Attachment 57 Details for Bug 252 – Log of a failed user account deletion using the NT4 domain user manager.

Log of a failed user account deletion using the NT4 domain user manager.

slim.5.log (text/plain), 193.88 KB, created by John H Terpstra (mail address dead( on 2003-07-26 12:54:25 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: John H Terpstra (mail address dead(

Created: 2003-07-26 12:54:25 UTC

Size: 193.88 KB

patch

obsolete

>[2003/07/26 13:53:12, 5] lib/debug.c:debug_dump_status(359)
>  INFO: Current debug levels:
>    all: True/5
>    tdb: False/0
>    printdrivers: False/0
>    lanman: False/0
>    smb: False/0
>    rpc_parse: False/0
>    rpc_srv: False/0
>    rpc_cli: False/0
>    passdb: False/0
>    sam: False/0
>    auth: False/0
>    winbind: False/0
>    vfs: False/0
>    idmap: False/0
>[2003/07/26 13:53:12, 2] param/loadparm.c:do_section(3418)
>  Processing section "[homes]"
>  doing parameter comment = Home Directories
>  doing parameter valid users = %S
>  doing parameter read only = No
>  doing parameter browseable = No
>[2003/07/26 13:53:12, 2] param/loadparm.c:do_section(3418)
>  Processing section "[print$]"
>  doing parameter comment = Printer Drivers Share
>  doing parameter path = /var/lib/samba/drivers
>  doing parameter write list = jht, root
>  doing parameter printer admin = jht, root
>  doing parameter create mask = 0664
>  doing parameter directory mask = 0775
>[2003/07/26 13:53:12, 2] param/loadparm.c:do_section(3418)
>  Processing section "[netlogon]"
>  doing parameter comment = Network Logon Service
>  doing parameter path = /var/lib/samba/netlogon
>  doing parameter admin users = root, jht
>  doing parameter guest ok = Yes
>  doing parameter nt acl support = No
>  doing parameter browseable = No
>  doing parameter blocking locks = No
>  doing parameter csc policy = disable
>  doing parameter locking = No
>  doing parameter oplocks = No
>  doing parameter level2 oplocks = No
>  doing parameter posix locking = No
>  doing parameter strict locking = No
>  doing parameter share modes = No
>[2003/07/26 13:53:12, 2] param/loadparm.c:do_section(3418)
>  Processing section "[Profiles]"
>  doing parameter comment = Roaming Profile Share
>  doing parameter path = /var/lib/samba/profiles
>  doing parameter read only = No
>  doing parameter profile acls = Yes
>[2003/07/26 13:53:12, 2] param/loadparm.c:do_section(3418)
>  Processing section "[printers]"
>  doing parameter comment = All Printers
>  doing parameter path = /var/spool/samba
>  doing parameter printer admin = root, jht
>  doing parameter create mask = 0600
>  doing parameter guest ok = Yes
>  doing parameter printable = Yes
>  doing parameter use client driver = Yes
>  doing parameter default devmode = Yes
>  doing parameter browseable = No
>[2003/07/26 13:53:12, 2] param/loadparm.c:do_section(3418)
>  Processing section "[media]"
>  doing parameter comment = Public Stuff
>  doing parameter path = /export2
>  doing parameter read list = @users
>  doing parameter write list = jht
>  doing parameter read only = No
>  doing parameter blocking locks = No
>  doing parameter csc policy = disable
>  doing parameter locking = No
>  doing parameter oplocks = No
>  doing parameter level2 oplocks = No
>  doing parameter posix locking = No
>  doing parameter strict locking = No
>  doing parameter share modes = No
>[2003/07/26 13:53:12, 2] param/loadparm.c:do_section(3418)
>  Processing section "[data]"
>  doing parameter comment = Data Stuff
>  doing parameter path = /export/data
>  doing parameter write list = @ntadmin
>  doing parameter read only = No
>  doing parameter blocking locks = No
>  doing parameter csc policy = disable
>  doing parameter locking = No
>  doing parameter oplocks = No
>  doing parameter level2 oplocks = No
>  doing parameter posix locking = No
>  doing parameter strict locking = No
>  doing parameter share modes = No
>[2003/07/26 13:53:12, 2] param/loadparm.c:do_section(3418)
>  Processing section "[cdr]"
>  doing parameter comment = CDR Production Files
>  doing parameter path = /export/CDR
>  doing parameter force user = root
>  doing parameter read only = No
>  doing parameter case sensitive = Yes
>[2003/07/26 13:53:12, 4] param/loadparm.c:lp_load(3930)
>  pm_process() returned Yes
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_ipc(2351)
>  adding IPC service
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_ipc(2351)
>  adding IPC service
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] lib/charcnv.c:charset_name(74)
>  Substituting charset 'ISO-8859-1' for LOCALE
>[2003/07/26 13:53:12, 5] printing/print_cups.c:cups_printer_fn(92)
>  cups_printer_fn(0x807cb9e)
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_printer(2386)
>  adding printer service color
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_printer(2386)
>  adding printer service high
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_printer(2386)
>  adding printer service hpps1000
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_printer(2386)
>  adding printer service lp
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_printer(2386)
>  adding printer service photo
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_printer(2386)
>  adding printer service raw
>[2003/07/26 13:53:12, 2] lib/interface.c:add_interface(79)
>  added interface ip=192.168.1.1 bcast=192.168.1.255 nmask=255.255.255.0
>[2003/07/26 13:53:12, 2] lib/interface.c:add_interface(79)
>  added interface ip=127.0.0.1 bcast=127.255.255.255 nmask=255.0.0.0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_KEEPALIVE = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_REUSEADDR = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_BROADCAST = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option TCP_NODELAY = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option IPTOS_LOWDELAY = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option IPTOS_THROUGHPUT = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_SNDBUF = 16384
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_RCVBUF = 16384
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_SNDLOWAT = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_RCVLOWAT = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_SNDTIMEO = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_RCVTIMEO = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_KEEPALIVE = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_REUSEADDR = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_BROADCAST = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option TCP_NODELAY = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option IPTOS_LOWDELAY = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option IPTOS_THROUGHPUT = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_SNDBUF = 16384
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_RCVBUF = 16384
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_SNDLOWAT = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_RCVLOWAT = 1
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_SNDTIMEO = 0
>[2003/07/26 13:53:12, 5] lib/util_sock.c:print_socket_options(105)
>  socket option SO_RCVTIMEO = 0
>[2003/07/26 13:53:12, 5] lib/hash.c:hash_table_init(67)
>  Hash size = 521.
