >[2025/04/09 07:47:48.875580, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) > Attempt 1/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 07:47:48.875605, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 07:47:48.875635, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX" domain >[2025/04/09 07:47:48.875665, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result -1073741420 for domain ADPROTOCOLX server windc2.adprotocolx.com >[2025/04/09 07:47:48.875688, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1549(find_dc) > Retrieving a list of IP addresses for DCs. >[2025/04/09 07:47:48.875752, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:48.875796, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) > ads_dc_name: domain=ADPROTOCOLX >[2025/04/09 07:47:48.875838, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:48.875863, 6, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) > resolve_and_ping_dns: (cldap) looking for realm 'ADPROTOCOLX.COM' >[2025/04/09 07:47:48.875888, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) >[2025/04/09 07:47:48.875938, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:48.875985, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:47:48.876015, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) >[2025/04/09 07:47:48.876072, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:47:48.876147, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:48.876184, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:48.876218, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:48.876252, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:48.876285, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:48.876312, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:48.876341, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:48.876368, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:48.876388, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:48.876408, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:48.876427, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:48.876457, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:48.876501, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:48.876530, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:48.876556, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:48.876586, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:48.876620, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:48.876666, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) > cldap_ping_list: Try to create 6 netlogon connections for domain 'ADPROTOCOLX.COM' (provided count of addresses was 6). >[2025/04/09 07:47:48.877680, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:47:48.878587, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:47:48.878624, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477531 seconds ahead) >[2025/04/09 07:47:48.878675, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:47:48.878700, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477531 seconds ahead) >[2025/04/09 07:47:48.878771, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) > cldap_ping_list: realm[ADPROTOCOLX.COM]: selected 10.28.1.93 => windc2.adprotocolx.com >[2025/04/09 07:47:48.878797, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) > cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:47:48.879758, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:47:48.879804, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:48.879842, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:47:48.879929, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:47:48.880005, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:48.880044, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:47:48.880085, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:47:48.880119, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:47:48.880187, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:47:48.880292, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:47:48.880337, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:48.880414, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 41 CE 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 A....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:47:49.881021, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:47:49.881122, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:47:49.881154, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:49.881274, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 8D 2E 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:47:49.881419, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:47:49.882118, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 8D 2E 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 07:47:49.882571, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:47:49.882604, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:47:49.882632, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:49.882653, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:47:49.882673, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:47:49.882692, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:49.882715, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:49.882774, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:49.882820, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:49.882846, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:49.882875, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:49.882899, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:49.882922, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:49.882945, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:49.882995, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:49.883022, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:49.883042, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:49.883078, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:47:49.883112, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:49.883149, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:47:49.883169, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:47:49.883193, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:47:49.883213, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:47:49.883272, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:47:49.883298, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:49.883357, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 91 69 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .i...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:47:50.884529, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:47:50.884620, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:47:50.884658, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:50.884763, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 1D EA 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:47:50.884883, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:47:50.885288, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 1D EA 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej > [0100] 03 48 28 E1 00 D1 .H(... >[2025/04/09 07:47:50.885717, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:47:50.885751, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:47:50.885774, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:50.885812, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:47:50.885833, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:47:50.885854, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:50.885877, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:50.885927, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:50.885989, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:50.886039, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:50.886078, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:50.886119, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:50.886147, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:50.886183, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:50.886203, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:50.886250, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:50.886279, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:50.886314, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:47:50.886354, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:47:50.987574, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:47:53.888317, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:47:53.888559, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:47:53.888644, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) > ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 >[2025/04/09 07:47:53.888744, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:53.888787, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) >[2025/04/09 07:47:53.888843, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:53.888890, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:47:53.888916, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) >[2025/04/09 07:47:53.888978, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:47:53.889045, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:53.889084, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:53.889120, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:53.889148, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:53.889189, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:53.889220, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:53.889365, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:53.889412, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:53.889441, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:53.889486, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:53.889505, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:53.889553, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:47:53.889664, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:47:53.889712, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:47:53.889763, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:47:53.889800, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:53.889864, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:53.889897, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename NULL) >[2025/04/09 07:47:53.889925, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:53.889985, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:47:53.890086, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename (null)) >[2025/04/09 07:47:53.890124, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:47:53.890159, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:53.890192, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:53.890225, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:53.890252, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:53.890285, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:53.890312, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:53.890342, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:53.890367, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:53.890397, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:53.890437, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:53.890464, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:53.890507, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:47:53.890534, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:47:53.890564, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:47:53.890591, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:47:53.890625, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:53.890651, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:53.890679, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1553(find_dc) > Retrieved IP addresses for 6 DCs. >[2025/04/09 07:47:53.890706, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1574(find_dc) > Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). >[2025/04/09 07:47:53.890804, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 445 >[2025/04/09 07:47:53.891320, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1589(find_dc) > Successfully connected to DC '10.28.1.93'. >[2025/04/09 07:47:53.891375, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. >[2025/04/09 07:47:53.891410, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.93'. >[2025/04/09 07:47:53.891437, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) >[2025/04/09 07:47:53.892243, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:47:53.893197, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:47:53.893240, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477526 seconds ahead) >[2025/04/09 07:47:53.893315, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:47:53.893357, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477526 seconds ahead) >[2025/04/09 07:47:53.893401, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:47:53.893433, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 >[2025/04/09 07:47:53.893461, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:58:53 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 07:47:53.893514, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f1fc >[2025/04/09 07:47:53.893546, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:47:53.893588, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:47:53.893652, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:47:53.893731, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:53.893770, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:47:53.893793, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:47:53.893846, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:47:53.893875, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:47:53.893987, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:47:53.894040, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:53.894131, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 49 0C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 I....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:47:54.895063, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:47:54.895165, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:47:54.895210, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:54.895338, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 7A 19 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 z....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:47:54.895475, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:47:54.896085, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 7A 19 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 z....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... > [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. > [0120] D7 81 C8 0F 00 ..... >[2025/04/09 07:47:54.896573, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:47:54.896618, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:47:54.896652, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:54.896679, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:47:54.896706, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:47:54.896727, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:54.896762, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:54.896823, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:54.896890, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:54.896928, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:54.897001, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:54.897031, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:54.897062, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:54.897097, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:54.897133, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:54.897165, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:54.897232, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:54.897270, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:47:54.897302, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:47:54.897327, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:47:54.897358, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:47:54.897386, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:47:54.897407, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:47:54.897483, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:47:54.897517, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:54.897590, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 2E 95 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:47:55.898786, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:47:55.898910, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:47:55.898942, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:47:55.899094, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 0C F9 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:47:55.899230, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:47:55.899683, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 0C F9 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s > [0100] D0 D7 81 C8 0F 00 ...... >[2025/04/09 07:47:55.900403, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:47:55.900454, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:47:55.900481, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:55.900509, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:47:55.900535, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:47:55.900556, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:55.900592, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:55.900652, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:47:55.900695, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:47:55.900740, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:47:55.900768, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:47:55.900810, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:47:55.900843, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:47:55.900897, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:55.900924, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:47:55.900977, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:47:55.901012, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:47:55.901043, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:47:55.901081, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:47:56.102573, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:47:56.885298, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) >[2025/04/09 07:47:56.885468, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) > tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb >[2025/04/09 07:47:56.885756, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) > Could not get the lock for windc2.adprotocolx.com >[2025/04/09 07:47:56.886023, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) > cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com >[2025/04/09 07:47:56.886113, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK >[2025/04/09 07:47:58.903180, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:47:58.903554, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:47:58.903664, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200178] >[2025/04/09 07:47:58.903707, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:02:58 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:47:58.903776, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200178] >[2025/04/09 07:47:58.903800, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:02:58 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:47:58.903843, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' >[2025/04/09 07:47:58.903881, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 07:48:01.602910, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:48:01.603040, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:48:01.603193, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:48:01.603327, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:48:01.603483, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000000b (11) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:48:01.603736, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:48:01.603928, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:48:01.604046, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:01.605014, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:48:01.605079, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000000b (11) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] F8 87 AC D4 E2 59 21 7E 51 E2 3D EF BF 17 03 20 .....Y!~ Q.=.... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 67 6D 7A 6E 66 FA 96 03 03 54 25 50 00 86 DD 8E gmznf... .T%P.... > [0030] CB C3 8B 22 D6 37 02 29 B5 5E 4C 6E 14 B7 01 08 ...".7.) .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:48:01.605390, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:48:01.605415, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:48:01.605435, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:48:01.605476, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:48:01.605500, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:48:01.605521, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:48:01.605550, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:48:01.605637, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:48:01.605719, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:48:01.605816, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:48:01.605839, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:48:14.996554, 1] ../../source3/winbindd/winbindd_cm.c:877(cm_prepare_connection) > authenticated session setup to windc2.adprotocolx.com using GPFSNMBASH$@ADPROTOCOLX.COM failed with NT_STATUS_CONNECTION_RESET >[2025/04/09 07:48:14.996786, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_CONNECTION_RESET >[2025/04/09 07:48:14.997380, 1] ../../source3/winbindd/winbindd_cm.c:776(cm_prepare_connection) > Could not cli_initialize >[2025/04/09 07:48:14.997502, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_NO_MEMORY >[2025/04/09 07:48:14.997704, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). >[2025/04/09 07:48:14.997881, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1019(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:48:14.999810, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:861(cm_prepare_connection) > connecting to windc2.adprotocolx.com (ADPROTOCOLX, ADPROTOCOLX.COM) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] >[2025/04/09 07:48:14.999862, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com >[2025/04/09 07:48:15.000141, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] >[2025/04/09 07:48:15.000236, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199295.000125: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:48:15.001134, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199295.000127: Sending unauthenticated request >[2025/04/09 07:48:15.001219, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199295.000128: Sending request (182 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:48:15.001501, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199295.000129: Resolving hostname 10.28.1.93 >[2025/04/09 07:48:15.001719, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199295.000130: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 07:48:15.002790, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199295.000131: Received answer (219 bytes) from dgram 10.28.1.93:88 >[2025/04/09 07:48:15.002903, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199295.000132: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:48:16.611197, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:48:16.611313, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:48:16.611431, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:48:16.611540, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:48:16.611653, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000000c (12) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:48:16.611876, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:48:16.612006, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:48:16.612082, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:16.612946, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:48:16.613026, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000000c (12) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 0F C8 02 AF 16 6E B5 E8 1D 6A D2 A8 98 06 A0 8E .....n.. .j...... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] AD 25 A5 65 FB A8 12 20 A5 E7 63 BA 89 14 F9 DF .%.e... ..c..... > [0030] 03 90 ED 0C 3C BD 2A 33 00 00 00 00 00 00 00 00 ....<.*3 ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:48:16.613356, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:48:16.613382, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:48:16.613413, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:48:16.613448, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:48:16.613471, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:48:16.613501, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:48:16.613531, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:48:16.613619, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:48:16.613643, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:48:16.613710, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:48:16.613732, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:48:18.067884, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199298.067814: No URI records found >[2025/04/09 07:48:18.068071, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199298.067815: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. >[2025/04/09 07:48:21.139763, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199301.139749: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:48:24.212094, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212078: No SRV records found >[2025/04/09 07:48:24.212188, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212079: Response was not from master KDC >[2025/04/09 07:48:24.212313, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212080: Received error from KDC: -1765328359/Additional pre-authentication required >[2025/04/09 07:48:24.212578, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212083: Preauthenticating using KDC method data >[2025/04/09 07:48:24.212616, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212084: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) >[2025/04/09 07:48:24.212646, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212085: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:48:24.212683, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 36 extra bytes >[2025/04/09 07:48:24.212778, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:48:24.212826, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') >[2025/04/09 07:48:24.212972, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:48:24.213151, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > in: struct netr_GetAnyDCName > logon_server : * > logon_server : 'windc2.adprotocolx.com' > domainname : * > domainname : 'adprotocolx' >[2025/04/09 07:48:24.213277, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000000d (13) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000068 (104) > context_id : 0x0000 (0) > opnum : 0x000d (13) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:48:24.213507, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:48:24.213638, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:48:24.213730, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:24.216715, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212086: AS key obtained for encrypted timestamp: aes256-cts/C8D8 >[2025/04/09 07:48:24.216812, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212088: Encrypted timestamp (for 1744210093.702851): plain 301AA011180F32303235303430393134343831335AA10502030AB983, encrypted 8ACDE9179797C3A1A64C1840882D0DBC2DB33A1A4B4AF8328F3F0F756DC31E775694D4659F273C82CCE71D317A086A4C0997CAD1BB4E5498 >[2025/04/09 07:48:24.216867, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212089: Preauth module encrypted_timestamp (2) (real) returned: 0/Success >[2025/04/09 07:48:24.216896, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212090: Produced preauth for next request: PA-ENC-TIMESTAMP (2) >[2025/04/09 07:48:24.216986, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212091: Sending request (261 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:48:24.217287, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212092: Resolving hostname 10.28.1.92 >[2025/04/09 07:48:24.217435, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199304.212093: Sending initial UDP request to dgram 10.28.1.92:88 >[2025/04/09 07:48:25.218623, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199305.218611: Resolving hostname 10.28.1.93 >[2025/04/09 07:48:25.218860, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199305.218612: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 07:48:25.220992, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199305.218613: Received answer (102 bytes) from dgram 10.28.1.93:88 >[2025/04/09 07:48:25.221209, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199305.218614: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:48:27.283665, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199307.283652: No URI records found >[2025/04/09 07:48:27.283778, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199307.283653: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. >[2025/04/09 07:48:30.355719, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199310.355709: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:48:33.427794, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427777: No SRV records found >[2025/04/09 07:48:33.427904, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427778: Response was not from master KDC >[2025/04/09 07:48:33.428009, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427779: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP >[2025/04/09 07:48:33.428058, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427780: Request or response is too big for UDP; retrying with TCP >[2025/04/09 07:48:33.428110, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427781: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) >[2025/04/09 07:48:33.428399, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427782: Resolving hostname 10.28.1.93 >[2025/04/09 07:48:33.428624, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427783: Initiating TCP connection to stream 10.28.1.93:88 >[2025/04/09 07:48:33.429136, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427784: Sending TCP request to stream 10.28.1.93:88 >[2025/04/09 07:48:33.430550, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427785: Received answer (1596 bytes) from stream 10.28.1.93:88 >[2025/04/09 07:48:33.430607, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427786: Terminating TCP connection to stream 10.28.1.93:88 >[2025/04/09 07:48:33.430701, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199313.427787: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:48:36.499814, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199316.499802: No URI records found >[2025/04/09 07:48:36.499916, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199316.499803: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:48:39.571697, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571682: No SRV records found >[2025/04/09 07:48:39.571839, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571683: Response was not from master KDC >[2025/04/09 07:48:39.571970, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571684: Processing preauth types: PA-ETYPE-INFO2 (19) >[2025/04/09 07:48:39.572043, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571685: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:48:39.572077, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571686: Produced preauth for next request: (empty) >[2025/04/09 07:48:39.572163, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571687: AS key determined by preauth: aes256-cts/C8D8 >[2025/04/09 07:48:39.572311, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571688: Decrypted AS reply; session key is: aes256-cts/1980 >[2025/04/09 07:48:39.572363, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571689: FAST negotiation: unavailable >[2025/04/09 07:48:39.572497, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:48:39.572566, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571690: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:48:39.572668, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398472] 1744199319.571691: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect >[2025/04/09 07:48:39.572779, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos >[2025/04/09 07:48:39.572830, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) > cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO >[2025/04/09 07:48:39.573215, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 07:48:39.573331, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 07:48:46.902048, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) >[2025/04/09 07:48:46.902145, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) > tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb >[2025/04/09 07:48:46.902769, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) > Could not get the lock for windc2.adprotocolx.com >[2025/04/09 07:48:46.902940, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) > cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com >[2025/04/09 07:48:46.903035, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK >[2025/04/09 07:48:58.004521, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf82590090]: subreq: 0x55cf825a79f0 >[2025/04/09 07:48:58.004618, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf82595480]: subreq: 0x55cf825ee110 >[2025/04/09 07:48:58.004723, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf82590090]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825a79f0/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] >[2025/04/09 07:48:58.004826, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf82595480]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825ee110/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf825ee2f0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:48:58.006892, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf82590090]: subreq: 0x55cf825a8c50 >[2025/04/09 07:48:58.006947, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf82595480]: subreq: 0x55cf82601d30 >[2025/04/09 07:48:58.007006, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf82590090]: NT_STATUS_OK tevent_req[0x55cf825a8c50/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825a8e30)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:994] >[2025/04/09 07:48:58.007081, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf82595480]: NT_STATUS_OK tevent_req[0x55cf82601d30/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf82601f10)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:48:58.007445, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:58.007839, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200238] >[2025/04/09 07:48:58.007890, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:03:58 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:48:58.007999, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200238] >[2025/04/09 07:48:58.008031, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:03:58 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:48:58.008198, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) > set_domain_online: called for domain ADPROTOCOLX >[2025/04/09 07:48:58.008271, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:48:58.008730, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) > messaging_dgm_send: Sending message to 2398430 >[2025/04/09 07:48:58.008796, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403284309 seconds ahead) >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:48:58.009391, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=14, vnn=4026531841, opcode=18, srvid=0 >[2025/04/09 07:48:58.009773, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=15, vnn=4026531841, opcode=4, srvid=0 >[2025/04/09 07:48:58.009907, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=149, srvid=0 >[2025/04/09 07:48:58.010146, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) > db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b >[2025/04/09 07:48:58.010325, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > session_key : 6927d03bace8352078671274da7f767c > sequence : 0x67f65e44 (1744199236) > seed: struct netr_Credential > data : 5ae434c6f197d07b > client: struct netr_Credential > data : 7b2f5a59c67e107d > server: struct netr_Credential > data : 780a45edba62c4b2 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > ex : * > ex: struct netlogon_creds_CredentialState_extra_info > magic : 0x00000601 (1537) > reserved : 0x00000000 (0) > client_requested_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > auth_time : Wed Apr 9 07:47:15 AM 2025 EDT > client_sid : S-1-0-1108 >[2025/04/09 07:48:58.011026, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:48:58.011060, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:48:58.011095, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:48:58.011171, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:48:58.011203, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:48:58.011233, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:48:58.011254, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:48:58.011383, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:58.013462, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > session_key : 6927d03bace8352078671274da7f767c > sequence : 0x67f65e44 (1744199236) > seed: struct netr_Credential > data : 5ae434c6f197d07b > client: struct netr_Credential > data : 7b2f5a59c67e107d > server: struct netr_Credential > data : 780a45edba62c4b2 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > ex : * > ex: struct netlogon_creds_CredentialState_extra_info > magic : 0x00000601 (1537) > reserved : 0x00000000 (0) > client_requested_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > auth_time : Wed Apr 9 07:47:15 AM 2025 EDT > client_sid : S-1-0-1108 >[2025/04/09 07:48:58.014259, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 07:48:58.014311, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 07:48:58.014351, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 07:48:58.014429, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55cf82598840]: subreq: 0x55cf825a79f0 >[2025/04/09 07:48:58.014474, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55cf82598840]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825a79f0/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] >[2025/04/09 07:48:58.014515, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 07:48:58.014706, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x00000029 (41) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 07:48:58.015195, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:48:58.015304, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:58.016067, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 72 >[2025/04/09 07:48:58.016192, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0058 (88) > auth_length : 0x000c (12) > call_id : 0x00000029 (41) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b51 (2897) > secondary_address_size : 0x000c (12) > secondary_address : '\pipe\lsass' > _pad1 : DATA_BLOB length=2 > [0000] D0 11 .. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 07:48:58.016620, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 88 at offset 0: NT_STATUS_OK >[2025/04/09 07:48:58.016649, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 88 bytes. >[2025/04/09 07:48:58.016678, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:48:58.016706, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:48:58.016743, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55cf82598840]: subreq: 0x55cf825a79f0 >[2025/04/09 07:48:58.016777, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55cf82598840]: NT_STATUS_OK tevent_req[0x55cf825a79f0/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] >[2025/04/09 07:48:58.016829, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:48:58.016858, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:48:58.016891, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:48:58.016931, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 07:48:58.016973, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=17, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 07:48:58.017020, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:48:58.017052, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:48:58.017072, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:48:58.017091, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:48:58.017156, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > in: struct netr_GetAnyDCName > logon_server : * > logon_server : 'windc2.adprotocolx.com' > domainname : * > domainname : 'adprotocolx' >[2025/04/09 07:48:58.017254, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:48:58.017571, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000002a (42) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x000000a4 (164) > context_id : 0x0000 (0) > opnum : 0x000d (13) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:48:58.017811, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:48:58.017919, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:48:58.017976, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:59.230414, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:59.231434, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) > cli_api_pipe failed: NT_STATUS_IO_TIMEOUT >[2025/04/09 07:48:59.231537, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 10000 (ms) to 1000 (ms). >[2025/04/09 07:48:59.231613, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 1000 (ms) to 500 (ms). >[2025/04/09 07:48:59.231678, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:48:59.231869, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1956(connection_ok) > connection_ok: Connection to windc2.adprotocolx.com for domain ADPROTOCOLX is not connected >[2025/04/09 07:48:59.231909, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1770(cm_open_connection) > Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. >[2025/04/09 07:48:59.231990, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) > Attempt 0/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 07:48:59.232020, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 07:48:59.232132, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX" domain >[2025/04/09 07:48:59.232198, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result -1073741420 for domain ADPROTOCOLX server windc2.adprotocolx.com >[2025/04/09 07:48:59.232247, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result -1073741420 for domain ADPROTOCOLX server windc2.adprotocolx.com >[2025/04/09 07:48:59.232292, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1549(find_dc) > Retrieving a list of IP addresses for DCs. >[2025/04/09 07:48:59.232358, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:48:59.232393, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) > ads_dc_name: domain=ADPROTOCOLX >[2025/04/09 07:48:59.232433, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:48:59.232461, 6, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) > resolve_and_ping_dns: (cldap) looking for realm 'ADPROTOCOLX.COM' >[2025/04/09 07:48:59.232491, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) >[2025/04/09 07:48:59.232537, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain >[2025/04/09 07:48:59.232577, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc2.adprotocolx.com, *" >[2025/04/09 07:48:59.232616, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) >[2025/04/09 07:48:59.232663, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:48:59.232705, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:48:59.232733, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:48:59.232776, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:48:59.232804, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:48:59.232844, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:48:59.232875, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:48:59.232910, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:48:59.232965, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:48:59.233002, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:48:59.233034, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:48:59.233064, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:48:59.233090, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:48:59.233119, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:48:59.233145, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:48:59.233172, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:48:59.233194, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:48:59.233228, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:48:59.233271, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:48:59.233304, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:48:59.233337, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:48:59.233369, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:48:59.233403, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:48:59.233440, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) > cldap_ping_list: Try to create 6 netlogon connections for domain 'ADPROTOCOLX.COM' (provided count of addresses was 6). >[2025/04/09 07:48:59.234531, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:48:59.235598, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:48:59.235636, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477460 seconds ahead) >[2025/04/09 07:48:59.235691, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:48:59.235720, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477460 seconds ahead) >[2025/04/09 07:48:59.235770, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) > cldap_ping_list: realm[ADPROTOCOLX.COM]: selected 10.28.1.93 => windc2.adprotocolx.com >[2025/04/09 07:48:59.235799, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) > cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:48:59.236790, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:48:59.236855, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:48:59.236902, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:48:59.237000, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:48:59.237044, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain >[2025/04/09 07:48:59.237084, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc2.adprotocolx.com, *" >[2025/04/09 07:48:59.237115, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:48:59.237143, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:48:59.237198, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:48:59.237306, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:48:59.237351, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:48:59.237421, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 2C 25 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ,%...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:49:00.238660, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:49:00.238791, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:49:00.238822, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:49:00.238969, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 46 00 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 F....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:49:00.239120, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:49:00.239712, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 46 00 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 F....