>[2003/07/26 13:53:12, 5] smbd/connection.c:claim_connection(170)
>  claiming  0
>[2003/07/26 13:53:12, 5] smbd/reply.c:reply_special(136)
>  init msg_type=0x81 msg_flags=0x0
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 1 of length 174
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=170
>  smb_com=0x72
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=0
>  smb_pid=51966
>  smb_uid=102
>  smb_mid=0
>  smt_wct=0
>  smb_bcc=135
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBnegprot (pid 26844)
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 5] smbd/uid.c:change_to_root_user(218)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(455)
>  Requested protocol [PC NETWORK PROGRAM 1.0]
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(455)
>  Requested protocol [XENIX CORE]
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(455)
>  Requested protocol [MICROSOFT NETWORKS 1.03]
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(455)
>  Requested protocol [LANMAN1.0]
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(455)
>  Requested protocol [Windows for Workgroups 3.1a]
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(455)
>  Requested protocol [LM1.2X002]
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(455)
>  Requested protocol [LANMAN2.1]
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(455)
>  Requested protocol [NT LM 0.12]
>[2003/07/26 13:53:12, 5] auth/auth.c:make_auth_context_subsystem(463)
>  Making default auth method list for DC, security=user, encrypt passwords = yes
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend rhosts
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'rhosts'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend hostsequiv
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'hostsequiv'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend sam
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'sam'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend sam_ignoredomain
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'sam_ignoredomain'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend unix
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'unix'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend winbind
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'winbind'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend smbserver
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'smbserver'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend trustdomain
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'trustdomain'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend ntdomain
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'ntdomain'
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(45)
>  Attempting to register auth backend guest
>[2003/07/26 13:53:12, 5] auth/auth.c:smb_register_auth(57)
>  Successfully added auth method 'guest'
>[2003/07/26 13:53:12, 5] auth/auth.c:load_auth_module(370)
>  load_auth_module: Attempting to find an auth method to match guest
>[2003/07/26 13:53:12, 5] auth/auth.c:load_auth_module(395)
>  load_auth_module: auth method guest has a valid init
>[2003/07/26 13:53:12, 5] auth/auth.c:load_auth_module(370)
>  load_auth_module: Attempting to find an auth method to match sam
>[2003/07/26 13:53:12, 5] auth/auth.c:load_auth_module(395)
>  load_auth_module: auth method sam has a valid init
>[2003/07/26 13:53:12, 5] auth/auth.c:load_auth_module(370)
>  load_auth_module: Attempting to find an auth method to match winbind:trustdomain
>[2003/07/26 13:53:12, 5] auth/auth.c:load_auth_module(370)
>  load_auth_module: Attempting to find an auth method to match trustdomain
>[2003/07/26 13:53:12, 5] auth/auth.c:load_auth_module(395)
>  load_auth_module: auth method trustdomain has a valid init
>[2003/07/26 13:53:12, 5] auth/auth.c:load_auth_module(395)
>  load_auth_module: auth method winbind has a valid init
>[2003/07/26 13:53:12, 5] auth/auth.c:get_ntlm_challenge(93)
>  auth_get_challenge: module guest did not want to specify a challenge
>[2003/07/26 13:53:12, 5] auth/auth.c:get_ntlm_challenge(93)
>  auth_get_challenge: module sam did not want to specify a challenge
>[2003/07/26 13:53:12, 5] auth/auth.c:get_ntlm_challenge(93)
>  auth_get_challenge: module winbind did not want to specify a challenge
>[2003/07/26 13:53:12, 5] auth/auth.c:get_ntlm_challenge(132)
>  auth_context challenge created by random
>[2003/07/26 13:53:12, 5] auth/auth.c:get_ntlm_challenge(133)
>  challenge is: 
>[2003/07/26 13:53:12, 5] lib/util.c:dump_data(1887)
>  [000] 10 2C 96 C4 CB C6 47 CE                           .,.ÄËÆGÎ 
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_nt1(323)
>  not using SPNEGO
>[2003/07/26 13:53:12, 3] smbd/negprot.c:reply_negprot(532)
>  Selected protocol NT LM 0.12
>[2003/07/26 13:53:12, 5] smbd/negprot.c:reply_negprot(538)
>  negprot index=7
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=95
>  smb_com=0x72
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=51966
>  smb_uid=102
>  smb_mid=0
>  smt_wct=17
>  smb_vwv[ 0]=    7 (0x7)
>  smb_vwv[ 1]=12803 (0x3203)
>  smb_vwv[ 2]=  256 (0x100)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=   65 (0x41)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  256 (0x100)
>  smb_vwv[ 7]=56320 (0xDC00)
>  smb_vwv[ 8]=  104 (0x68)
>  smb_vwv[ 9]=64768 (0xFD00)
>  smb_vwv[10]=  227 (0xE3)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=27652 (0x6C04)
>  smb_vwv[13]=44939 (0xAF8B)
>  smb_vwv[14]=50003 (0xC353)
>  smb_vwv[15]=26625 (0x6801)
>  smb_vwv[16]= 2049 (0x801)
>  smb_bcc=26
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 2 of length 268
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=264
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=0
>  smb_pid=51966
>  smb_uid=102
>  smb_mid=0
>  smt_wct=13
>  smb_vwv[ 0]=  117 (0x75)
>  smb_vwv[ 1]=  222 (0xDE)
>  smb_vwv[ 2]=16644 (0x4104)
>  smb_vwv[ 3]=   50 (0x32)
>  smb_vwv[ 4]=    1 (0x1)
>  smb_vwv[ 5]=26844 (0x68DC)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=   24 (0x18)
>  smb_vwv[ 8]=   24 (0x18)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=  212 (0xD4)
>  smb_vwv[12]=    0 (0x0)
>  smb_bcc=161
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBsesssetupX (pid 26844)
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 5] smbd/uid.c:change_to_root_user(218)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2003/07/26 13:53:12, 3] smbd/sesssetup.c:reply_sesssetup_and_X(569)
>  wct=13 flg2=0x8003
>[2003/07/26 13:53:12, 3] smbd/sesssetup.c:reply_sesssetup_and_X(676)
>  Domain=[MIDEARTH]  NativeOS=[Windows NT 1381] NativeLanMan=[]
>[2003/07/26 13:53:12, 3] smbd/sesssetup.c:reply_sesssetup_and_X(687)
>  sesssetupX:name=[MIDEARTH]\[Administrator]@[slim]
>[2003/07/26 13:53:12, 4] lib/username.c:map_username(132)
>  Scanning username map /etc/samba/smbusers
>[2003/07/26 13:53:12, 3] lib/username.c:map_username(173)
>  Mapped user Administrator to root
>[2003/07/26 13:53:12, 5] auth/auth_util.c:make_user_info_map(216)
>  make_user_info_map: Mapping user [MIDEARTH]\[Administrator] from workstation [slim]
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 3] smbd/uid.c:push_conn_ctx(287)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 5] passdb/secrets.c:secrets_fetch_trusted_domain_password(299)
>  secrets_fetch failed!