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... > [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. > [0120] D7 81 C8 0F 00 ..... >[2025/04/09 07:49:00.240237, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:49:00.240278, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:49:00.240313, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:00.240335, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:49:00.240355, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:49:00.240379, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:00.240403, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:00.240462, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:49:00.240519, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:49:00.240555, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:49:00.240584, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:49:00.240613, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:00.240647, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:00.240679, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:49:00.240709, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:49:00.240739, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:00.240775, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:00.240810, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:49:00.240837, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:00.240863, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:00.240890, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:49:00.240911, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 10.28.1.92 192.168.122.133 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:00.240949, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:49:00.241004, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain >[2025/04/09 07:49:00.241039, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc2.adprotocolx.com, *" >[2025/04/09 07:49:00.241073, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:49:00.241106, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:49:00.241132, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:49:00.241206, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:49:00.241240, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:49:00.241308, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] D7 0C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:49:01.242507, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:49:01.242596, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:49:01.242625, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:49:01.242734, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 07 62 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .b...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:49:01.242847, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:49:01.243289, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 07 62 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .b...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej > [0100] 03 48 28 E1 00 D1 .H(... >[2025/04/09 07:49:01.243687, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:49:01.243729, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:49:01.243763, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:01.243790, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:49:01.243815, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:49:01.243841, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:01.243881, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:01.243997, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:49:01.244057, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:49:01.244092, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:49:01.244155, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:49:01.244190, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:01.244235, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:01.244268, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:01.244297, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:49:01.244327, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:01.244357, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:49:01.244386, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:49:01.244416, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:01.244441, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:01.244473, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:49:01.244498, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:01.244528, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:49:01.244555, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:49:01.446017, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:49:04.246181, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:49:04.246448, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:49:04.246513, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) > ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 >[2025/04/09 07:49:04.246564, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:49:04.246602, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) >[2025/04/09 07:49:04.246642, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain >[2025/04/09 07:49:04.246675, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc2.adprotocolx.com, *" >[2025/04/09 07:49:04.246704, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) >[2025/04/09 07:49:04.246732, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:49:04.246774, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:04.246810, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:49:04.246850, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:49:04.246878, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:49:04.246909, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:49:04.246939, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:04.246998, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:04.247053, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:04.247081, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:49:04.247122, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:04.247147, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:49:04.247180, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:49:04.247206, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:04.247228, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:04.247253, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:49:04.247275, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:04.247308, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:49:04.247338, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:49:04.247365, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:49:04.247395, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:49:04.247432, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:04.247465, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:04.247488, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename NULL) >[2025/04/09 07:49:04.247515, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain >[2025/04/09 07:49:04.247542, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc2.adprotocolx.com, *" >[2025/04/09 07:49:04.247568, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename (null)) >[2025/04/09 07:49:04.247597, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:49:04.247629, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:04.247655, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:49:04.247687, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:49:04.247714, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:49:04.247743, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:49:04.247771, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:04.247798, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:04.247827, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:04.247856, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:49:04.247881, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:04.247905, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:49:04.247937, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:49:04.247986, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:04.248035, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:04.248059, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:49:04.248093, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:04.248122, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:49:04.248151, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:49:04.248177, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:49:04.248201, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:49:04.248225, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:04.248250, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:04.248272, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1553(find_dc) > Retrieved IP addresses for 6 DCs. >[2025/04/09 07:49:04.248302, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1574(find_dc) > Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). >[2025/04/09 07:49:04.248384, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 445 >[2025/04/09 07:49:04.248908, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1589(find_dc) > Successfully connected to DC '10.28.1.93'. >[2025/04/09 07:49:04.248986, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. >[2025/04/09 07:49:04.249039, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.93'. >[2025/04/09 07:49:04.249068, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) >[2025/04/09 07:49:04.249790, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:49:04.250630, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:49:04.250666, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477455 seconds ahead) >[2025/04/09 07:49:04.250733, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:49:04.250771, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477455 seconds ahead) >[2025/04/09 07:49:04.250831, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:49:04.250863, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 >[2025/04/09 07:49:04.250899, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 08:00:04 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 07:49:04.250945, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f1fc >[2025/04/09 07:49:04.251023, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:49:04.251055, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:49:04.251107, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:49:04.251143, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) > saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain >[2025/04/09 07:49:04.251172, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: "windc2.adprotocolx.com, *" >[2025/04/09 07:49:04.251199, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:49:04.251225, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:49:04.251259, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:49:04.251334, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:49:04.251368, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:49:04.251435, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 72 46 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 rF...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:49:05.013656, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) >[2025/04/09 07:49:05.013783, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) > tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb >[2025/04/09 07:49:05.014114, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) > Could not get the lock for windc2.adprotocolx.com >[2025/04/09 07:49:05.014301, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) > cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com >[2025/04/09 07:49:05.014368, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK >[2025/04/09 07:49:05.252669, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:49:05.252754, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:49:05.252785, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:49:05.253342, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] D1 BA 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:49:05.253490, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:49:05.254000, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] D1 BA 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 07:49:05.254490, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:49:05.254530, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:49:05.254555, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:05.254577, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:49:05.254597, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:49:05.254621, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:05.254665, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:05.254724, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:49:05.254781, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:49:05.254813, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) >[2025/04/09 07:49:05.254843, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name windc2.adprotocolx.com#20 found. >[2025/04/09 07:49:05.254871, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:05.254906, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:05.254938, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:05.254993, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:49:05.255033, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:05.255065, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:49:05.255094, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:49:05.255124, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:05.255149, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:05.255177, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:49:05.255201, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:05.255229, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:49:05.255259, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:49:05.255302, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:49:05.255329, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:49:05.255356, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:49:05.255382, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:49:05.255443, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:49:05.255476, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:49:05.255546, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] D4 7E 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .~...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:49:06.256722, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:49:06.256873, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:49:06.256906, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:49:06.257122, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] D0 5F 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ._...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:49:06.257260, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:49:06.257604, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] D0 5F 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ._...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s > [0100] D0 D7 81 C8 0F 00 ...... >[2025/04/09 07:49:06.258103, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:49:06.258152, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:49:06.258177, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:06.258206, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:49:06.258229, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:49:06.258251, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:06.258280, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:06.258345, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:49:06.258395, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:49:06.258431, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:49:06.258460, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:49:06.258491, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:49:06.258519, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:49:06.258546, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:06.258574, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:49:06.258600, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:49:06.258625, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:49:06.258654, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:49:06.258688, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:49:06.360083, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:49:09.212714, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:09.212837, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000002a (42) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000008 (8) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 25 7E 56 F9 4E 43 BC 42 ED FE 45 2A AE B5 EA C9 %~V.NC.B ..E*.... > [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 0C 4A 48 8A 3C EF A1 00 0B DC 7B 3A A9 6B B4 DB .JH.<... ..{:.k.. > [0030] 71 3F DD 1C 53 0A F4 94 B5 5E 4C 6E 14 B7 01 08 q?..S... .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:49:09.213211, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:09.213237, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:49:09.213255, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:09.213319, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 8 >[2025/04/09 07:49:09.213343, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:09.213364, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. >[2025/04/09 07:49:09.213403, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > out: struct netr_GetAnyDCName > dcname : * > dcname : NULL > result : WERR_NO_LOGON_SERVERS >[2025/04/09 07:49:09.213544, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) > dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS >[2025/04/09 07:49:09.213604, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:09.213721, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:09.213752, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4016 bytes to parent >[2025/04/09 07:49:09.214210, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:09.214244, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:49:09.214322, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:09.214416, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:49:09.214494, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000002b (43) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:09.214671, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:09.214745, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:09.214781, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:09.215616, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:09.215665, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000002b (43) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 8E 5B B2 50 4C 55 44 8A 5C 0A A1 9D F0 D7 E9 9E .[.PLUD. \....... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 93 BE 73 00 03 A9 88 F6 B0 26 FE 31 93 C5 8A 9A ..s..... .&.1.... > [0030] B0 5B 25 8D CE 2D DE E9 B5 5E 4C 6E 14 B7 01 08 .[%..-.. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:49:09.215917, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:09.215939, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:49:09.215957, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:09.216013, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:49:09.216036, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:09.216065, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:49:09.216111, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:49:09.216213, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:49:09.216235, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:09.216312, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:09.216333, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:49:09.259276, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:49:09.259500, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:49:09.259573, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200249] >[2025/04/09 07:49:09.259611, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:04:09 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:49:09.259662, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200249] >[2025/04/09 07:49:09.259683, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:04:09 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:49:09.259713, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' >[2025/04/09 07:49:09.259750, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 07:49:25.809415, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:25.809533, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:49:25.809671, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:25.809813, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:49:25.809918, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000002c (44) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:25.810163, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:25.810275, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:25.810338, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:25.811157, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:25.811208, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000002c (44) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] F9 20 92 CB 09 3F 9F 96 0F 62 70 3A 28 C5 32 51 . ...?.. .bp:(.2Q > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 9D DC B6 71 F9 5C 35 11 12 D4 D7 2B 2B AF 26 38 ...q.\5. ...++.&8 > [0030] 8B B9 2F 77 80 A5 3F 7C 0F B0 74 F7 7A 72 80 3C ../w..?| ..t.zr.< > [0040] 12 37 E8 D2 99 AE 2D D5 E1 D1 67 1A 97 3F 47 D1 .7....-. ..g..?G. >[2025/04/09 07:49:25.811507, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:25.811534, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:49:25.811554, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:25.811588, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:49:25.811612, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:25.811642, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:49:25.811680, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:49:25.811763, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:49:25.811787, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:25.811855, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:25.811877, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:49:26.958365, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:26.958419, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:49:26.958492, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:26.958558, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:49:26.958641, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000002d (45) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:26.958848, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:26.958951, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:26.959032, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:26.959754, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:26.959797, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000002d (45) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 72 8E 64 86 88 0E 1D C3 64 B7 4C 99 2B CE E9 E0 r.d..... d.L.+... > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 5C E4 7B C8 83 62 97 E8 77 2B C3 3A E9 1D E8 3C \.{..b.. w+.:...< > [0030] 88 CC B0 79 F9 E7 CE 03 A2 99 45 44 4A 78 AD 66 ...y.... ..EDJx.f > [0040] 5F 5E D5 0A A4 AB 98 3D 73 E3 ED 9D F4 76 49 39 _^.....= s....vI9 >[2025/04/09 07:49:26.960092, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:26.960117, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:49:26.960138, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:26.960172, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:49:26.960195, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:26.960221, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:49:26.960256, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:49:26.960354, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:49:26.960400, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:26.960464, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:26.960485, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:49:31.620900, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:31.621058, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:49:31.621227, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:31.621391, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:49:31.621536, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000002e (46) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:31.621741, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:31.621862, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:31.622008, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:31.625273, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:31.625339, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000002e (46) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 0F 65 3F 51 95 4A 69 9D 85 32 D8 D9 70 F6 9C 22 .e?Q.Ji. .2..p.." > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 28 EC E6 86 C5 DE 9A CA 55 83 42 F5 1D F1 4E 1A (....... U.B...N. > [0030] 3C 8C 69 60 B8 96 D4 6E A2 99 45 44 4A 78 AD 66 <.i`...n ..EDJx.f > [0040] 5F 5E D5 0A A4 AB 98 3D 73 E3 ED 9D F4 76 49 39 _^.....