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] libsmb/trustdom_cache.c:trustdom_cache_fetch(172)
>  no entry for trusted domain MIDEARTH found.
>[2003/07/26 13:53:12, 5] auth/auth_util.c:make_user_info(132)
>  attempting to make a user_info for root (Administrator)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:make_user_info(142)
>  making strings for root's user_info struct
>[2003/07/26 13:53:12, 5] auth/auth_util.c:make_user_info(184)
>  making blobs for root's user_info struct
>[2003/07/26 13:53:12, 3] auth/auth.c:check_ntlm_password(216)
>  check_ntlm_password:  Checking password for unmapped user [MIDEARTH]\[Administrator]@[slim] with the new password interface
>[2003/07/26 13:53:12, 3] auth/auth.c:check_ntlm_password(219)
>  check_ntlm_password:  mapped user is: [MIDEARTH]\[root]@[slim]
>[2003/07/26 13:53:12, 5] lib/util.c:dump_data(1887)
>  [000] 10 2C 96 C4 CB C6 47 CE                           .,.ÄËÆGÎ 
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 3] smbd/uid.c:push_conn_ctx(287)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 4] auth/auth_sam.c:sam_password_ok(218)
>  sam_password_ok: Checking NT MD4 password
>[2003/07/26 13:53:12, 4] auth/auth_sam.c:sam_account_ok(324)
>  sam_account_ok: Checking SMB password for user root
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 3] smbd/uid.c:push_conn_ctx(287)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 3 supplementary groups
>  Group[  0]: 0
>  Group[  1]: 0
>  Group[  2]: 71
>[2003/07/26 13:53:12, 3] smbd/uid.c:fetch_sid_from_gid_cache(651)
>  fetch sid from gid cache 0 -> S-1-5-32-544
>[2003/07/26 13:53:12, 5] auth/auth_util.c:make_server_info_sam(815)
>  make_server_info_sam: made server info for user root -> root
>[2003/07/26 13:53:12, 3] auth/auth.c:check_ntlm_password(265)
>  check_ntlm_password: sam authentication for user [Administrator] succeeded
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 3] smbd/uid.c:push_conn_ctx(287)
>  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] auth/auth.c:check_ntlm_password(289)
>  check_ntlm_password:  PAM Account for user [root] succeeded
>[2003/07/26 13:53:12, 2] auth/auth.c:check_ntlm_password(302)
>  check_ntlm_password:  authentication for user [Administrator] -> [root] -> [root] succeeded
>[2003/07/26 13:53:12, 5] auth/auth_util.c:free_user_info(1151)
>  attempting to free (and zero) a user_info structure
>[2003/07/26 13:53:12, 3] smbd/password.c:register_vuid(204)
>  User name: root	Real name: root
>[2003/07/26 13:53:12, 3] smbd/password.c:register_vuid(222)
>  UNIX uid 0 is UNIX user root, and will be vuid 100
>[2003/07/26 13:53:12, 2] smbd/utmp.c:sys_utmp_update(413)
>  utmp_update: uname:/var/run/utmp wname:/var/log/wtmp
>[2003/07/26 13:53:12, 3] smbd/password.c:register_vuid(238)
>  Adding/updating homes service for user 'root' using home directory: '/root'
>[2003/07/26 13:53:12, 3] param/loadparm.c:lp_add_home(2310)
>  adding home's share [root] for user 'root' at '/root'
>[2003/07/26 13:53:12, 3] smbd/process.c:chain_reply(1012)
>  Chained message
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=264
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=0
>  smb_pid=51966
>  smb_uid=100
>  smb_mid=0
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    1 (0x1)
>  smb_bcc=31
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtconX (pid 26844)
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 5] smbd/uid.c:change_to_root_user(218)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2003/07/26 13:53:12, 4] smbd/reply.c:reply_tcon_and_X(260)
>  Client requested device type [IPC] for share [IPC$]
>[2003/07/26 13:53:12, 5] smbd/service.c:make_connection(855)
>  making a connection to 'normal' service ipc$
>[2003/07/26 13:53:12, 3] lib/access.c:check_access(314)
>  check_access: no hostnames in host allow/deny list.
>[2003/07/26 13:53:12, 2] lib/access.c:check_access(325)
>  Allowed connection from  (192.168.1.233)
>[2003/07/26 13:53:12, 5] lib/username.c:Get_Pwnam(288)
>  Finding user root
>[2003/07/26 13:53:12, 5] lib/username.c:Get_Pwnam_internals(223)
>  Trying _Get_Pwnam(), username as lowercase is root
>[2003/07/26 13:53:12, 5] lib/username.c:Get_Pwnam_internals(251)
>  Get_Pwnam_internals did find user [root]!
>[2003/07/26 13:53:12, 3] smbd/service.c:make_connection_snum(536)
>  Connect path is '/tmp' for service [IPC$]
>[2003/07/26 13:53:12, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(217)
>  get_share_security: using default secdesc for IPC$
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(267)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(268)
>  se_access_check: user sid is S-1-5-21-1593769616-160655940-3590153233-1000
>  se_access_check: also S-1-5-21-1593769616-160655940-3590153233-512
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>[2003/07/26 13:53:12, 5] lib/util_seaccess.c:se_access_check(325)
>  se_access_check: access (2) granted.