= s....vI9 >[2025/04/09 07:49:31.625615, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:31.625640, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:49:31.625660, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:31.625697, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:49:31.625719, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:31.625746, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:49:31.625776, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:49:31.625855, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:49:31.625878, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:31.625944, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:31.626014, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:49:34.868860, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 36 extra bytes >[2025/04/09 07:49:34.868993, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:34.869048, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') >[2025/04/09 07:49:34.869216, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:49:34.869385, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > in: struct netr_GetAnyDCName > logon_server : * > logon_server : 'windc2.adprotocolx.com' > domainname : * > domainname : 'adprotocolx' >[2025/04/09 07:49:34.869481, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000002f (47) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000068 (104) > context_id : 0x0000 (0) > opnum : 0x000d (13) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:34.869740, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:34.869859, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:34.869925, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:34.870781, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:34.870837, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000002f (47) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000008 (8) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] E5 D6 DA C6 00 8F 17 32 E8 A0 89 30 03 17 22 2D .......2 ...0.."- > [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 33 C6 07 BF EE F9 95 FC CD 77 1A FC 83 8A 84 9A 3....... .w...... > [0030] 2B F9 1B 12 A0 B7 48 00 A2 99 45 44 4A 78 AD 66 +.....H. ..EDJx.f > [0040] 5F 5E D5 0A A4 AB 98 3D 73 E3 ED 9D F4 76 49 39 _^.....= s....vI9 >[2025/04/09 07:49:34.871168, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:34.871195, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:49:34.871222, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:34.871269, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 8 >[2025/04/09 07:49:34.871292, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:34.871320, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. >[2025/04/09 07:49:34.871346, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > out: struct netr_GetAnyDCName > dcname : * > dcname : NULL > result : WERR_NO_LOGON_SERVERS >[2025/04/09 07:49:34.871406, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) > dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS >[2025/04/09 07:49:34.871430, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:34.871482, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:34.871506, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4016 bytes to parent >[2025/04/09 07:49:36.921726, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) >[2025/04/09 07:49:36.921853, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) > tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb >[2025/04/09 07:49:36.922032, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) > Could not get the lock for windc2.adprotocolx.com >[2025/04/09 07:49:36.922146, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) > cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com >[2025/04/09 07:49:36.922207, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK >[2025/04/09 07:49:40.067782, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:40.067847, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:49:40.067991, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:40.068093, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:49:40.068212, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000030 (48) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:40.068420, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:40.068521, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:40.068583, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:40.071116, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:40.071177, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000030 (48) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] A2 FE A9 11 A7 A1 6A 8B EE 7F BA AE 90 C5 6D BD ......j. ......m. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 15 A4 BE DA 66 4E 73 AB 7E 9A 76 86 4C 59 27 79 ....fNs. ~.v.LY'y > [0030] 8A 45 74 03 A1 F2 BE B6 68 E3 73 95 71 01 00 00 .Et..... h.s.q... > [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ >[2025/04/09 07:49:40.071482, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:40.071517, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:49:40.071537, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:40.071577, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:49:40.071616, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:40.071639, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:49:40.071673, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:49:40.071767, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:49:40.071797, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:40.071877, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:40.071898, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:49:41.016643, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). >[2025/04/09 07:49:41.016930, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1019(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:49:41.018331, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:861(cm_prepare_connection) > connecting to windc2.adprotocolx.com (ADPROTOCOLX, ADPROTOCOLX.COM) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] >[2025/04/09 07:49:41.018471, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com >[2025/04/09 07:49:41.018684, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] >[2025/04/09 07:49:41.018758, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199381.018678: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:49:41.019690, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199381.018680: Sending unauthenticated request >[2025/04/09 07:49:41.019745, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199381.018681: Sending request (182 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:49:41.019943, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199381.018682: Resolving hostname 10.28.1.92 >[2025/04/09 07:49:41.020128, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199381.018683: Sending initial UDP request to dgram 10.28.1.92:88 >[2025/04/09 07:49:42.021320, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199382.021304: Resolving hostname 10.28.1.93 >[2025/04/09 07:49:42.021553, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199382.021305: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 07:49:42.023044, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199382.021306: Received answer (219 bytes) from dgram 10.28.1.93:88 >[2025/04/09 07:49:42.023248, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199382.021307: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:49:44.083904, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199384.083876: No URI records found >[2025/04/09 07:49:44.084147, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199384.083877: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. >[2025/04/09 07:49:46.622301, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:46.622373, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:49:46.622488, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:46.622623, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:49:46.622787, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000031 (49) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:46.623062, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:46.623244, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:46.623344, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:46.624503, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:46.624567, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000031 (49) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 6E 74 71 B5 B2 AD 69 E9 ED 9E 79 B1 55 4E 35 83 ntq...i. ..y.UN5. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 9E FE DE AB D5 DF 6C 7C 81 C0 1B 3F 8C 9D AF 77 ......l| ...?...w > [0030] 21 34 E6 41 AD 69 F2 26 68 E3 73 95 71 01 00 00 !4.A.i.& h.s.q... > [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ >[2025/04/09 07:49:46.624899, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:46.624926, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:49:46.624948, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:46.625007, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:49:46.625033, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:46.625061, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:49:46.625097, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:49:46.625206, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:49:46.625243, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:46.625327, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:46.625351, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:49:47.156404, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199387.156386: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:49:47.156539, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 36 extra bytes >[2025/04/09 07:49:47.156583, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:47.156614, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') >[2025/04/09 07:49:47.156704, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:49:47.156820, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > in: struct netr_GetAnyDCName > logon_server : * > logon_server : 'windc2.adprotocolx.com' > domainname : * > domainname : 'adprotocolx' >[2025/04/09 07:49:47.156944, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000032 (50) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000068 (104) > context_id : 0x0000 (0) > opnum : 0x000d (13) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:47.157311, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:47.157482, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:47.157560, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:47.158403, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:47.158472, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000032 (50) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000008 (8) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 29 31 03 61 7E D8 36 EC 2B FE 5E 36 C8 05 40 00 )1.a~.6. +.^6..@. > [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 49 77 BB 1B 45 2E 0F 0F 68 52 47 EE 36 20 05 13 Iw..E... hRG.6 .. > [0030] 47 78 AE C9 E1 B1 25 07 00 00 00 00 1B 00 00 00 Gx....%. ........ > [0040] E0 37 F7 30 FD 7F 00 00 F0 37 F7 30 FD 7F 00 00 .7.0.... .7.0.... >[2025/04/09 07:49:47.158891, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:47.158930, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:49:47.158973, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:47.159022, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 8 >[2025/04/09 07:49:47.159052, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:47.159080, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. >[2025/04/09 07:49:47.159119, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > out: struct netr_GetAnyDCName > dcname : * > dcname : NULL > result : WERR_NO_LOGON_SERVERS >[2025/04/09 07:49:47.159220, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) > dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS >[2025/04/09 07:49:47.159260, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:49:47.159365, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:47.159406, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4016 bytes to parent >[2025/04/09 07:49:50.228003, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.227989: No SRV records found >[2025/04/09 07:49:50.228110, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.227990: Response was not from master KDC >[2025/04/09 07:49:50.228214, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.227991: Received error from KDC: -1765328359/Additional pre-authentication required >[2025/04/09 07:49:50.228421, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.227994: Preauthenticating using KDC method data >[2025/04/09 07:49:50.228459, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.227995: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) >[2025/04/09 07:49:50.228508, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.227996: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:49:50.232365, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.227997: AS key obtained for encrypted timestamp: aes256-cts/C8D8 >[2025/04/09 07:49:50.232491, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.227999: Encrypted timestamp (for 1744210180.673053): plain 301AA011180F32303235303430393134343934305AA10502030A451D, encrypted 27859E4451840F04F86F230028777B6102B01224A209DFFF94027EC29B6E4218F55D3ECD43A13B67FFD44CBE6206058A530C743F42F7B89E >[2025/04/09 07:49:50.232538, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.228000: Preauth module encrypted_timestamp (2) (real) returned: 0/Success >[2025/04/09 07:49:50.232564, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.228001: Produced preauth for next request: PA-ENC-TIMESTAMP (2) >[2025/04/09 07:49:50.232617, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.228002: Sending request (261 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:49:50.232715, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.228003: Resolving hostname 10.28.1.93 >[2025/04/09 07:49:50.232883, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.228004: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 07:49:50.234839, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.228005: Received answer (102 bytes) from dgram 10.28.1.93:88 >[2025/04/09 07:49:50.234933, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199390.228006: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:49:52.345678, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:52.345733, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:49:52.345813, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:49:52.345903, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:49:52.346077, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000033 (51) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:52.346321, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:52.346519, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:52.346619, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:49:52.347456, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:49:52.347526, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000033 (51) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 20 24 0F 8E ED D0 2D CF EB 25 35 12 05 81 6E C5 $....-. .%5...n. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] BC D6 98 3E F9 A7 D8 D7 D1 39 E8 35 C1 E9 04 0C ...>.... .9.5.... > [0030] 24 C8 B4 FB 07 62 42 4F 00 00 00 00 1B 00 00 00 $....bBO ........ > [0040] E0 37 F7 30 FD 7F 00 00 F0 37 F7 30 FD 7F 00 00 .7.0.... .7.0.... >[2025/04/09 07:49:52.347929, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:49:52.348005, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:49:52.348044, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:49:52.348084, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:49:52.348118, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:49:52.348141, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:49:52.348182, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:49:52.348278, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:49:52.348315, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:49:52.348395, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:49:52.348424, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:49:53.299946, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199393.299915: No URI records found >[2025/04/09 07:49:53.300157, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199393.299916: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. >[2025/04/09 07:49:55.030412, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) >[2025/04/09 07:49:55.030515, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) > tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb >[2025/04/09 07:49:55.031198, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) > Could not get the lock for windc2.adprotocolx.com >[2025/04/09 07:49:55.031351, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) > cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com >[2025/04/09 07:49:55.031410, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK >[2025/04/09 07:49:56.371846, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199396.371815: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:49:59.443735, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199399.443726: No SRV records found >[2025/04/09 07:49:59.443848, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199399.443727: Response was not from master KDC >[2025/04/09 07:49:59.444005, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199399.443728: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP >[2025/04/09 07:49:59.444079, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199399.443729: Request or response is too big for UDP; retrying with TCP >[2025/04/09 07:49:59.444124, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199399.443730: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) >[2025/04/09 07:49:59.444536, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 36 extra bytes >[2025/04/09 07:49:59.444578, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199399.443731: Resolving hostname 10.28.1.92 >[2025/04/09 07:49:59.444592, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:49:59.444627, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') >[2025/04/09 07:49:59.444719, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199399.443732: Initiating TCP connection to stream 10.28.1.92:88 >[2025/04/09 07:49:59.444725, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:49:59.444870, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > in: struct netr_GetAnyDCName > logon_server : * > logon_server : 'windc2.adprotocolx.com' > domainname : * > domainname : 'adprotocolx' >[2025/04/09 07:49:59.445023, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000034 (52) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000068 (104) > context_id : 0x0000 (0) > opnum : 0x000d (13) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:49:59.445347, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:49:59.445473, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:49:59.445537, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:50:00.445908, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199400.445895: Resolving hostname 10.28.1.93 >[2025/04/09 07:50:00.446189, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199400.445896: Initiating TCP connection to stream 10.28.1.93:88 >[2025/04/09 07:50:00.446772, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199400.445897: Sending TCP request to stream 10.28.1.93:88 >[2025/04/09 07:50:00.448925, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199400.445898: Received answer (1596 bytes) from stream 10.28.1.93:88 >[2025/04/09 07:50:00.449003, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199400.445899: Terminating TCP connection to stream 10.28.1.92:88 >[2025/04/09 07:50:00.449068, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199400.445900: Terminating TCP connection to stream 10.28.1.93:88 >[2025/04/09 07:50:00.449279, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199400.445901: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:50:02.516082, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199402.516062: No URI records found >[2025/04/09 07:50:02.516306, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199402.516063: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:50:05.591310, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591296: No SRV records found >[2025/04/09 07:50:05.591397, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591297: Response was not from master KDC >[2025/04/09 07:50:05.591544, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591298: Processing preauth types: PA-ETYPE-INFO2 (19) >[2025/04/09 07:50:05.591586, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591299: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:50:05.591627, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591300: Produced preauth for next request: (empty) >[2025/04/09 07:50:05.591669, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591301: AS key determined by preauth: aes256-cts/C8D8 >[2025/04/09 07:50:05.591782, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591302: Decrypted AS reply; session key is: aes256-cts/A62B >[2025/04/09 07:50:05.591827, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591303: FAST negotiation: unavailable >[2025/04/09 07:50:05.591938, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:50:05.592018, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591304: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:50:05.592084, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199405.591305: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect >[2025/04/09 07:50:05.592176, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos >[2025/04/09 07:50:05.592232, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) > cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO >[2025/04/09 07:50:05.592520, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 07:50:05.592635, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 07:50:14.464512, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:50:14.464693, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000034 (52) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000008 (8) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] E6 62 2C 66 81 11 3B 5C C0 49 21 9E 16 22 B4 2D .b,f..;\ .I!..".- > [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 01 07 61 71 CB F2 ED 4A DC 09 B2 F2 11 5C E7 69 ..aq...J .....\.i > [0030] A1 B0 2A 97 41 DE F9 96 68 E3 73 95 71 01 00 00 ..*.A... h.s.q... > [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ >[2025/04/09 07:50:14.465146, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:50:14.465183, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:50:14.465208, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:50:14.465282, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 8 >[2025/04/09 07:50:14.465316, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:50:14.465366, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. >[2025/04/09 07:50:14.465408, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > out: struct netr_GetAnyDCName > dcname : * > dcname : NULL > result : WERR_NO_LOGON_SERVERS >[2025/04/09 07:50:14.465514, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) > dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS >[2025/04/09 07:50:14.465550, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:14.465673, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:50:14.465714, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4016 bytes to parent >[2025/04/09 07:50:16.634138, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:50:16.634187, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:50:16.634269, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:16.634386, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:50:16.634487, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000035 (53) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:50:16.634732, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:50:16.634846, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:50:16.634906, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:50:16.638421, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:50:16.638478, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000035 (53) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 5A DA 4A AA 39 BE DB 40 FA 02 88 63 39 C2 03 72 Z.J.9..