>[2003/07/26 13:53:12, 3] smbd/vfs.c:vfs_init_default(201)
>  Initialising default vfs hooks
>[2003/07/26 13:53:12, 5] smbd/connection.c:claim_connection(170)
>  claiming IPC$ 0
>[2003/07/26 13:53:12, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(217)
>  get_share_security: using default secdesc for IPC$
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(267)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(268)
>  se_access_check: user sid is S-1-5-21-1593769616-160655940-3590153233-1000
>  se_access_check: also S-1-5-21-1593769616-160655940-3590153233-512
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>[2003/07/26 13:53:12, 5] lib/util_seaccess.c:se_access_check(325)
>  se_access_check: access (1) granted.
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-1593769616-160655940-3590153233-1000
>  contains 6 SIDs
>  SID[  0]: S-1-5-21-1593769616-160655940-3590153233-1000
>  SID[  1]: S-1-5-21-1593769616-160655940-3590153233-512
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-32-544
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 3 supplementary groups
>  Group[  0]: 0
>  Group[  1]: 0
>  Group[  2]: 71
>[2003/07/26 13:53:12, 5] smbd/uid.c:change_to_user(203)
>  change_to_user uid=(0,0) gid=(0,0)
>[2003/07/26 13:53:12, 3] smbd/service.c:make_connection_snum(692)
>  slim (192.168.1.233) connect to service IPC$ initially as user root (uid=0, gid=0) (pid 26844)
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 5] smbd/uid.c:change_to_root_user(218)
>  change_to_root_user: now uid=(0,0) gid=(0,0)
>[2003/07/26 13:53:12, 3] smbd/reply.c:reply_tcon_and_X(308)
>  tconX service=IPC$ 
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=116
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=51966
>  smb_uid=100
>  smb_mid=0
>  smt_wct=3
>  smb_vwv[ 0]=  117 (0x75)
>  smb_vwv[ 1]=  100 (0x64)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_bcc=59
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 3 of length 100
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=96
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=64
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]= 2560 (0xA00)
>  smb_vwv[ 3]= 1536 (0x600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_bcc=13
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBntcreateX (pid 26844)
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(491)
>  NT user token of user S-1-5-21-1593769616-160655940-3590153233-1000
>  contains 6 SIDs
>  SID[  0]: S-1-5-21-1593769616-160655940-3590153233-1000
>  SID[  1]: S-1-5-21-1593769616-160655940-3590153233-512
>  SID[  2]: S-1-1-0
>  SID[  3]: S-1-5-2
>  SID[  4]: S-1-5-11
>  SID[  5]: S-1-5-32-544
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 3 supplementary groups
>  Group[  0]: 0
>  Group[  1]: 0
>  Group[  2]: 71
>[2003/07/26 13:53:12, 5] smbd/uid.c:change_to_user(203)
>  change_to_user uid=(0,0) gid=(0,0)
>[2003/07/26 13:53:12, 4] smbd/vfs.c:vfs_ChDir(611)
>  vfs_ChDir to /tmp
>[2003/07/26 13:53:12, 4] smbd/nttrans.c:nt_open_pipe(486)
>  nt_open_pipe: Opening pipe \samr.
>[2003/07/26 13:53:12, 3] smbd/nttrans.c:nt_open_pipe(503)
>  nt_open_pipe: Known pipe samr opening.
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested samr (pipes_open=0)
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(279)
>  Create pipe requested samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(372)
>  Created internal pipe samr (pipes_open=0)
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(258)
>  Opened pipe samr with handle 74f4 (pipes_open=1)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(264)
>  open pipes: name samr pnum=74f4
>[2003/07/26 13:53:12, 5] smbd/nttrans.c:do_ntcreate_pipe_open(551)
>  do_ntcreate_pipe_open: open pipe = \samr
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=64
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=62464 (0xF400)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 4 of length 160
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=128
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29940 (0x74F4)
>  smb_bcc=89
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f4
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f4 (pipes_open=1)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f4)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 0b
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0048
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00680067
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(846)
>  api_pipe_bind_req: decode request. 846
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(857)
>  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_rb 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0000 max_tsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0002 max_rsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 assoc_gid: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0008 num_elements: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000c context_id  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      000e num_syntaxes: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0010 data   : 12345778
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0014 data   : 1234
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0016 data   : abcd
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          0018 data   : ef 00 01 23 45 67 89 ac 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 version: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0024 data   : 8a885d04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0028 data   : 1ceb
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          002a data   : 11c9
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          002c data   : 9f e8 08 00 2b 10 48 60 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0034 version: 00000002
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(987)
>  api_pipe_bind_req: make response. 987
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:check_bind_req(725)
>  check_bind_req for \PIPE\samr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_ba 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0000 max_tsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0002 max_rsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 assoc_gid: 000053f0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 len: 000c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000a str: \PIPE\lsass.
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>          0018 num_results: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          001c result     : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          001e reason     : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 data   : 8a885d04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0024 data   : 1ceb
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0026 data   : 11c9
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          0028 data   : 9f e8 08 00 2b 10 48 60 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0030 version: 00000002
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 0c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0044
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00680067
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=128
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 5 of length 164
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=160
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=192
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   76 (0x4C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   76 (0x4C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29940 (0x74F4)
>  smb_bcc=93
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=76 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f4
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f4 (pipes_open=1)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f4)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 004c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000044
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000034
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0007
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x7 - api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_open_domain 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000020
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: a6 db 22 3f c7 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0014 flags: 00000200
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0018 num_auths: 00000004
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001c sid_rev_num: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001d num_auths  : 04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001e id_auth[0] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001f id_auth[1] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0020 id_auth[2] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0021 id_auth[3] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0022 id_auth[4] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0023 id_auth[5] : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32s(861)
>              0024 sub_auths : 00000015 5efefe90 09936a44 d5fd6411 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(170)
>  Policy not found: [000] 00 00 00 00 20 00 00 00  00 00 00 00 A6 DB 22 3F  .... ... ....¦Û"?
>  [010] C7 68 00 00                                       Çh.. 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_open_domain 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_INVALID_HANDLE
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1499)
>  api_rpcTNP: bad handle fault return.
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 23
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0020
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000044
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000018 smb_io_rpc_hdr_fault fault
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0018 status  : NT code 0x1c00001a
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      001c reserved: 00000000
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..32]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=88
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=192
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   32 (0x20)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   32 (0x20)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=33
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 6 of length 46
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=42
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=51966
>  smb_uid=100
>  smb_mid=256
>  smt_wct=3
>  smb_vwv[ 0]=29940 (0x74F4)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBclose (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f4
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f4 (pipes_open=1)
>[2003/07/26 13:53:12, 5] smbd/pipes.c:reply_pipe_close(258)
>  reply_pipe_close: pnum:74f4
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name samr pnum=74f4 (pipes_open=0)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=51966
>  smb_uid=100
>  smb_mid=256
>  smt_wct=0
>  smb_bcc=0
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 7 of length 100
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=96
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=320
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]= 2560 (0xA00)
>  smb_vwv[ 3]= 1536 (0x600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_bcc=13
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBntcreateX (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 4] smbd/nttrans.c:nt_open_pipe(486)
>  nt_open_pipe: Opening pipe \samr.
>[2003/07/26 13:53:12, 3] smbd/nttrans.c:nt_open_pipe(503)
>  nt_open_pipe: Known pipe samr opening.
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested samr (pipes_open=0)
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(279)
>  Create pipe requested samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(372)
>  Created internal pipe samr (pipes_open=0)
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(258)
>  Opened pipe samr with handle 74f5 (pipes_open=1)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(264)
>  open pipes: name samr pnum=74f5
>[2003/07/26 13:53:12, 5] smbd/nttrans.c:do_ntcreate_pipe_open(551)
>  do_ntcreate_pipe_open: open pipe = \samr
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=320
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=62720 (0xF500)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 8 of length 160
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=384
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29941 (0x74F5)
>  smb_bcc=89
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f5
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f5 (pipes_open=1)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f5)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 0b
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0048
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000043
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(846)
>  api_pipe_bind_req: decode request. 846
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(857)
>  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_rb 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0000 max_tsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0002 max_rsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 assoc_gid: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0008 num_elements: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000c context_id  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      000e num_syntaxes: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0010 data   : 12345778
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0014 data   : 1234
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0016 data   : abcd
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          0018 data   : ef 00 01 23 45 67 89 ac 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 version: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0024 data   : 8a885d04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0028 data   : 1ceb
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          002a data   : 11c9
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          002c data   : 9f e8 08 00 2b 10 48 60 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0034 version: 00000002
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(987)
>  api_pipe_bind_req: make response. 987
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:check_bind_req(725)
>  check_bind_req for \PIPE\samr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_ba 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0000 max_tsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0002 max_rsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 assoc_gid: 000053f0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 len: 000c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000a str: \PIPE\lsass.
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>          0018 num_results: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          001c result     : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          001e reason     : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 data   : 8a885d04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0024 data   : 1ceb
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0026 data   : 11c9
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          0028 data   : 9f e8 08 00 2b 10 48 60 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0030 version: 00000002
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 0c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0044
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000043
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=384
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 9 of length 132
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=448
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29941 (0x74F5)
>  smb_bcc=61
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f5
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f5 (pipes_open=1)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f5)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 002c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000045
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000014
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0001
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_close_hnd 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000020
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: a6 db 22 3f c7 68 00 00 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(170)
>  Policy not found: [000] 00 00 00 00 20 00 00 00  00 00 00 00 A6 DB 22 3F  .... ... ....¦Û"?
>  [010] C7 68 00 00                                       Çh.. 
>[2003/07/26 13:53:12, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(196)
>  Error closing policy
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_close_hnd 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OBJECT_NAME_INVALID
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1499)
>  api_rpcTNP: bad handle fault return.
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 23
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0020
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000045
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000018 smb_io_rpc_hdr_fault fault
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0018 status  : NT code 0x1c00001a
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      001c reserved: 00000000
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..32]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=88
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=448
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   32 (0x20)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   32 (0x20)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=33
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 10 of length 46
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=42
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=51966
>  smb_uid=100
>  smb_mid=512
>  smt_wct=3
>  smb_vwv[ 0]=29941 (0x74F5)
>  smb_vwv[ 1]=65535 (0xFFFF)
>  smb_vwv[ 2]=65535 (0xFFFF)
>  smb_bcc=0
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBclose (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f5
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f5 (pipes_open=1)
>[2003/07/26 13:53:12, 5] smbd/pipes.c:reply_pipe_close(258)
>  reply_pipe_close: pnum:74f5
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1081)
>  closed pipe name samr pnum=74f5 (pipes_open=0)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=51966
>  smb_uid=100
>  smb_mid=512
>  smt_wct=0
>  smb_bcc=0
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 11 of length 100
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=96
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=576
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]= 2560 (0xA00)
>  smb_vwv[ 3]= 1536 (0x600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_bcc=13
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBntcreateX (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 4] smbd/nttrans.c:nt_open_pipe(486)
>  nt_open_pipe: Opening pipe \samr.
>[2003/07/26 13:53:12, 3] smbd/nttrans.c:nt_open_pipe(503)
>  nt_open_pipe: Known pipe samr opening.
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested samr (pipes_open=0)
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(279)
>  Create pipe requested samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(372)
>  Created internal pipe samr (pipes_open=0)
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(258)
>  Opened pipe samr with handle 74f6 (pipes_open=1)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(264)
>  open pipes: name samr pnum=74f6
>[2003/07/26 13:53:12, 5] smbd/nttrans.c:do_ntcreate_pipe_open(551)
>  do_ntcreate_pipe_open: open pipe = \samr
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=576
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=62976 (0xF600)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 12 of length 160
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=640
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=89
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=1)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 0b
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0048
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000045
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(846)
>  api_pipe_bind_req: decode request. 846
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(857)
>  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_rb 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0000 max_tsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0002 max_rsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 assoc_gid: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0008 num_elements: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000c context_id  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      000e num_syntaxes: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0010 data   : 12345778
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0014 data   : 1234
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0016 data   : abcd
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          0018 data   : ef 00 01 23 45 67 89 ac 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 version: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0024 data   : 8a885d04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0028 data   : 1ceb
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          002a data   : 11c9
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          002c data   : 9f e8 08 00 2b 10 48 60 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0034 version: 00000002
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(987)
>  api_pipe_bind_req: make response. 987
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:check_bind_req(725)
>  check_bind_req for \PIPE\samr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_ba 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0000 max_tsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0002 max_rsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 assoc_gid: 000053f0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 len: 000c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000a str: \PIPE\lsass.