@ ...c9..r > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 40 10 A2 7C 50 07 E2 76 0C C8 2A F3 E0 F8 73 CB @..|P..v ..*...s. > [0030] 83 C5 48 28 A6 03 0A C5 68 E3 73 95 71 01 00 00 ..H(.... h.s.q... > [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ >[2025/04/09 07:50:16.638776, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:50:16.638803, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:50:16.638824, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:50:16.638858, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:50:16.638883, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:50:16.638909, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:50:16.638940, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:50:16.639044, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:50:16.639071, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:16.639147, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:50:16.639169, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:50:19.654980, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:50:19.655081, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:50:19.655229, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:19.655341, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:50:19.655463, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000036 (54) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:50:19.655819, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:50:19.656000, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:50:19.656080, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:50:19.657031, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:50:19.657093, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000036 (54) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] DE B2 81 30 BD 5F 77 33 F3 B0 27 31 BF 69 23 4E ...0._w3 ..'1.i#N > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 35 51 50 17 07 48 B2 82 B9 DD 3C 86 39 DC C3 A0 5QP..H.. ..<.9... > [0030] 5F 8D 2D 0B C1 D4 D8 7F 68 E3 73 95 71 01 00 00 _.-..... h.s.q... > [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ >[2025/04/09 07:50:19.657478, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:50:19.657508, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:50:19.657536, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:50:19.657573, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:50:19.657606, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:50:19.657642, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:50:19.657678, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:50:19.657771, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:50:19.657803, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:19.657890, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:50:19.657919, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:50:24.020253, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf8259a830]: subreq: 0x55cf825c8930 >[2025/04/09 07:50:24.020368, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf8258ccd0]: subreq: 0x55cf82605e00 >[2025/04/09 07:50:24.020420, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf8259a830]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8930/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825c8b10)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] >[2025/04/09 07:50:24.020529, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf8258ccd0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf82605e00/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf82605fe0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:50:24.020934, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1719(cli_session_setup_creds_done_spnego) > SPNEGO login failed: The transport connection has been reset. >[2025/04/09 07:50:24.021049, 1, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:877(cm_prepare_connection) > authenticated session setup to windc2.adprotocolx.com using GPFSNMBASH$@ADPROTOCOLX.COM failed with NT_STATUS_CONNECTION_RESET >[2025/04/09 07:50:24.021182, 1, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_CONNECTION_RESET >[2025/04/09 07:50:24.021240, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:51:24 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 07:50:24.021318, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX (windc2.adprotocolx.com) to failed conn cache >[2025/04/09 07:50:24.021374, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) >[2025/04/09 07:50:24.021410, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) >[2025/04/09 07:50:24.021402, 1] ../../source3/winbindd/winbindd_cm.c:776(cm_prepare_connection) > Could not cli_initialize >[2025/04/09 07:50:24.021440, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) > saf_delete: domain = [ADPROTOCOLX] >[2025/04/09 07:50:24.021465, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:51:24 AM 2025 EDT] (60 seconds ahead) >[2025/04/09 07:50:24.021477, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_NO_MEMORY >[2025/04/09 07:50:24.021505, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) > add_failed_connection_entry: added domain ADPROTOCOLX.COM (windc2.adprotocolx.com) to failed conn cache >[2025/04/09 07:50:24.021530, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 07:50:24.021553, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) > Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) >[2025/04/09 07:50:24.021589, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) > Attempt 1/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. >[2025/04/09 07:50:24.021614, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) > First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. >[2025/04/09 07:50:24.021645, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX" domain >[2025/04/09 07:50:24.021675, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result -1073741801 for domain ADPROTOCOLX server windc2.adprotocolx.com >[2025/04/09 07:50:24.021698, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1549(find_dc) > Retrieving a list of IP addresses for DCs. >[2025/04/09 07:50:24.021758, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:50:24.021794, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) > ads_dc_name: domain=ADPROTOCOLX >[2025/04/09 07:50:24.021827, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:50:24.021850, 6, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) > resolve_and_ping_dns: (cldap) looking for realm 'ADPROTOCOLX.COM' >[2025/04/09 07:50:24.021877, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) >[2025/04/09 07:50:24.021917, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:50:24.021942, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:50:24.021989, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) >[2025/04/09 07:50:24.022020, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:50:24.022061, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:24.022091, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:50:24.022120, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:50:24.022146, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:50:24.022172, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:24.022196, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:50:24.022220, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:50:24.022244, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:24.022265, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:24.022289, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:50:24.022315, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:24.022373, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:50:24.022453, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:50:24.022484, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:50:24.022520, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:50:24.022557, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:24.022587, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:24.022623, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) > cldap_ping_list: Try to create 6 netlogon connections for domain 'ADPROTOCOLX.COM' (provided count of addresses was 6). >[2025/04/09 07:50:24.023459, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:50:24.025980, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:50:24.026044, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477375 seconds ahead) >[2025/04/09 07:50:24.026136, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:50:24.026173, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477375 seconds ahead) >[2025/04/09 07:50:24.026216, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) > cldap_ping_list: realm[ADPROTOCOLX.COM]: selected 10.28.1.93 => windc2.adprotocolx.com >[2025/04/09 07:50:24.026245, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) > cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:50:24.027309, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:50:24.027372, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:50:24.027403, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:50:24.027466, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:50:24.027508, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:50:24.027541, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:50:24.027566, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:50:24.027595, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:50:24.027632, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:50:24.027714, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:50:24.027751, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:50:24.027819, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] F0 D6 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:50:25.029133, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:50:25.029227, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:50:25.029257, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:50:25.029386, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] A6 D5 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:50:25.029530, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:50:25.030020, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] A6 D5 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 07:50:25.030486, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:50:25.030529, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:50:25.030556, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:25.030585, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:50:25.030623, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:50:25.030650, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:25.030679, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:25.030754, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:50:25.030797, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:50:25.030844, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:50:25.030870, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:25.030901, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:50:25.030932, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:50:25.030989, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:25.031025, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:25.031054, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:50:25.031092, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:25.031124, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:50:25.031170, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:50:25.031201, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:50:25.031227, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:50:25.031258, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:50:25.031286, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:50:25.031380, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:50:25.031416, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:50:25.031489, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 59 C0 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 Y....... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:50:26.032693, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:50:26.032846, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:50:26.032881, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:50:26.033005, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] BB CE 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:50:26.033143, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:50:26.033467, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] BB CE 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej > [0100] 03 48 28 E1 00 D1 .H(... >[2025/04/09 07:50:26.033903, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:50:26.033944, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:50:26.034016, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:26.034042, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:50:26.034065, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:50:26.034088, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:26.034116, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:26.034179, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:50:26.034216, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:50:26.034247, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:50:26.034274, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:26.034306, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:50:26.034344, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:50:26.034389, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:26.034415, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:26.034444, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:50:26.034467, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:26.034498, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:50:26.034533, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:50:26.136044, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:50:27.092395, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) > Need to read 36 extra bytes >[2025/04/09 07:50:27.092490, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:50:27.092523, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') >[2025/04/09 07:50:27.092618, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > in: struct wbint_DsGetDcName > domain_name : * > domain_name : 'adprotocolx' > domain_guid : NULL > site_name : NULL > flags : 0x40000001 (1073741825) >[2025/04/09 07:50:27.092746, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > in: struct netr_GetAnyDCName > logon_server : * > logon_server : 'windc2.adprotocolx.com' > domainname : * > domainname : 'adprotocolx' >[2025/04/09 07:50:27.092849, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000037 (55) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x00000068 (104) > context_id : 0x0000 (0) > opnum : 0x000d (13) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:50:27.093126, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x08 (8) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:50:27.093240, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:50:27.093312, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:50:27.100566, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:50:27.100622, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000037 (55) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000008 (8) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] D1 D0 F3 B1 E2 A9 C8 58 51 D9 B3 2A CA 53 8F 3C .......X Q..*.S.< > [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] E8 D5 D3 71 43 A3 39 F1 35 BB 42 34 94 2A EF D0 ...qC.9. 5.B4.*.. > [0030] 92 2A 75 FE A0 9C 49 ED 68 E3 73 95 71 01 00 00 .*u...I. h.s.q... > [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ >[2025/04/09 07:50:27.100929, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:50:27.101000, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:50:27.101032, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:50:27.101088, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 8 >[2025/04/09 07:50:27.101125, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:50:27.101153, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. >[2025/04/09 07:50:27.101188, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > out: struct netr_GetAnyDCName > dcname : * > dcname : NULL > result : WERR_NO_LOGON_SERVERS >[2025/04/09 07:50:27.101276, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) > dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS >[2025/04/09 07:50:27.101317, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:50:27.101405, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:50:27.101430, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4016 bytes to parent >[2025/04/09 07:50:29.035671, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:50:29.035917, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:50:29.036009, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) > ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 >[2025/04/09 07:50:29.036045, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:50:29.036084, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) >[2025/04/09 07:50:29.036129, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:50:29.036176, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:50:29.036336, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) >[2025/04/09 07:50:29.036366, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:50:29.036429, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:29.036465, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:50:29.036497, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:50:29.036537, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:50:29.036571, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:29.036600, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:50:29.036627, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:50:29.036670, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:29.036697, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:29.036719, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:50:29.036742, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:29.036776, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:50:29.036805, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:50:29.036835, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:50:29.036872, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:50:29.036903, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:29.036934, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:29.036978, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) > get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename NULL) >[2025/04/09 07:50:29.037011, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:50:29.037042, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:50:29.037078, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename (null)) >[2025/04/09 07:50:29.037108, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) > namecache_fetch: name ADPROTOCOLX.COM#1C found. >[2025/04/09 07:50:29.037144, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:29.037189, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:50:29.037215, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:50:29.037242, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:50:29.037276, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:29.037306, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:50:29.037333, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:50:29.037361, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:29.037386, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:29.037433, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:50:29.037464, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:29.037508, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 >[2025/04/09 07:50:29.037537, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 >[2025/04/09 07:50:29.037566, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 >[2025/04/09 07:50:29.037594, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 >[2025/04/09 07:50:29.037622, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:29.037650, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:29.037676, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1553(find_dc) > Retrieved IP addresses for 6 DCs. >[2025/04/09 07:50:29.037703, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1574(find_dc) > Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). >[2025/04/09 07:50:29.037757, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) > Connecting to 10.28.1.93 at port 445 >[2025/04/09 07:50:29.038264, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1589(find_dc) > Successfully connected to DC '10.28.1.93'. >[2025/04/09 07:50:29.038351, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) > Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. >[2025/04/09 07:50:29.038402, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) > ads_connect: Resolving name of LDAP server '10.28.1.93'. >[2025/04/09 07:50:29.038445, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) > ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) >[2025/04/09 07:50:29.039065, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:50:29.040337, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:50:29.040376, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477370 seconds ahead) >[2025/04/09 07:50:29.040469, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) > sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] >[2025/04/09 07:50:29.040504, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477370 seconds ahead) >[2025/04/09 07:50:29.040559, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) > Successfully contacted LDAP server 10.28.1.93 >[2025/04/09 07:50:29.040592, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) > namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 >[2025/04/09 07:50:29.040624, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 08:01:29 AM 2025 EDT] (660 seconds ahead) >[2025/04/09 07:50:29.040664, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) > dcip_check_name_ads: CLDAP flags = 0x1f1fc >[2025/04/09 07:50:29.040692, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) > ads_closest_dc: NBT_SERVER_CLOSEST flag set >[2025/04/09 07:50:29.040722, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) > sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" >[2025/04/09 07:50:29.040770, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX >[2025/04/09 07:50:29.040803, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:50:29.040841, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:50:29.040871, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) >[2025/04/09 07:50:29.040908, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:50:29.040936, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:50:29.041055, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:50:29.041102, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:50:29.041170, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] C6 DB 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:50:30.042372, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:50:30.042483, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:50:30.042531, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:50:30.042636, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 7E 26 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ~&...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . >[2025/04/09 07:50:30.042795, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:50:30.043091, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 7E 26 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ~&...... ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa > [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N > [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m > [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX > [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... > [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind > [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c > [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... > [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp > [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. > [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. > [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. > [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... > [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ > [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... > [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ > [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. > [0120] 48 28 E1 00 D1 H(... >[2025/04/09 07:50:30.043582, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:50:30.043643, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:50:30.043669, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:30.043692, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:50:30.043717, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:50:30.043743, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:30.043767, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:30.043829, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:50:30.043864, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:50:30.043897, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:50:30.043925, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:30.043981, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:50:30.044020, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:50:30.044048, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:30.044071, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:30.044098, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:50:30.044120, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:30.044150, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search >[2025/04/09 07:50:30.044181, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) > saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain >[2025/04/09 07:50:30.044211, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) > get_dc_list: preferred server list: ", *" >[2025/04/09 07:50:30.044235, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) > internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) >[2025/04/09 07:50:30.044262, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) > resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS >[2025/04/09 07:50:30.044289, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) > resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM >[2025/04/09 07:50:30.044358, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 >[2025/04/09 07:50:30.044403, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:50:30.044487, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] 7F C0 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:50:31.045684, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) > dns_lookup_waited: waited >[2025/04/09 07:50:31.045755, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) > dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 >[2025/04/09 07:50:31.045786, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) > dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP >[2025/04/09 07:50:31.045865, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] EB F2 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. >[2025/04/09 07:50:31.045991, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) > dns_lookup_send_next: cancelling wait_subreq >[2025/04/09 07:50:31.046375, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) > [0000] EB F2 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke > [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ > [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL > [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. > [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win > [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. > [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. > [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad > [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L > [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L > [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L > [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... > [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... > [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... > [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... > [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej > [0100] 03 48 28 E1 00 D1 .H(... >[2025/04/09 07:50:31.046789, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 >[2025/04/09 07:50:31.046830, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 >[2025/04/09 07:50:31.046859, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:31.046881, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 >[2025/04/09 07:50:31.046909, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 >[2025/04/09 07:50:31.047005, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) > resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:31.047050, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs > internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:31.047147, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) > get_dc_list: Adding 6 DC's from auto lookup >[2025/04/09 07:50:31.047194, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 >[2025/04/09 07:50:31.047228, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 >[2025/04/09 07:50:31.047256, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 >[2025/04/09 07:50:31.047283, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 >[2025/04/09 07:50:31.047313, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 >[2025/04/09 07:50:31.047343, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) > check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:31.047368, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2025/04/09 07:50:31.047395, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) > get_dc_list: returning 6 ip addresses in an ordered list >[2025/04/09 07:50:31.047420, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) > get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 >[2025/04/09 07:50:31.047459, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) > get_kdc_ip_string: got 6 addresses from site-less search >[2025/04/09 07:50:31.047493, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) > get_kdc_ip_string: 5 additional KDCs to test >[2025/04/09 07:50:31.148788, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) > &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX > command : LOGON_SAM_LOGON_RESPONSE_EX (23) > sbz : 0x0000 (0) > server_type : 0x0001f1fc (127484) > 0: NBT_SERVER_PDC > 1: NBT_SERVER_GC > 1: NBT_SERVER_LDAP > 1: NBT_SERVER_DS > 1: NBT_SERVER_KDC > 1: NBT_SERVER_TIMESERV > 1: NBT_SERVER_CLOSEST > 1: NBT_SERVER_WRITABLE > 0: NBT_SERVER_GOOD_TIMESERV > 0: NBT_SERVER_NDNC > 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 > 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 > 1: NBT_SERVER_ADS_WEB_SERVICE > 1: NBT_SERVER_DS_8 > 1: NBT_SERVER_DS_9 > 1: NBT_SERVER_DS_10 > 0: NBT_SERVER_HAS_DNS_NAME > 0: NBT_SERVER_IS_DEFAULT_NC > 0: NBT_SERVER_FOREST_ROOT > domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 > forest : 'adprotocolx.com' > dns_domain : 'adprotocolx.com' > pdc_dns_name : 'windc2.adprotocolx.com' > domain_name : 'ADPROTOCOLX' > pdc_name : 'WINDC2' > user_name : '' > server_site : 'Default-First-Site-Name' > client_site : 'Default-First-Site-Name' > sockaddr_size : 0x00 (0) > sockaddr: struct nbt_sockaddr > sockaddr_family : 0x00000000 (0) > pdc_ip : (null) > remaining : DATA_BLOB length=0 > next_closest_site : NULL > nt_version : 0x00000005 (5) > 1: NETLOGON_NT_VERSION_1 > 0: NETLOGON_NT_VERSION_5 > 1: NETLOGON_NT_VERSION_5EX > 0: NETLOGON_NT_VERSION_5EX_WITH_IP > 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE > 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL > 0: NETLOGON_NT_VERSION_PDC > 0: NETLOGON_NT_VERSION_IP > 0: NETLOGON_NT_VERSION_LOCAL > 0: NETLOGON_NT_VERSION_GC > lmnt_token : 0xffff (65535) > lm20_token : 0xffff (65535) >[2025/04/09 07:50:31.621295, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:50:31.621365, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:50:31.621484, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:31.621594, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:50:31.621719, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000038 (56) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:50:31.621949, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:50:31.622075, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:50:31.622149, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:50:31.623133, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:50:31.623186, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000038 (56) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] EA FB B4 7F 70 BF 19 84 1F 0F BD ED DC 67 BA 8F ....p... .....g.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 4C F1 76 CC DE 55 EB D3 03 3D 54 9C 71 DE 35 F1 L.v..U.. .=T.q.5. > [0030] 8E D8 7B C3 BB 27 75 D7 B5 5E 4C 6E 14 B7 01 08 ..{..'u. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:50:31.623502, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:50:31.623527, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:50:31.623548, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:50:31.623589, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:50:31.623615, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:50:31.623636, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:50:31.623672, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:50:31.623747, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:50:31.623772, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:31.623838, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:50:31.623859, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:50:31.624622, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:50:31.624654, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:50:31.624698, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:31.624750, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:50:31.624819, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000039 (57) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:50:31.625062, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:50:31.625147, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:50:31.625185, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:50:31.625930, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:50:31.626013, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000039 (57) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] B3 0C 33 9E 7D E0 B4 D5 DE E0 EF 46 8C B4 AF 37 ..3.}... ...F...7 > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 03 59 3B 41 20 EA 58 9D EA 38 7E A1 76 17 46 5D .Y;A .X. .8~.v.F] > [0030] 1E DD 19 E5 A4 72 85 64 B5 5E 4C 6E 14 B7 01 08 .....r.d .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:50:31.626310, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:50:31.626334, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:50:31.626355, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:50:31.626390, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:50:31.626414, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:50:31.626435, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:50:31.626481, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:50:31.626558, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:50:31.626583, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:31.626647, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:50:31.626669, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:50:34.049576, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) > get_kdc_ip_string: Returning > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:50:34.049802, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) > create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: > kdc = 10.28.1.93 > kdc = [2001:192::c973:d0d7:81c8:f00]:88 > >[2025/04/09 07:50:34.049945, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200334] >[2025/04/09 07:50:34.050014, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:05:34 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:50:34.050074, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200334] >[2025/04/09 07:50:34.050099, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:05:34 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:50:34.050157, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) > DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' >[2025/04/09 07:50:34.050226, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) > cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX >[2025/04/09 07:50:46.632343, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:50:46.632401, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:50:46.632553, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:50:46.632702, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:50:46.632882, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003a (58) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:50:46.633184, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:50:46.633303, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:50:46.633391, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:50:46.634878, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:50:46.634940, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003a (58) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 27 CA F1 9D 1D 4C 4E B9 9F 1E 26 32 9E B0 C6 36 '....LN. ..&2...6 > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] E2 1B 43 AF 61 C6 FD E6 0D 17 7D 3C 3C A2 1B E4 ..C.a... ..}<<... > [0030] 9B 28 77 D3 3A 4F 25 6B B5 5E 4C 6E 14 B7 01 08 .(w.:O%k .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:50:46.635260, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:50:46.635287, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:50:46.635307, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:50:46.635345, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:50:46.635370, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:50:46.635396, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:50:46.635429, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:50:46.635536, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:50:46.635576, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:50:46.635663, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:50:46.635686, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:51:01.622747, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:51:01.622828, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:51:01.623007, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:01.623125, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:51:01.623259, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003b (59) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:51:01.623448, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:51:01.623598, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:51:01.623676, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:51:01.625379, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:51:01.625446, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003b (59) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] EF 80 2A CE 16 93 BF 9C 9F D6 51 21 0D 5F D4 2D ..*..... ..Q!._.- > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 5E A1 DD 9E 76 4E E2 3C 53 24 B4 4D 59 04 4E 02 ^...vN.< S$.MY.N. > [0030] 70 65 9F B0 F0 FB 6B 35 B5 5E 4C 6E 14 B7 01 08 pe....k5 .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:51:01.625732, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:51:01.625821, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:51:01.625849, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:51:01.625887, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:51:01.625924, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:51:01.625944, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:51:01.626025, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:51:01.626115, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:51:01.626139, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:01.626210, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:51:01.626232, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:51:07.032360, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) > cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). >[2025/04/09 07:51:07.032576, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1019(print_socket_options) > socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:51:07.034140, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:861(cm_prepare_connection) > connecting to windc2.adprotocolx.com (ADPROTOCOLX, ADPROTOCOLX.COM) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] >[2025/04/09 07:51:07.034206, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com >[2025/04/09 07:51:07.034358, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] >[2025/04/09 07:51:07.034411, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199467.034345: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:51:07.034875, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199467.034347: Sending unauthenticated request >[2025/04/09 07:51:07.034914, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199467.034348: Sending request (182 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:51:07.035182, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199467.034349: Resolving hostname 10.28.1.93 >[2025/04/09 07:51:07.035326, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199467.034350: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 07:51:07.036450, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199467.034351: Received answer (219 bytes) from dgram 10.28.1.93:88 >[2025/04/09 07:51:07.036525, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199467.034352: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:51:07.037773, 1] ../../source3/rpc_client/cli_pipe.c:554(cli_pipe_validate_current_pdu) > ../../source3/rpc_client/cli_pipe.c:554: RPC fault code DCERPC_FAULT_ACCESS_DENIED received from host windc2.adprotocolx.com! >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:51:10.099603, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199470.099589: No URI records found >[2025/04/09 07:51:10.099707, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199470.099590: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. >[2025/04/09 07:51:13.171837, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199473.171826: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:51:14.039006, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) > tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) >[2025/04/09 07:51:14.039128, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) > tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb >[2025/04/09 07:51:14.039412, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) > Could not get the lock for windc2.adprotocolx.com >[2025/04/09 07:51:14.039552, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) > cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com >[2025/04/09 07:51:14.039606, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK >[2025/04/09 07:51:16.243891, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243879: No SRV records found >[2025/04/09 07:51:16.244011, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243880: Response was not from master KDC >[2025/04/09 07:51:16.244082, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243881: Received error from KDC: -1765328359/Additional pre-authentication required >[2025/04/09 07:51:16.244177, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243884: Preauthenticating using KDC method data >[2025/04/09 07:51:16.244229, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243885: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) >[2025/04/09 07:51:16.244276, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243886: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:51:16.248076, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243887: AS key obtained for encrypted timestamp: aes256-cts/C8D8 >[2025/04/09 07:51:16.248179, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243889: Encrypted timestamp (for 1744210265.658860): plain 301AA011180F32303235303430393134353130355AA10502030A0DAC, encrypted 12E9C53D34DB64C4148DA16DB2C66E28DEDE9DB526376B5F9627951C45735B8B9B12C5F9A1E3E35E1403BC04FFBEC906C0F8B505775D09B8 >[2025/04/09 07:51:16.248240, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243890: Preauth module encrypted_timestamp (2) (real) returned: 0/Success >[2025/04/09 07:51:16.248279, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243891: Produced preauth for next request: PA-ENC-TIMESTAMP (2) >[2025/04/09 07:51:16.248324, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243892: Sending request (261 bytes) to ADPROTOCOLX.COM >[2025/04/09 07:51:16.248411, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243893: Resolving hostname 10.28.1.93 >[2025/04/09 07:51:16.248547, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243894: Sending initial UDP request to dgram 10.28.1.93:88 >[2025/04/09 07:51:16.250261, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243895: Received answer (102 bytes) from dgram 10.28.1.93:88 >[2025/04/09 07:51:16.250362, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199476.243896: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:51:16.629491, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:51:16.629559, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:51:16.629653, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:16.629732, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:51:16.629830, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003c (60) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:51:16.630069, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:51:16.630177, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:51:16.630254, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:51:16.633271, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:51:16.633321, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003c (60) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 37 F2 0D 9E 96 64 13 84 8A DD 9B B0 CF 8E E1 C8 7....d.. ........ > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 2E 0E E0 E5 45 A5 1F 99 A4 95 10 7C E1 3F CD F2 ....E... ...|.?.. > [0030] 25 E9 0E 6F 2D 00 17 EF 00 00 00 00 00 00 00 00 %..o-... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:51:16.633590, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:51:16.633613, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:51:16.633632, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:51:16.633664, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:51:16.633685, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:51:16.633713, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:51:16.633742, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:51:16.633813, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:51:16.633834, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:16.633890, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:51:16.633910, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:51:19.315802, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199479.315787: No URI records found >[2025/04/09 07:51:19.315998, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199479.315788: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. >[2025/04/09 07:51:22.387723, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199482.387712: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:51:25.459905, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459876: No SRV records found >[2025/04/09 07:51:25.459992, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459877: Response was not from master KDC >[2025/04/09 07:51:25.460085, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459878: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP >[2025/04/09 07:51:25.460117, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459879: Request or response is too big for UDP; retrying with TCP >[2025/04/09 07:51:25.460144, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459880: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) >[2025/04/09 07:51:25.460296, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459881: Resolving hostname 10.28.1.93 >[2025/04/09 07:51:25.460458, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459882: Initiating TCP connection to stream 10.28.1.93:88 >[2025/04/09 07:51:25.460983, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459883: Sending TCP request to stream 10.28.1.93:88 >[2025/04/09 07:51:25.462582, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459884: Received answer (1596 bytes) from stream 10.28.1.93:88 >[2025/04/09 07:51:25.462626, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459885: Terminating TCP connection to stream 10.28.1.93:88 >[2025/04/09 07:51:25.462725, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199485.459886: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. >[2025/04/09 07:51:28.531660, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199488.531642: No URI records found >[2025/04/09 07:51:28.531761, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199488.531643: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. >[2025/04/09 07:51:31.614121, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614088: No SRV records found >[2025/04/09 07:51:31.614199, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614089: Response was not from master KDC >[2025/04/09 07:51:31.614279, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614090: Processing preauth types: PA-ETYPE-INFO2 (19) >[2025/04/09 07:51:31.614316, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614091: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" >[2025/04/09 07:51:31.614345, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614092: Produced preauth for next request: (empty) >[2025/04/09 07:51:31.614397, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614093: AS key determined by preauth: aes256-cts/C8D8 >[2025/04/09 07:51:31.614498, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614094: Decrypted AS reply; session key is: aes256-cts/8537 >[2025/04/09 07:51:31.614548, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614095: FAST negotiation: unavailable >[2025/04/09 07:51:31.614634, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) > kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:51:31.614685, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614096: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM >[2025/04/09 07:51:31.614730, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) > smb_krb5_trace_cb: [2398754] 1744199491.614097: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect >[2025/04/09 07:51:31.614811, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) > cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos >[2025/04/09 07:51:31.614847, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) > cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO >[2025/04/09 07:51:31.615166, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC mechanism spnego >[2025/04/09 07:51:31.615279, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC submechanism gse_krb5 >[2025/04/09 07:51:31.641480, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:51:31.641545, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:51:31.641664, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:31.641773, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:51:31.641870, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003d (61) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:51:31.642100, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:51:31.642216, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:51:31.642281, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:51:31.645502, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:51:31.645568, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003d (61) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] AC 7F 23 B4 96 95 C7 4B B7 66 68 64 E6 03 99 6E ..#....K .fhd...n > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] F7 3B E0 51 84 55 F4 D1 3F B7 DD 27 CC 4E 0E 0A .;.Q.U.. ?..'.N.. > [0030] 63 F0 5A 8E 4B ED 0E 35 B8 3C 71 95 71 01 00 00 c.Z.K..5 .<q.q... > [0040] D8 3C 71 95 71 01 00 00 04 00 00 00 00 00 00 00 .<q.q... ........ >[2025/04/09 07:51:31.645843, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:51:31.645867, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:51:31.645887, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:51:31.645922, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:51:31.645944, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:51:31.646004, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:51:31.646040, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:51:31.646111, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:51:31.646134, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:31.646202, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:51:31.646224, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:51:47.131435, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:51:47.131559, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:51:47.131759, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:51:47.131903, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:51:47.132048, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003e (62) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:51:47.132276, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:51:47.132405, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:51:47.132510, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:51:47.133489, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:51:47.133544, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003e (62) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 6A D5 86 ED 43 70 26 E4 6A 4B 80 27 C6 27 A6 9E j...Cp&. jK.'.'.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] CD 2B 36 FA A4 4E 2D 72 5C 1F E5 54 0B 10 E6 61 .+6..N-r \..T...a > [0030] 77 2F BD C2 22 9C 5E 75 B8 3C 71 95 71 01 00 00 w/..".^u .<q.q... > [0040] D8 3C 71 95 71 01 00 00 04 00 00 00 00 00 00 00 .<q.q... ........ >[2025/04/09 07:51:47.133845, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:51:47.133870, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:51:47.133890, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:51:47.133925, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:51:47.133948, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:51:47.134007, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:51:47.134039, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:51:47.134120, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:51:47.134143, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:51:47.134221, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:51:47.134245, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:51:50.036713, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf82603ae0]: subreq: 0x55cf825c8e50 >[2025/04/09 07:51:50.036820, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf8259a830]: subreq: 0x55cf8258f430 >[2025/04/09 07:51:50.036884, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf82603ae0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8e50/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825c9030)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] >[2025/04/09 07:51:50.037000, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf8259a830]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf8258f430/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf8258f610)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:51:50.039843, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: gse_krb5[0x55cf82603ae0]: subreq: 0x55cf825c8930 >[2025/04/09 07:51:50.039882, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: spnego[0x55cf8259a830]: subreq: 0x55cf8258f430 >[2025/04/09 07:51:50.039908, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: gse_krb5[0x55cf82603ae0]: NT_STATUS_OK tevent_req[0x55cf825c8930/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825c8b10)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:994] >[2025/04/09 07:51:50.039944, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: spnego[0x55cf8259a830]: NT_STATUS_OK tevent_req[0x55cf8258f430/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf8258f610)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] >[2025/04/09 07:51:50.040269, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:51:50.040870, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200410] >[2025/04/09 07:51:50.040917, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:06:50 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:51:50.041018, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) > saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200410] >[2025/04/09 07:51:50.041044, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:06:50 AM 2025 EDT] (900 seconds ahead) >[2025/04/09 07:51:50.041212, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) > set_domain_online: called for domain ADPROTOCOLX >[2025/04/09 07:51:50.041258, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) > get_global_winbindd_state_offline: Offline state not set. >[2025/04/09 07:51:50.041948, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) > messaging_dgm_send: Sending message to 2398430 >[2025/04/09 07:51:50.042058, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) > gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403284137 seconds ahead) >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:51:50.042511, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=18, vnn=4026531841, opcode=18, srvid=0 >[2025/04/09 07:51:50.042643, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=19, vnn=4026531841, opcode=4, srvid=0 >[2025/04/09 07:51:50.042729, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=20, vnn=4026531841, opcode=149, srvid=0 >[2025/04/09 07:51:50.042847, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) > db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b >[2025/04/09 07:51:50.043017, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > session_key : 6927d03bace8352078671274da7f767c > sequence : 0x67f65e44 (1744199236) > seed: struct netr_Credential > data : 5ae434c6f197d07b > client: struct netr_Credential > data : 7b2f5a59c67e107d > server: struct netr_Credential > data : 780a45edba62c4b2 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > ex : * > ex: struct netlogon_creds_CredentialState_extra_info > magic : 0x00000601 (1537) > reserved : 0x00000000 (0) > client_requested_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > auth_time : Wed Apr 9 07:47:15 AM 2025 EDT > client_sid : S-1-0-1108 >[2025/04/09 07:51:50.043726, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:51:50.043756, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:51:50.043795, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:51:50.043845, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) > ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 >[2025/04/09 07:51:50.043868, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:968(ctdbd_migrate) > ctdbd_migrate: Sending ctdb packet >ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory >[2025/04/09 07:51:50.044053, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:51:50.044094, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:51:50.044124, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:51:50.044164, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:51:50.044184, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:51:50.044273, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:51:50.044817, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) > state->creds: struct netlogon_creds_CredentialState > negotiate_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > session_key : 6927d03bace8352078671274da7f767c > sequence : 0x67f65e44 (1744199236) > seed: struct netr_Credential > data : 5ae434c6f197d07b > client: struct netr_Credential > data : 7b2f5a59c67e107d > server: struct netr_Credential > data : 780a45edba62c4b2 > secure_channel_type : SEC_CHAN_WKSTA (0x2) > computer_name : 'GPFSNMBASH' > account_name : 'GPFSNMBASH$' > ex : * > ex: struct netlogon_creds_CredentialState_extra_info > magic : 0x00000601 (1537) > reserved : 0x00000000 (0) > client_requested_flags : 0x610fffff (1628438527) > 1: NETLOGON_NEG_ACCOUNT_LOCKOUT > 1: NETLOGON_NEG_PERSISTENT_SAMREPL > 1: NETLOGON_NEG_ARCFOUR > 1: NETLOGON_NEG_PROMOTION_COUNT > 1: NETLOGON_NEG_CHANGELOG_BDC > 1: NETLOGON_NEG_FULL_SYNC_REPL > 1: NETLOGON_NEG_MULTIPLE_SIDS > 1: NETLOGON_NEG_REDO > 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL > 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC > 1: NETLOGON_NEG_GENERIC_PASSTHROUGH > 1: NETLOGON_NEG_CONCURRENT_RPC > 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL > 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL > 1: NETLOGON_NEG_STRONG_KEYS > 1: NETLOGON_NEG_TRANSITIVE_TRUSTS > 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS > 1: NETLOGON_NEG_PASSWORD_SET2 > 1: NETLOGON_NEG_GETDOMAININFO > 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS > 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION > 0: NETLOGON_NEG_RODC_PASSTHROUGH > 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 > 1: NETLOGON_NEG_SUPPORTS_AES > 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS > 1: NETLOGON_NEG_AUTHENTICATED_RPC > 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH > auth_time : Wed Apr 9 07:47:15 AM 2025 EDT > client_sid : S-1-0-1108 >[2025/04/09 07:51:50.045535, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) > Starting GENSEC mechanism schannel >[2025/04/09 07:51:50.045575, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) > Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 >[2025/04/09 07:51:50.045598, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) > create_generic_auth_rpc_bind_req: generate first token >[2025/04/09 07:51:50.045661, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55cf825b31d0]: subreq: 0x55cf825c8e50 >[2025/04/09 07:51:50.045691, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55cf825b31d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8e50/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825c9030)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] >[2025/04/09 07:51:50.045723, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x00 (0) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=31 > [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC > [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. >[2025/04/09 07:51:50.045827, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND (11) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x006f (111) > auth_length : 0x001f (31) > call_id : 0x0000000e (14) > u : union dcerpc_payload(case 11) > bind: struct dcerpc_bind > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000000 (0) > num_contexts : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ctx_list > context_id : 0x0000 (0) > num_transfer_syntaxes : 0x01 (1) > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntaxes: ARRAY(1) > transfer_syntaxes: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=39 > [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ > [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS > [0020] 4E 4D 42 41 53 48 00 NMBASH. >[2025/04/09 07:51:50.046141, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:51:50.046186, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:51:50.046706, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 72 >[2025/04/09 07:51:50.046785, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_BIND_ACK (12) > pfc_flags : 0x07 (7) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0058 (88) > auth_length : 0x000c (12) > call_id : 0x0000000e (14) > u : union dcerpc_payload(case 12) > bind_ack: struct dcerpc_bind_ack > max_xmit_frag : 0x10b8 (4280) > max_recv_frag : 0x10b8 (4280) > assoc_group_id : 0x00000b88 (2952) > secondary_address_size : 0x000c (12) > secondary_address : '\pipe\lsass' > _pad1 : DATA_BLOB length=2 > [0000] 00 00 .. > num_results : 0x01 (1) > ctx_list: ARRAY(1) > ctx_list: struct dcerpc_ack_ctx > result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) > reason : union dcerpc_bind_ack_reason(case 0) > value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) > syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) > auth_info : DATA_BLOB length=20 > [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ > [0010] 00 00 00 00 .... >[2025/04/09 07:51:50.047113, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 88 at offset 0: NT_STATUS_OK >[2025/04/09 07:51:50.047147, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 88 bytes. >[2025/04/09 07:51:50.047174, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) > check_bind_response: accepted! >[2025/04/09 07:51:50.047196, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 0 >[2025/04/09 07:51:50.047224, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) > gensec_update_send: schannel[0x55cf825b31d0]: subreq: 0x55cf825c8e50 >[2025/04/09 07:51:50.047249, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) > gensec_update_done: schannel[0x55cf825b31d0]: NT_STATUS_OK tevent_req[0x55cf825c8e50/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825c9030)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] >[2025/04/09 07:51:50.047284, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) > dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb >[2025/04/09 07:51:50.047303, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) > lock order: 1:<none> 2:<none> 3:g_lock.tdb 4:<none> >[2025/04/09 07:51:50.047327, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) > Locking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:51:50.047360, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) > dbwrap_watched_record_prepare_wakeup: No watchers >[2025/04/09 07:51:50.047389, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) > ctdbd_control: Sending ctdb packet reqid=22, vnn=4026531841, opcode=128, srvid=1294615339 >[2025/04/09 07:51:50.047472, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) > Unlocking db 1294615339 key 434C495B475046534E4D >[2025/04/09 07:51:50.047504, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) > dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned >[2025/04/09 07:51:50.047522, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) > dbwrap_watched_trigger_wakeup: No one to wakeup >[2025/04/09 07:51:50.047539, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) > dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb >[2025/04/09 07:51:50.047592, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > in: struct netr_GetAnyDCName > logon_server : * > logon_server : 'windc2.adprotocolx.com' > domainname : * > domainname : 'adprotocolx' >[2025/04/09 07:51:50.047704, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) > t: struct dcerpc_sec_verification_trailer > _pad : DATA_BLOB length=0 > magic : 0000000000000000 > count: struct dcerpc_sec_vt_count > count : 0x0002 (2) > commands: ARRAY(2) > commands: struct dcerpc_sec_vt > command : 0x0001 (1) > 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) > 0: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x1) > bitmask1 : 0x00000001 (1) > 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING > commands: struct dcerpc_sec_vt > command : 0x4002 (16386) > 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) > 1: DCERPC_SEC_VT_COMMAND_END > 0: DCERPC_SEC_VT_MUST_PROCESS > u : union dcerpc_sec_vt_union(case 0x2) > pcontext: struct dcerpc_sec_vt_pcontext > abstract_syntax: struct ndr_syntax_id > uuid : 12345678-1234-abcd-ef00-01234567cffb > if_version : 0x00000001 (1) > transfer_syntax: struct ndr_syntax_id > uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 > if_version : 0x00000002 (2) >[2025/04/09 07:51:50.047908, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000000f (15) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x000000a4 (164) > context_id : 0x0000 (0) > opnum : 0x000d (13) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:51:50.048112, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x0c (12) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:51:50.048238, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:51:50.048287, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:52:01.636659, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:52:01.636717, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:52:01.636785, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:52:01.636873, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:52:01.636998, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x0000003f (63) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:52:01.637221, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:52:01.637327, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:52:01.637382, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:52:01.639367, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:52:01.639424, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000003f (63) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 0C 15 37 8C 49 22 C4 30 FC 2E 51 81 90 6F BC 65 ..7.I".0 ..Q..o.e > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] B8 E7 DD 92 16 FF 4A 13 E5 5E 5D 7B 91 E3 7B 95 ......J. .^]{..{. > [0030] 04 76 6C D3 38 FD 6A 13 B8 3C 71 95 71 01 00 00 .vl.8.j. .<q.q... > [0040] D8 3C 71 95 71 01 00 00 04 00 00 00 00 00 00 00 .<q.q... ........ >[2025/04/09 07:52:01.639718, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:52:01.639742, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:52:01.639763, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:52:01.639807, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:52:01.639830, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:52:01.639859, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:52:01.639888, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:52:01.640006, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:52:01.640032, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:52:01.640097, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:52:01.640119, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:52:05.043924, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:52:05.044229, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x0000000f (15) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x00000008 (8) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] D5 B1 75 C7 0F A6 0F 5B E6 17 54 4C 9D B2 FC 2A ..u....[ ..TL...* > [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 04 9A 1F DB 23 4F 55 A9 54 29 48 C1 A6 88 61 EC ....#OU. T)H...a. > [0030] 4E E5 5B 16 08 51 EE BA 00 00 00 00 00 00 00 00 N.[..Q.. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:52:05.044614, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:52:05.044649, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 8 >[2025/04/09 07:52:05.044670, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:52:05.044754, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 8 >[2025/04/09 07:52:05.044778, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:52:05.044812, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. >[2025/04/09 07:52:05.044866, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_GetAnyDCName: struct netr_GetAnyDCName > out: struct netr_GetAnyDCName > dcname : * > dcname : NULL > result : WERR_NO_LOGON_SERVERS >[2025/04/09 07:52:05.045073, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) > dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS >[2025/04/09 07:52:05.045141, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_DsGetDcName: struct wbint_DsGetDcName > out: struct wbint_DsGetDcName > dc_info : * > dc_info : NULL > result : NT_STATUS_NO_LOGON_SERVERS >[2025/04/09 07:52:05.045276, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:52:05.045300, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4016 bytes to parent >[2025/04/09 07:52:16.669752, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:52:16.669825, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:52:16.669987, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:52:16.670127, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:52:16.670279, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000040 (64) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:52:16.670492, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:52:16.670639, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:52:16.670715, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:52:16.671589, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:52:16.671644, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000040 (64) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 0B D7 A0 4D BA 98 B5 20 84 AC FA 7A 22 B8 33 D0 ...M... ...z".3. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] F8 54 05 0E 18 B6 54 5E 9D 32 C5 8F A1 88 AF FB .T....T^ .2...... > [0030] 4A 3B 86 3B 36 67 D3 E4 00 00 00 00 00 00 00 00 J;.;6g.. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:52:16.671984, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:52:16.672026, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:52:16.672047, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:52:16.672082, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:52:16.672105, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:52:16.672126, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:52:16.672162, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:52:16.672280, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:52:16.672304, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:52:16.672375, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:52:16.672398, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:52:31.647984, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:52:31.648059, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:52:31.648149, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:52:31.648239, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:52:31.648343, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000041 (65) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:52:31.648544, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:52:31.648655, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:52:31.648722, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:52:31.649859, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:52:31.649935, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000041 (65) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 83 50 82 7C 96 56 B8 8A 3E 9B C1 D8 DE 11 93 39 .P.|.V.. >......9 > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 6D 32 BA DD C8 E5 3F 00 05 32 2C CC 99 3D 2A 3A m2....?. .2,..=*: > [0030] 3B 6E F6 12 5E 7A B1 4A B8 3C 71 95 71 01 00 00 ;n..^z.J .<q.q... > [0040] D8 3C 71 95 71 01 00 00 04 00 00 00 00 00 00 00 .<q.q... ........ >[2025/04/09 07:52:31.650249, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:52:31.650272, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:52:31.650291, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:52:31.650331, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:52:31.650353, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:52:31.650382, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:52:31.650416, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:52:31.650494, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:52:31.650516, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:52:31.650574, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:52:31.650594, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:52:33.044841, 1] ../../source3/winbindd/winbindd_cm.c:877(cm_prepare_connection) > authenticated session setup to windc2.adprotocolx.com using GPFSNMBASH$@ADPROTOCOLX.COM failed with NT_STATUS_CONNECTION_RESET >[2025/04/09 07:52:33.045024, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) > Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_CONNECTION_RESET >[2025/04/09 07:52:46.651138, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:52:46.651257, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:52:46.651368, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:52:46.651471, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:52:46.651569, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000042 (66) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:52:46.651762, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:52:46.651861, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:52:46.651920, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:52:46.653206, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:52:46.653271, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000042 (66) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 43 8B FE 33 16 E1 D9 00 05 FB 76 D4 FB 7E 16 9D C..3.... ..v..~.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 08 67 0B AF F7 E2 C6 8D 84 29 4E 16 7C E3 DE 0E .g...... .)N.|... > [0030] 5B 16 76 3F 94 D4 13 80 00 00 00 00 00 00 00 00 [.v?.... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:52:46.653677, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:52:46.653701, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:52:46.653731, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:52:46.653764, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:52:46.653786, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:52:46.653814, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:52:46.653843, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:52:46.653909, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:52:46.653930, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:52:46.654054, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:52:46.654085, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:53:01.648557, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:53:01.648552, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:53:01.648661, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:53:01.648694, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:53:01.648829, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:01.648937, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc >[2025/04/09 07:53:01.649005, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct wbint_PingDc > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:53:01.649121, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) >[2025/04/09 07:53:01.649210, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > [3] : 0x00 (0) > in: struct netr_LogonControl > frag_length : 0x0018 (24) > logon_server : * > auth_length : 0x0038 (56) > logon_server : '\\windc2.adprotocolx.com' > call_id : 0x00000043 (67) > function_code : NETLOGON_CONTROL_QUERY (1) > u : union dcerpc_payload(case 0) > level : 0x00000002 (2) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:53:01.649322, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) >[2025/04/09 07:53:01.649337, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > rpc_vers_minor : 0x00 (0) > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > ptype : DCERPC_PKT_REQUEST (0) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > pfc_flags : 0x03 (3) > auth_pad_length : 0x04 (4) > 1: DCERPC_PFC_FLAG_FIRST > auth_reserved : 0x00 (0) > 1: DCERPC_PFC_FLAG_LAST > auth_context_id : 0x00000001 (1) > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > credentials : DATA_BLOB length=0 > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000010 (16) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) >[2025/04/09 07:53:01.649477, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:53:01.649528, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) >[2025/04/09 07:53:01.649582, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:53:01.649653, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:53:01.649752, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:53:01.651497, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:53:01.651568, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000010 (16) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 46 13 DC D5 02 1D 54 D9 7B 2B C4 0B C8 ED 6B 89 F.....T. {+....k. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 77 AF E2 82 EA 5A 60 D0 7C 2F 20 A8 52 80 82 A4 w....Z`. |/ .R... > [0030] 7F F9 CE F6 62 FE 97 9F 00 00 00 00 00 00 00 00 ....b... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:53:01.651842, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:53:01.651867, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:53:01.651886, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:53:01.651922, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:53:01.651944, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:53:01.652044, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:53:01.652080, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:53:01.652161, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:53:01.652184, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:01.652247, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:53:01.652267, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:53:01.652436, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:53:01.652474, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000043 (67) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] ED 60 C4 C4 29 96 A8 D9 F5 CA 27 AC 86 C1 45 70 .`..)... ..'...Ep > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 80 09 E2 DD 36 CB B7 63 00 6D 37 E3 40 8A 48 18 ....6..c .m7.@.H. > [0030] BB 2C B4 5B 8C 4C 45 62 00 00 00 00 00 00 00 00 .,.[.LEb ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:53:01.652725, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:53:01.652746, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:53:01.652765, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:53:01.652795, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:53:01.652816, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:53:01.652839, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:53:01.652863, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:53:01.652938, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:53:01.653007, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:01.653083, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:53:01.653105, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:53:16.666236, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:53:16.666320, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:53:16.666625, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:16.666820, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:53:16.666947, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000044 (68) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:53:16.667221, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:53:16.667329, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:53:16.667414, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:53:16.668917, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:53:16.668993, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000044 (68) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 33 F5 4B 14 0F 4C 08 94 B1 4A 55 FA 9F 41 80 F3 3.K..L.. .JU..A.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 13 E0 40 F0 45 50 69 3E AD 9D 00 E6 22 00 6A FE ..@.EPi> ....".j. > [0030] 57 F4 3A 95 6A 00 F6 88 00 00 00 00 00 00 00 00 W.:.j... ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:53:16.669309, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:53:16.669341, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:53:16.669360, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:53:16.669397, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:53:16.669421, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:53:16.669441, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:53:16.669469, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:53:16.669557, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:53:16.669580, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:16.669646, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:53:16.669666, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:53:31.656649, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:53:31.656724, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:53:31.656869, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:31.657076, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:53:31.657245, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000045 (69) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:53:31.657471, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:53:31.657655, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:53:31.657778, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:53:31.663165, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:53:31.663221, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000045 (69) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 6B A0 FF 58 82 A1 70 BA 91 A0 82 D3 F2 B7 AC 4A k..X..p. .......J > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 39 53 E9 BD B2 E8 44 6D 0C 33 06 14 E8 6B 21 5D 9S....Dm .3...k!] > [0030] 00 17 FC 9C 6E 6A 3B C1 00 00 00 00 00 00 00 00 ....nj;. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:53:31.663497, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:53:31.663521, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:53:31.663541, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:53:31.663573, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:53:31.663595, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:53:31.663625, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:53:31.663660, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:53:31.663746, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:53:31.663783, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:31.663857, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:53:31.663878, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:53:31.674803, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:53:31.674831, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:53:31.674868, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:31.674911, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:53:31.675002, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000046 (70) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:53:31.675182, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:53:31.675255, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:53:31.675304, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:53:31.676061, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:53:31.676105, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000046 (70) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 3F B9 94 96 7B 7E 02 5A BE DF 0C D9 33 42 9D 0B ?...{~.Z ....3B.. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] DF 1A BD EF 80 28 21 39 03 E2 EE D7 96 08 B5 3B .....(!9 .......; > [0030] 9B FB 41 3D 20 84 7E 47 B5 5E 4C 6E 14 B7 01 08 ..A= .~G .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:53:31.676359, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:53:31.676381, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:53:31.676399, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:53:31.676430, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:53:31.676451, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:53:31.676482, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:53:31.676509, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:53:31.676576, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:53:31.676603, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:31.676659, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:53:31.676679, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:53:46.649484, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:53:46.649556, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:53:46.649653, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:53:46.649761, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:53:46.649864, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000047 (71) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:53:46.650084, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:53:46.650221, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:53:46.650279, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:53:46.651802, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:53:46.651863, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000047 (71) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 60 13 58 80 86 4C B3 62 16 01 81 2E 42 8F 90 47 `.X..L.b ....B..G > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 8A FA 4E 85 30 A8 BA 95 30 A2 E9 7B 54 F4 75 6C ..N.0... 0..{T.ul > [0030] F8 BF E7 DF F4 D5 5C D5 00 00 00 00 00 00 00 00 ......\. ........ > [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:53:46.652184, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:53:46.652208, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:53:46.652227, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:53:46.652259, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:53:46.652280, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:53:46.652307, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:53:46.652336, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:53:46.652422, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:53:46.652461, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:53:46.652518, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:53:46.652538, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:54:01.657778, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:54:01.657843, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:54:01.658111, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:54:01.658224, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:54:01.658326, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000048 (72) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:54:01.658505, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:54:01.658610, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:54:01.658676, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:54:01.659920, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:54:01.660007, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000048 (72) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 39 0B 2C A6 78 B2 59 50 B4 88 E7 E5 C3 E7 36 A6 9.,.x.YP ......6. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] 8C 94 C5 A7 D1 58 AF 5F 31 96 D8 E7 4E 7F 27 A2 .....X._ 1...N.'. > [0030] 4D 30 F4 67 44 A8 0D 18 B5 5E 4C 6E 14 B7 01 08 M0.gD... .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:54:01.660278, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:54:01.660299, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:54:01.660317, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:54:01.660348, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:54:01.660369, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:54:01.660398, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:54:01.660426, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:54:01.660504, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:54:01.660526, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:54:01.660581, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:54:01.660600, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >[2025/04/09 07:54:01.673341, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) > child daemon request 55 >[2025/04/09 07:54:01.673373, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) > winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') >[2025/04/09 07:54:01.673416, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > in: struct wbint_PingDc >[2025/04/09 07:54:01.673470, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > in: struct netr_LogonControl > logon_server : * > logon_server : '\\windc2.adprotocolx.com' > function_code : NETLOGON_CONTROL_QUERY (1) > level : 0x00000002 (2) >[2025/04/09 07:54:01.673542, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) > &r: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_REQUEST (0) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0018 (24) > auth_length : 0x0038 (56) > call_id : 0x00000049 (73) > u : union dcerpc_payload(case 0) > request: struct dcerpc_request > alloc_hint : 0x0000004c (76) > context_id : 0x0000 (0) > opnum : 0x000c (12) > object : union dcerpc_object(case 0) > empty: struct dcerpc_empty > stub_and_verifier : DATA_BLOB length=0 >[2025/04/09 07:54:01.673736, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) > &r: struct dcerpc_auth > auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) > auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) > auth_pad_length : 0x04 (4) > auth_reserved : 0x00 (0) > auth_context_id : 0x00000001 (1) > credentials : DATA_BLOB length=0 >[2025/04/09 07:54:01.673823, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) > rpc_api_pipe: host windc2.adprotocolx.com >[2025/04/09 07:54:01.673865, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) > signed SMB2 message (sign_algo_id=1) >[2025/04/09 07:54:01.675478, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) > rpc_read_send: data_to_read: 88 >[2025/04/09 07:54:01.675529, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) > state->pkt: struct ncacn_packet > rpc_vers : 0x05 (5) > rpc_vers_minor : 0x00 (0) > ptype : DCERPC_PKT_RESPONSE (2) > pfc_flags : 0x03 (3) > 1: DCERPC_PFC_FLAG_FIRST > 1: DCERPC_PFC_FLAG_LAST > 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING > 0: DCERPC_PFC_FLAG_CONC_MPX > 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE > 0: DCERPC_PFC_FLAG_MAYBE > 0: DCERPC_PFC_FLAG_OBJECT_UUID > drep: ARRAY(4) > [0] : 0x10 (16) > [1] : 0x00 (0) > [2] : 0x00 (0) > [3] : 0x00 (0) > frag_length : 0x0068 (104) > auth_length : 0x0038 (56) > call_id : 0x00000049 (73) > u : union dcerpc_payload(case 2) > response: struct dcerpc_response > alloc_hint : 0x0000000c (12) > context_id : 0x0000 (0) > cancel_count : 0x00 (0) > reserved : 0x00 (0) > stub_and_verifier : DATA_BLOB length=80 > [0000] 49 0E 1F 20 B0 A8 4B BD 9A C7 36 A2 C6 7E 67 0B I.. ..K. ..6..~g. > [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ > [0020] CB BF 3E A3 2E 3B B4 6F D7 5F 2D D4 24 90 23 F6 ..>..;.o ._-.$.#. > [0030] 4D 46 D6 04 5D 6F F2 05 B5 5E 4C 6E 14 B7 01 08 MF..]o.. .^Ln.... > [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ >[2025/04/09 07:54:01.675787, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) > Requested Privacy. >[2025/04/09 07:54:01.675809, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) > dcerpc_pull_auth_trailer: auth_pad_length 4 >[2025/04/09 07:54:01.675828, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) > GENSEC auth >[2025/04/09 07:54:01.675861, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) > Got pdu len 104, data_len 12 >[2025/04/09 07:54:01.675890, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) > rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK >[2025/04/09 07:54:01.675909, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) > rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. >[2025/04/09 07:54:01.675936, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > netr_LogonControl: struct netr_LogonControl > out: struct netr_LogonControl > query : * > query : union netr_CONTROL_QUERY_INFORMATION(case 2) > info2 : NULL > result : WERR_NOT_SUPPORTED >[2025/04/09 07:54:01.676040, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) > winbindd_dual_ping_dc succeeded >[2025/04/09 07:54:01.676064, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) > wbint_PingDc: struct wbint_PingDc > out: struct wbint_PingDc > dcname : * > dcname : * > dcname : 'windc2.adprotocolx.com' > result : NT_STATUS_OK >[2025/04/09 07:54:01.676131, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) > Finished processing child request 55 >[2025/04/09 07:54:01.676154, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) > Writing 4052 bytes to parent >
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 15844
: 18631 |
18686
|
18687
|
18690