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>          0018 num_results: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          001c result     : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          001e reason     : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 data   : 8a885d04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0024 data   : 1ceb
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0026 data   : 11c9
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          0028 data   : 9f e8 08 00 2b 10 48 60 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0030 version: 00000002
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 0c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0044
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000045
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=640
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 13 of length 148
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=144
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=704
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   60 (0x3C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=77
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=60 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=1)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 003c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000046
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000024
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0039
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x39 - api_rpcTNP: rpc command: SAMR_CONNECT
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_connect 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 ptr_srv_name: 00139c30
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 uni_max_len: 00000008
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0008 undoc      : 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          000c uni_str_len: 00000008
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:dbg_rw_punival(806)
>          0010 buffer     : \.\.F.R.O.D.O...
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0020 access_mask: 00000020
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_connect(2413)
>  _samr_connect: 2413
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(267)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(268)
>  se_access_check: user sid is S-1-5-21-1593769616-160655940-3590153233-1000
>  se_access_check: also S-1-5-21-1593769616-160655940-3590153233-512
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>[2003/07/26 13:53:12, 5] lib/util_seaccess.c:se_access_check(325)
>  se_access_check: access (20) granted.
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_connect(2444)
>  _samr_connect: 2444
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_connect 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 748
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000046
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=704
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 14 of length 104
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=100
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=768
>  smt_wct=24
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]= 3584 (0xE00)
>  smb_vwv[ 3]= 1536 (0x600)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=40704 (0x9F00)
>  smb_vwv[ 8]=  513 (0x201)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=  768 (0x300)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=  256 (0x100)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=  512 (0x200)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_bcc=17
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBntcreateX (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 4] smbd/nttrans.c:nt_open_pipe(486)
>  nt_open_pipe: Opening pipe \lsarpc.
>[2003/07/26 13:53:12, 3] smbd/nttrans.c:nt_open_pipe(503)
>  nt_open_pipe: Known pipe lsarpc opening.
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(178)
>  Open pipe requested lsarpc (pipes_open=1)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(205)
>  open_rpc_pipe_p: name samr pnum=74f6
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(279)
>  Create pipe requested lsarpc
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(372)
>  Created internal pipe lsarpc (pipes_open=1)
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(258)
>  Opened pipe lsarpc with handle 74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(264)
>  open pipes: name lsarpc pnum=74f7
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(264)
>  open pipes: name samr pnum=74f6
>[2003/07/26 13:53:12, 5] smbd/nttrans.c:do_ntcreate_pipe_open(551)
>  do_ntcreate_pipe_open: open pipe = \lsarpc
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=768
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=63232 (0xF700)
>  smb_vwv[ 3]=  372 (0x174)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 15 of length 160
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=156
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=832
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29943 (0x74F7)
>  smb_bcc=89
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=72 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f7
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "lsarpc" (pnum 74f7)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 0b
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0048
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000044
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(846)
>  api_pipe_bind_req: decode request. 846
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(857)
>  api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_rb 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0000 max_tsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0002 max_rsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 assoc_gid: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0008 num_elements: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000c context_id  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      000e num_syntaxes: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0010 data   : 12345778
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0014 data   : 1234
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0016 data   : abcd
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          0018 data   : ef 00 01 23 45 67 89 ab 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 version: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0024 data   : 8a885d04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0028 data   : 1ceb
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          002a data   : 11c9
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          002c data   : 9f e8 08 00 2b 10 48 60 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0034 version: 00000002
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(987)
>  api_pipe_bind_req: make response. 987
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:check_bind_req(725)
>  check_bind_req for \PIPE\lsarpc
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_ba 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0000 max_tsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0002 max_rsize: 1630
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 assoc_gid: 000053f0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 len: 000c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000a str: \PIPE\lsass.
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>          0018 num_results: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          001c result     : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          001e reason     : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 data   : 8a885d04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0024 data   : 1ceb
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0026 data   : 11c9
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          0028 data   : 9f e8 08 00 2b 10 48 60 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0030 version: 00000002
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 0c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0044
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000044
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..68]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=832
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 16 of length 172
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=168
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=896
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   84 (0x54)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   84 (0x54)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29943 (0x74F7)
>  smb_bcc=101
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=84 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f7
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "lsarpc" (pnum 74f7)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0054
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000013
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 0000003c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 002c
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\lsarpc
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\lsarpc
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 lsa_io_q_open_pol2 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 ptr       : 00139c30
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 uni_max_len: 00000008
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0008 undoc      : 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          000c uni_str_len: 00000008
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:dbg_rw_punival(806)
>          0010 buffer     : \.\.F.R.O.D.O...
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0020 len         : 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0024 ptr_root_dir: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0028 ptr_obj_name: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          002c attributes  : 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0030 ptr_sec_desc: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0034 ptr_sec_qos : 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0038 des_access: 00000001
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(267)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(268)
>  se_access_check: user sid is S-1-5-21-1593769616-160655940-3590153233-1000
>  se_access_check: also S-1-5-21-1593769616-160655940-3590153233-512
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>[2003/07/26 13:53:12, 5] lib/util_seaccess.c:se_access_check(325)
>  se_access_check: access (1) granted.
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[2] [000] 00 00 00 00 02 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 lsa_io_r_open_pol2 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000002
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called lsarpc successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 816
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000013
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=896
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 17 of length 134
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=130
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=960
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   46 (0x2E)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   46 (0x2E)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29943 (0x74F7)
>  smb_bcc=63
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=46 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f7
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "lsarpc" (pnum 74f7)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 002e
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000014
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000016
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0007
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\lsarpc
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\lsarpc
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: lsarpc op 0x7 - api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 lsa_io_q_query 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000002
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 info_class: 0005
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 lsa_io_r_query 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 undoc_buffer: 22000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 info_class: 0005
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 uni_dom_max_len: 0010
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a uni_dom_str_len: 0012
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          000c buffer_dom_name: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0010 buffer_dom_sid : 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>              0014 uni_max_len: 00000009
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>              0018 undoc      : 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>              001c uni_str_len: 00000008
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:dbg_rw_punival(806)
>              0020 buffer     : M.I.D.E.A.R.T.H.
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>              0030 num_auths: 00000004
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>                  0034 sid_rev_num: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>                  0035 num_auths  : 04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>                  0036 id_auth[0] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>                  0037 id_auth[1] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>                  0038 id_auth[2] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>                  0039 id_auth[3] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>                  003a id_auth[4] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>                  003b id_auth[5] : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32s(861)
>                  003c sub_auths : 00000015 5efefe90 09936a44 d5fd6411 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      004c status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called lsarpc successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 512
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0068
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000014
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000050
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..104]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=160
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=960
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  104 (0x68)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  104 (0x68)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=105
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 18 of length 132
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1024
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29943 (0x74F7)
>  smb_bcc=61
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f7
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "lsarpc" (pnum 74f7)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 002c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000015
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000014
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0000
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\lsarpc
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\lsarpc
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 lsa_io_q_close 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000002
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 02 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 lsa_io_r_close 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called lsarpc successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000015
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1024
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 19 of length 164
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=160
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1088
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   76 (0x4C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   76 (0x4C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=93
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=76 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 004c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000047
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000034
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0007
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x7 - api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_open_domain 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0014 flags: 00000200
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0018 num_auths: 00000004
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001c sid_rev_num: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001d num_auths  : 04
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001e id_auth[0] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001f id_auth[1] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0020 id_auth[2] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0021 id_auth[3] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0022 id_auth[4] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0023 id_auth[5] : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32s(861)
>              0024 sub_auths : 00000015 5efefe90 09936a44 d5fd6411 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 01 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(106)
>  _samr_open_domain: access check ((granted: 0x00000020;  required: 0x00000020)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(267)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(268)
>  se_access_check: user sid is S-1-5-21-1593769616-160655940-3590153233-1000
>  se_access_check: also S-1-5-21-1593769616-160655940-3590153233-512
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>[2003/07/26 13:53:12, 5] lib/util_seaccess.c:se_access_check(325)
>  se_access_check: access (200) granted.
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[2] [000] 00 00 00 00 03 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_open_domain(403)
>  samr_open_domain: 403
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_open_domain 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000003
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 732
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000047
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1088
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 20 of length 152
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=148
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1152
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   64 (0x40)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   64 (0x40)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=81
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=64 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0040
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000048
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000028
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0007
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x7 - api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_open_domain 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0014 flags: 00000200
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0018 num_auths: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001c sid_rev_num: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001d num_auths  : 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001e id_auth[0] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001f id_auth[1] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0020 id_auth[2] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0021 id_auth[3] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0022 id_auth[4] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0023 id_auth[5] : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32s(861)
>              0024 sub_auths : 00000020 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[1] [000] 00 00 00 00 01 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(106)
>  _samr_open_domain: access check ((granted: 0x00000020;  required: 0x00000020)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(267)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(268)
>  se_access_check: user sid is S-1-5-21-1593769616-160655940-3590153233-1000
>  se_access_check: also S-1-5-21-1593769616-160655940-3590153233-512
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>[2003/07/26 13:53:12, 5] lib/util_seaccess.c:se_access_check(325)
>  se_access_check: access (200) granted.
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[3] [000] 00 00 00 00 04 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_open_domain(403)
>  samr_open_domain: 403
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_open_domain 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000004
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 732
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000048
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1152
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 21 of length 176
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=172
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1216
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   88 (0x58)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   88 (0x58)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=105
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=88 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0058
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000049
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000040
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0011
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x11 - api_rpcTNP: rpc command: SAMR_LOOKUP_NAMES
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_lookup_names 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000003
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0014 num_names1: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0018 flags     : 000003e8
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      001c ptr       : 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0020 num_names2: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0024 uni_str_len: 0008
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0026 uni_max_len: 000a
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0028 buffer     : 0012ed5c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          002c uni_max_len: 00000005
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0030 undoc      : 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0034 uni_str_len: 00000004
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:dbg_rw_punival(806)
>          0038 buffer     : j.o.e.u.
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_lookup_names(1447)
>  _samr_lookup_names: 1447
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[1] [000] 00 00 00 00 03 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(106)
>  _samr_lookup_names: access check ((granted: 0x00000200;  required: 0000000000)
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_lookup_names(1466)
>  _samr_lookup_names: looking name on SID S-1-5-21-1593769616-160655940-3590153233
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 3] smbd/uid.c:push_conn_ctx(287)
>  push_conn_ctx(100) : conn_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 4] lib/username.c:map_username(132)
>  Scanning username map /etc/samba/smbusers
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
>[2003/07/26 13:53:12, 3] smbd/uid.c:push_conn_ctx(287)
>  push_conn_ctx(100) : conn_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_samr.c:init_samr_r_lookup_names(4751)
>  init_samr_r_lookup_names
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_lookup_names(1509)
>  _samr_lookup_names: 1509
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_lookup_names 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 num_rids1: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0004 ptr_rids : 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0008 num_rids2: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c rid[00]  : 000007e4
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 num_types1: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0014 ptr_types : 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0018 num_types2: 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      001c type[00]  : 00000001
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0020 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 42
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 003c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 00000049
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000024
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..60]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=116
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1216
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   60 (0x3C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   60 (0x3C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=61
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 22 of length 140
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=136
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1280
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   52 (0x34)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   52 (0x34)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=69
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=52 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0034
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004a
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 0000001c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0022
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x22 - api_rpcTNP: rpc command: SAMR_OPEN_USER
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_open_user 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000003
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0014 access_mask: 00010000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0018 user_rid : 000007e4
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[1] [000] 00 00 00 00 03 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(106)
>  _samr_open_user: access check ((granted: 0x00000200;  required: 0x00000200)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(267)
>[2003/07/26 13:53:12, 3] lib/util_seaccess.c:se_access_check(268)
>  se_access_check: user sid is S-1-5-21-1593769616-160655940-3590153233-1000
>  se_access_check: also S-1-5-21-1593769616-160655940-3590153233-512
>  se_access_check: also S-1-1-0
>  se_access_check: also S-1-5-2
>  se_access_check: also S-1-5-11
>  se_access_check: also S-1-5-32-544
>[2003/07/26 13:53:12, 5] lib/util_seaccess.c:se_access_check(325)
>  se_access_check: access (10000) granted.
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:push_sec_ctx(256)
>  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 3] smbd/uid.c:push_conn_ctx(287)
>  push_conn_ctx(100) : conn_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:53:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:53:12, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
>  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142)
>  Opened policy hnd[4] [000] 00 00 00 00 05 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_open_user 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000005
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 1339
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004a
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1280
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 23 of length 164
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=160
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1344
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   76 (0x4C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   76 (0x4C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=93
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=76 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 004c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004b
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000034
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 002d
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x2d - api_rpcTNP: rpc command: SAMR_UNKNOWN_2D
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_unknown_2d 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000004
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0014 num_auths: 00000005
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0018 sid_rev_num: 01
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              0019 num_auths  : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001a id_auth[0] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001b id_auth[1] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001c id_auth[2] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001d id_auth[3] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001e id_auth[4] : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>              001f id_auth[5] : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32s(861)
>              0020 sub_auths : 00000015 5efefe90 09936a44 d5fd6411 000007e4 
>[2003/07/26 13:53:12, 0] rpc_server/srv_samr_nt.c:_samr_unknown_2d(4278)
>  _samr_unknown_2d: Not yet implemented.
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_unknown_2d 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0000 status: NT_STATUS_NOT_IMPLEMENTED
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 001c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004b
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000004
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..28]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=84
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1344
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   28 (0x1C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   28 (0x1C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=29
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 24 of length 132
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1408
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=61
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 002c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004c
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000014
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0001
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_close_hnd 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000005
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 05 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(356)
>  samr_reply_close_hnd: 356
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_close_hnd 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1408
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 25 of length 132
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1472
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=61
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 002c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004d
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000014
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0001
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_close_hnd 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000003
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[1] [000] 00 00 00 00 03 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(356)
>  samr_reply_close_hnd: 356
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_close_hnd 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004d
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1472
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:53:12, 3] smbd/process.c:process_smb(881)
>  Transaction 26 of length 132
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=24
>  smb_flg2=32771
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1536
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   44 (0x2C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   84 (0x54)
>  smb_vwv[11]=   44 (0x2C)
>  smb_vwv[12]=   84 (0x54)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=29942 (0x74F6)
>  smb_bcc=61
>[2003/07/26 13:53:12, 3] smbd/process.c:switch_message(676)
>  switch message SMBtrans (pid 26844)
>[2003/07/26 13:53:12, 4] smbd/uid.c:change_to_user(122)
>  change_to_user: Skipping user change - already user
>[2003/07/26 13:53:12, 3] smbd/ipc.c:reply_trans(512)
>  trans <\PIPE\> data=44 params=0 setup=2
>[2003/07/26 13:53:12, 5] smbd/ipc.c:reply_trans(531)
>  calling named_pipe
>[2003/07/26 13:53:12, 3] smbd/ipc.c:named_pipe(326)
>  named pipe command on <> name
>[2003/07/26 13:53:12, 5] smbd/ipc.c:api_fd_reply(267)
>  api_fd_reply
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1149)
>  search for pipe pnum=74f6
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name lsarpc pnum=74f7 (pipes_open=2)
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1153)
>  pipe name samr pnum=74f6 (pipes_open=2)
>[2003/07/26 13:53:12, 3] smbd/ipc.c:api_fd_reply(288)
>  Got API command 0x26 on pipe "samr" (pnum 74f6)000000 smb_io_rpc_hdr 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 002c
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004e
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(488)
>  unmarshall_rpc_header: using little-endian RPC
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr_req req
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0000 alloc_hint: 00000014
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0004 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0006 opnum     : 0001
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_pipe_request(1413)
>  Requested \PIPE\samr
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe.c:api_pipe_request(1418)
>  Doing \PIPE\samr
>[2003/07/26 13:53:12, 4] rpc_server/srv_pipe.c:api_rpcTNP(1464)
>  api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_q_close_hnd 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000004
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 28 dc 22 3f dc 68 00 00 
>[2003/07/26 13:53:12, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162)
>  Found policy hnd[0] [000] 00 00 00 00 04 00 00 00  00 00 00 00 28 DC 22 3F  ........ ....(Ü"?
>  [010] DC 68 00 00                                       Üh.. 
>[2003/07/26 13:53:12, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
>  Closed policy
>[2003/07/26 13:53:12, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(356)
>  samr_reply_close_hnd: 356
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 samr_io_r_close_hnd 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0000 data1: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>          0004 data2: 00000000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          0008 data3: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>          000a data4: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8s(721)
>          000c data5: 00 00 00 00 00 00 00 00 
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_ntstatus(664)
>      0014 status: NT_STATUS_OK
>[2003/07/26 13:53:12, 5] rpc_server/srv_pipe.c:api_rpcTNP(1511)
>  api_rpcTNP: called samr successfully
>[2003/07/26 13:53:12, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
>  free_pipe_context: destroying talloc pool of size 0
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000000 smb_io_rpc_hdr hdr
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0000 major     : 05
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0001 minor     : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0002 pkt_type  : 02
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0003 flags     : 03
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0004 pack_type0: 10
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0005 pack_type1: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0006 pack_type2: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0007 pack_type3: 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0008 frag_len  : 0030
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      000a auth_len  : 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      000c call_id   : 0000004e
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_debug(81)
>  000010 smb_io_rpc_hdr_resp resp
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint32(634)
>      0010 alloc_hint: 00000018
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint16(605)
>      0014 context_id: 0000
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0016 cancel_ct : 00
>[2003/07/26 13:53:12, 5] rpc_parse/parse_prs.c:prs_uint8(576)
>      0017 reserved  : 00
>[2003/07/26 13:53:12, 5] smbd/ipc.c:copy_trans_params_and_data(62)
>  copy_trans_params_and_data: params[0..0] data[0..48]
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(456)
>[2003/07/26 13:53:12, 5] lib/util.c:show_msg(466)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=50208
>  smb_uid=100
>  smb_mid=1536
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2003/07/26 13:54:12, 3] smbd/sec_ctx.c:set_sec_ctx(288)
>  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
>[2003/07/26 13:54:12, 5] auth/auth_util.c:debug_nt_user_token(486)
>  NT user token: (NULL)
>[2003/07/26 13:54:12, 5] auth/auth_util.c:debug_unix_user_token(505)
>  UNIX token of user 0
>  Primary group is 0 and contains 0 supplementary groups
>[2003/07/26 13:54:12, 5] smbd/uid.c:change_to_root_user(218)
>  change_to_root_user: now uid=(0,0) gid=(0,0)

Actions: View

Attachments on bug 252: 57 | 58 | 292