[2011/03/03 16:52:45.597283, 0] lib/util_sock.c:1432(get_peer_addr_internal) getpeername failed. Error was Transport endpoint is not connected [2011/03/03 16:52:45.599005, 0] lib/util_sock.c:675(write_data) [2011/03/03 16:52:45.599039, 0] lib/util_sock.c:1432(get_peer_addr_internal) getpeername failed. Error was Transport endpoint is not connected write_data: write failure in writing to client 0.0.0.0. Error Connection reset by peer [2011/03/03 16:52:45.599057, 0] smbd/process.c:79(srv_send_smb) Error writing 4 bytes to client. -1. (Transport endpoint is not connected) [2011/03/03 16:52:46.797194, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.797194, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.797194, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c8e (19598) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.797194, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.797194, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.797194, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c8d (19597) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.797194, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.797194, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.797194, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c8c (19596) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.797194, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.797194, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.797194, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c8b (19595) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.797194, 10] ../lib/util/util.c:278(_dump_data) [2011/03/03 16:52:46.797194, 5] lib/debug.c:405(debug_dump_status) [0000] 31 30 00 10. INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 [2011/03/03 16:52:46.797194, 10] lib/messages_local.c:234(messaging_tdb_store) rpc_cli: False/0 messaging_tdb_store: passdb: False/0 sam: False/0 auth: False/0 [2011/03/03 16:52:46.797194, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) winbind: False/0 array: struct messaging_array vfs: False/0 num_messages : 0x00000001 (1) idmap: False/0 messages: ARRAY(1) quota: False/0 messages: struct messaging_rec acls: False/0 msg_version : 0x00000002 (2) locking: False/0 msdfs: False/0 dmapi: False/0 msg_type : MSG_DEBUG (1) registry: False/0 dest: struct server_id id : 0x00004c8a (19594) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.797194, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.797194, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.797194, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c89 (19593) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.797194, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.797194, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.797194, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c88 (19592) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.797194, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.798404, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.798420, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c86 (19590) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.798396, 5] lib/debug.c:405(debug_dump_status) [2011/03/03 16:52:46.798482, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 [2011/03/03 16:52:46.798722, 10] lib/messages_local.c:234(messaging_tdb_store) smb: False/0 messaging_tdb_store: rpc_parse: False/0 rpc_srv: False/0 [2011/03/03 16:52:46.798743, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array rpc_cli: False/0 num_messages : 0x00000001 (1) passdb: False/0 messages: ARRAY(1) sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 messages: struct messaging_rec idmap: False/0 msg_version : 0x00000002 (2) quota: False/0 msg_type : MSG_DEBUG (1) acls: False/0 dest: struct server_id locking: False/0 id : 0x00004c84 (19588) msdfs: False/0 vnn : 0xffffffff (4294967295) dmapi: False/0 src: struct server_id registry: False/0 id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.798874, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.798881, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.798881, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c82 (19586) vnn : 0xffffffff (4294967295) src: struct server_id [2011/03/03 16:52:46.798881, 5] lib/debug.c:405(debug_dump_status) id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 [2011/03/03 16:52:46.798881, 10] ../lib/util/util.c:278(_dump_data) auth: False/0 [0000] 31 30 00 10. winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.798881, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.798881, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) [2011/03/03 16:52:46.798881, 5] lib/debug.c:405(debug_dump_status) dest: struct server_id id : 0x00004c81 (19585) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) INFO: Current debug levels: vnn : 0xffffffff (4294967295) all: True/10 buf : DATA_BLOB length=3 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 [2011/03/03 16:52:46.798881, 10] ../lib/util/util.c:278(_dump_data) vfs: False/0 idmap: False/0 [0000] 31 30 00 10. quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.798881, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.798881, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c80 (19584) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.798881, 10] ../lib/util/util.c:278(_dump_data) [2011/03/03 16:52:46.798881, 5] lib/debug.c:405(debug_dump_status) [0000] 31 30 00 10. INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 [2011/03/03 16:52:46.798881, 10] lib/messages_local.c:234(messaging_tdb_store) lanman: False/0 messaging_tdb_store: smb: False/0 rpc_parse: False/0 rpc_srv: False/0 [2011/03/03 16:52:46.798881, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) rpc_cli: False/0 array: struct messaging_array passdb: False/0 num_messages : 0x00000001 (1) sam: False/0 messages: ARRAY(1) auth: False/0 messages: struct messaging_rec winbind: False/0 msg_version : 0x00000002 (2) vfs: False/0 msg_type : MSG_DEBUG (1) idmap: False/0 dest: struct server_id quota: False/0 id : 0x00004c7f (19583) acls: False/0 vnn : 0xffffffff (4294967295) locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.799908, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.800014, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.800107, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.803972, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 [2011/03/03 16:52:46.804012, 5] lib/debug.c:405(debug_dump_status) passdb: False/0 sam: False/0 auth: False/0 INFO: Current debug levels: winbind: False/0 all: True/10 vfs: False/0 [2011/03/03 16:52:46.804007, 5] lib/debug.c:405(debug_dump_status) tdb: False/0 idmap: False/0 printdrivers: False/0 quota: False/0 INFO: Current debug levels: lanman: False/0 acls: False/0 smb: False/0 all: True/10 rpc_parse: False/0 tdb: False/0 rpc_srv: False/0 locking: False/0 rpc_cli: False/0 printdrivers: False/0 passdb: False/0 lanman: False/0 sam: False/0 msdfs: False/0 smb: False/0 auth: False/0 dmapi: False/0 winbind: False/0 rpc_parse: False/0 registry: False/0 vfs: False/0 rpc_srv: False/0 idmap: False/0 rpc_cli: False/0 quota: False/0 passdb: False/0 acls: False/0 locking: False/0 sam: False/0 msdfs: False/0 auth: False/0 dmapi: False/0 winbind: False/0 registry: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.802888, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.804406, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.804420, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c7e (19582) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.804594, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.804727, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.804884, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.804476, 5] lib/debug.c:405(debug_dump_status) [2011/03/03 16:52:46.805047, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.805064, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array INFO: Current debug levels: num_messages : 0x00000001 (1) messages: ARRAY(1) all: True/10 messages: struct messaging_rec tdb: False/0 msg_version : 0x00000002 (2) printdrivers: False/0 lanman: False/0 msg_type : MSG_DEBUG (1) smb: False/0 dest: struct server_id rpc_parse: False/0 id : 0x00004c7d (19581) rpc_srv: False/0 vnn : 0xffffffff (4294967295) rpc_cli: False/0 src: struct server_id passdb: False/0 id : 0x00001297 (4759) sam: False/0 vnn : 0xffffffff (4294967295) auth: False/0 buf : DATA_BLOB length=3 winbind: False/0 vfs: False/0 idmap: False/0 [2011/03/03 16:52:46.805161, 10] ../lib/util/util.c:278(_dump_data) quota: False/0 [0000] 31 30 00 10. acls: False/0 locking: False/0 [2011/03/03 16:52:46.805217, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.805231, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c7c (19580) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.805290, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.805347, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.805361, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c7b (19579) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.805436, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.805416, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 [2011/03/03 16:52:46.805470, 10] lib/messages_local.c:234(messaging_tdb_store) tdb: False/0 messaging_tdb_store: printdrivers: False/0 lanman: False/0 smb: False/0 [2011/03/03 16:52:46.805485, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array rpc_parse: False/0 num_messages : 0x00000001 (1) rpc_srv: False/0 messages: ARRAY(1) rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 messages: struct messaging_rec winbind: False/0 msg_version : 0x00000002 (2) vfs: False/0 msg_type : MSG_DEBUG (1) idmap: False/0 dest: struct server_id quota: False/0 id : 0x00004c7a (19578) acls: False/0 vnn : 0xffffffff (4294967295) locking: False/0 src: struct server_id msdfs: False/0 id : 0x00001297 (4759) dmapi: False/0 vnn : 0xffffffff (4294967295) registry: False/0 buf : DATA_BLOB length=3 [2011/03/03 16:52:46.805567, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. msdfs: False/0 [2011/03/03 16:52:46.805532, 5] lib/debug.c:405(debug_dump_status) [2011/03/03 16:52:46.805619, 10] lib/messages_local.c:234(messaging_tdb_store) [2011/03/03 16:52:46.805807, 5] lib/debug.c:405(debug_dump_status) [2011/03/03 16:52:46.805937, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 INFO: Current debug levels: auth: False/0 winbind: False/0 all: True/10 vfs: False/0 tdb: False/0 idmap: False/0 INFO: Current debug levels: quota: False/0 printdrivers: False/0 acls: False/0 all: True/10 locking: False/0 tdb: False/0 msdfs: False/0 printdrivers: False/0 dmapi: False/0 lanman: False/0 registry: False/0 smb: False/0 lanman: False/0 rpc_parse: False/0 smb: False/0 rpc_srv: False/0 rpc_parse: False/0 rpc_cli: False/0 rpc_srv: False/0 passdb: False/0 rpc_cli: False/0 sam: False/0 passdb: False/0 auth: False/0 sam: False/0 winbind: False/0 auth: False/0 vfs: False/0 winbind: False/0 idmap: False/0 vfs: False/0 quota: False/0 idmap: False/0 acls: False/0 quota: False/0 locking: False/0 acls: False/0 msdfs: False/0 locking: False/0 dmapi: False/0 msdfs: False/0 registry: False/0 dmapi: False/0 registry: False/0 messaging_tdb_store: dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.806334, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c79 (19577) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.806465, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.806523, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.806536, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c78 (19576) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.806629, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.806860, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.806983, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.807209, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.807236, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c77 (19575) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.807327, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.807631, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.807870, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.807918, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c76 (19574) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.807979, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.808291, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.808483, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.808499, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c75 (19573) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.808573, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.808643, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.808657, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c74 (19572) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.808725, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.808807, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.808923, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.809162, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.809176, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c73 (19571) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.809244, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.809522, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.809679, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.809693, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c72 (19570) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.809766, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.809952, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.810161, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.810175, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c71 (19569) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.810258, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.810468, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.810659, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.810673, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c70 (19568) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.810741, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.810920, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.811320, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.811334, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c6f (19567) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.811407, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.811593, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.811752, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.811766, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c6e (19566) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.811846, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.811896, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.811917, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c6d (19565) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.811976, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.812016, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.812029, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c6c (19564) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.812087, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.812058, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 [2011/03/03 16:52:46.812139, 10] lib/messages_local.c:234(messaging_tdb_store) smb: False/0 messaging_tdb_store: rpc_parse: False/0 rpc_srv: False/0 [2011/03/03 16:52:46.812164, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) rpc_cli: False/0 array: struct messaging_array passdb: False/0 num_messages : 0x00000001 (1) sam: False/0 messages: ARRAY(1) auth: False/0 messages: struct messaging_rec winbind: False/0 msg_version : 0x00000002 (2) vfs: False/0 msg_type : MSG_DEBUG (1) idmap: False/0 dest: struct server_id quota: False/0 id : 0x00004c6b (19563) acls: False/0 vnn : 0xffffffff (4294967295) locking: False/0 src: struct server_id msdfs: False/0 id : 0x00001297 (4759) dmapi: False/0 vnn : 0xffffffff (4294967295) registry: False/0 buf : DATA_BLOB length=3 [2011/03/03 16:52:46.812338, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.812308, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.812507, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 [2011/03/03 16:52:46.812586, 5] lib/debug.c:405(debug_dump_status) msdfs: False/0 dmapi: False/0 registry: False/0 INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.812750, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.812764, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c6a (19562) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.812831, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.812887, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.812910, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c69 (19561) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.812971, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.813040, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.813054, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) [2011/03/03 16:52:46.813054, 5] lib/debug.c:405(debug_dump_status) dest: struct server_id id : 0x00004c68 (19560) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) INFO: Current debug levels: vnn : 0xffffffff (4294967295) all: True/10 buf : DATA_BLOB length=3 tdb: False/0 printdrivers: False/0 lanman: False/0 [2011/03/03 16:52:46.813148, 10] ../lib/util/util.c:278(_dump_data) smb: False/0 rpc_parse: False/0 [0000] 31 30 00 10. rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 [2011/03/03 16:52:46.813354, 5] lib/debug.c:405(debug_dump_status) vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 INFO: Current debug levels: locking: False/0 all: True/10 msdfs: False/0 tdb: False/0 dmapi: False/0 printdrivers: False/0 registry: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.813587, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.813587, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c67 (19559) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.813587, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.813820, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.813974, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.814184, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.814204, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c66 (19558) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.814213, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.814593, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.814758, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.814772, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c63 (19555) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.814840, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.815140, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.815373, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.815408, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c5e (19550) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.815475, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.815766, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.815985, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.815987, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c5d (19549) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.816131, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.816191, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.816198, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c5a (19546) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.816301, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.816476, 5] lib/debug.c:405(debug_dump_status) [2011/03/03 16:52:46.816447, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 INFO: Current debug levels: printdrivers: False/0 all: True/10 lanman: False/0 tdb: False/0 smb: False/0 printdrivers: False/0 rpc_parse: False/0 lanman: False/0 rpc_srv: False/0 smb: False/0 rpc_cli: False/0 passdb: False/0 rpc_parse: False/0 rpc_srv: False/0 sam: False/0 rpc_cli: False/0 auth: False/0 passdb: False/0 winbind: False/0 sam: False/0 vfs: False/0 auth: False/0 idmap: False/0 winbind: False/0 quota: False/0 vfs: False/0 acls: False/0 idmap: False/0 locking: False/0 quota: False/0 msdfs: False/0 acls: False/0 dmapi: False/0 locking: False/0 registry: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.816476, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.817225, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c59 (19545) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.817328, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.817518, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.817838, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.817853, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c58 (19544) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.817930, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.817998, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.818012, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c56 (19542) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.818071, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.818169, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.818274, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.818347, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.818426, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c42 (19522) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.818502, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.818631, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.818645, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c2f (19503) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.818711, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.818960, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.819326, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.819375, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.819508, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c2e (19502) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.819571, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.819625, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.819639, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c2d (19501) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.819690, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.819890, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.819906, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.820856, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.820926, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c2c (19500) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.821001, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.821094, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.821109, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c2b (19499) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.821177, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.821273, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.821404, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.821631, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.821646, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c2a (19498) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.821706, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.821762, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.821776, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c29 (19497) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.821868, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.821947, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.821963, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c27 (19495) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.822100, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.822197, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.822583, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.822777, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.822806, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) [2011/03/03 16:52:46.822765, 5] lib/debug.c:405(debug_dump_status) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) INFO: Current debug levels: messages: struct messaging_rec all: True/10 msg_version : 0x00000002 (2) tdb: False/0 msg_type : MSG_DEBUG (1) printdrivers: False/0 dest: struct server_id lanman: False/0 id : 0x00004c24 (19492) smb: False/0 vnn : 0xffffffff (4294967295) rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.822991, 10] ../lib/util/util.c:278(_dump_data) passdb: False/0 [0000] 31 30 00 10. sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.823286, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.823481, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.823495, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c21 (19489) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.823564, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.823613, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.823656, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004c1e (19486) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.823723, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.823757, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.823784, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004975 (18805) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.823817, 5] lib/debug.c:405(debug_dump_status) [2011/03/03 16:52:46.823881, 10] ../lib/util/util.c:278(_dump_data) INFO: Current debug levels: [0000] 31 30 00 10. all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 [2011/03/03 16:52:46.823934, 10] lib/messages_local.c:234(messaging_tdb_store) passdb: False/0 messaging_tdb_store: sam: False/0 auth: False/0 [2011/03/03 16:52:46.823958, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) winbind: False/0 array: struct messaging_array vfs: False/0 num_messages : 0x00000001 (1) idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x000048c3 (18627) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.824069, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.824114, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 [2011/03/03 16:52:46.824199, 5] lib/debug.c:405(debug_dump_status) msdfs: False/0 dmapi: False/0 registry: False/0 INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.824272, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 [2011/03/03 16:52:46.824358, 10] lib/messages_local.c:234(messaging_tdb_store) idmap: False/0 messaging_tdb_store: quota: False/0 acls: False/0 [2011/03/03 16:52:46.824383, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) locking: False/0 array: struct messaging_array msdfs: False/0 num_messages : 0x00000001 (1) dmapi: False/0 messages: ARRAY(1) registry: False/0 messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x0000452d (17709) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.824487, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.824594, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.824759, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.824773, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00002e03 (11779) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.824840, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.824886, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.824900, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00002bb1 (11185) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.824987, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.824954, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.825086, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.825029, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.825417, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x0000253c (9532) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.825478, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.825529, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.825543, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004b13 (19219) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.825633, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.825680, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.825699, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00002afb (11003) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.825758, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.825818, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.825832, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x0000705a (28762) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) [2011/03/03 16:52:46.825765, 5] lib/debug.c:405(debug_dump_status) buf : DATA_BLOB length=3 INFO: Current debug levels: all: True/10 [2011/03/03 16:52:46.825918, 10] ../lib/util/util.c:278(_dump_data) tdb: False/0 printdrivers: False/0 [0000] 31 30 00 10. lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 [2011/03/03 16:52:46.825954, 10] lib/messages_local.c:234(messaging_tdb_store) idmap: False/0 messaging_tdb_store: quota: False/0 acls: False/0 locking: False/0 [2011/03/03 16:52:46.825972, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) msdfs: False/0 array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00002fca (12234) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.826071, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.826127, 10] lib/messages_local.c:234(messaging_tdb_store) [2011/03/03 16:52:46.825997, 5] lib/debug.c:405(debug_dump_status) messaging_tdb_store: INFO: Current debug levels: all: True/10 [2011/03/03 16:52:46.826146, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) tdb: False/0 array: struct messaging_array printdrivers: False/0 num_messages : 0x00000001 (1) lanman: False/0 messages: ARRAY(1) smb: False/0 messages: struct messaging_rec rpc_parse: False/0 msg_version : 0x00000002 (2) rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 msg_type : MSG_DEBUG (1) dmapi: False/0 registry: False/0 dest: struct server_id id : 0x0000709d (28829) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) dmapi: False/0 vnn : 0xffffffff (4294967295) [2011/03/03 16:52:46.826209, 5] lib/debug.c:405(debug_dump_status) registry: False/0 buf : DATA_BLOB length=3 INFO: Current debug levels: all: True/10 [2011/03/03 16:52:46.826265, 10] ../lib/util/util.c:278(_dump_data) tdb: False/0 [0000] 31 30 00 10. printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 [2011/03/03 16:52:46.826315, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: winbind: False/0 vfs: False/0 [2011/03/03 16:52:46.826333, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) idmap: False/0 array: struct messaging_array quota: False/0 num_messages : 0x00000001 (1) acls: False/0 messages: ARRAY(1) locking: False/0 messages: struct messaging_rec msdfs: False/0 dmapi: False/0 [2011/03/03 16:52:46.826299, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: registry: False/0 all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.826488, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00004f88 (20360) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.826708, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.826753, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.826647, 5] lib/debug.c:405(debug_dump_status) [2011/03/03 16:52:46.826769, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array INFO: Current debug levels: num_messages : 0x00000001 (1) all: True/10 messages: ARRAY(1) tdb: False/0 messages: struct messaging_rec msg_version : 0x00000002 (2) printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 msg_type : MSG_DEBUG (1) quota: False/0 dest: struct server_id [2011/03/03 16:52:46.826830, 5] lib/debug.c:405(debug_dump_status) acls: False/0 id : 0x00003596 (13718) INFO: Current debug levels: locking: False/0 all: True/10 msdfs: False/0 vnn : 0xffffffff (4294967295) tdb: False/0 src: struct server_id dmapi: False/0 id : 0x00001297 (4759) registry: False/0 vnn : 0xffffffff (4294967295) printdrivers: False/0 buf : DATA_BLOB length=3 lanman: False/0 smb: False/0 rpc_parse: False/0 [2011/03/03 16:52:46.826961, 10] ../lib/util/util.c:278(_dump_data) rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 [0000] 31 30 00 10. sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.826998, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.826999, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00003410 (13328) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.827130, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.827111, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 [2011/03/03 16:52:46.827163, 10] lib/messages_local.c:234(messaging_tdb_store) printdrivers: False/0 messaging_tdb_store: lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 [2011/03/03 16:52:46.827180, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) locking: False/0 array: struct messaging_array msdfs: False/0 num_messages : 0x00000001 (1) dmapi: False/0 messages: ARRAY(1) registry: False/0 messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00007299 (29337) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.827274, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.827309, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.827339, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array [2011/03/03 16:52:46.827315, 5] lib/debug.c:405(debug_dump_status) num_messages : 0x00000001 (1) INFO: Current debug levels: messages: ARRAY(1) all: True/10 messages: struct messaging_rec tdb: False/0 msg_version : 0x00000002 (2) printdrivers: False/0 msg_type : MSG_DEBUG (1) lanman: False/0 dest: struct server_id smb: False/0 id : 0x00003e8c (16012) rpc_parse: False/0 vnn : 0xffffffff (4294967295) rpc_srv: False/0 src: struct server_id rpc_cli: False/0 id : 0x00001297 (4759) passdb: False/0 vnn : 0xffffffff (4294967295) sam: False/0 buf : DATA_BLOB length=3 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 [2011/03/03 16:52:46.827339, 10] ../lib/util/util.c:278(_dump_data) acls: False/0 locking: False/0 msdfs: False/0 [0000] 31 30 00 10. dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.827339, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 [2011/03/03 16:52:46.827339, 10] lib/messages_local.c:234(messaging_tdb_store) rpc_parse: False/0 messaging_tdb_store: rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 [2011/03/03 16:52:46.827339, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array sam: False/0 num_messages : 0x00000001 (1) auth: False/0 messages: ARRAY(1) winbind: False/0 messages: struct messaging_rec vfs: False/0 msg_version : 0x00000002 (2) idmap: False/0 quota: False/0 [2011/03/03 16:52:46.827339, 5] lib/debug.c:405(debug_dump_status) acls: False/0 INFO: Current debug levels: msg_type : MSG_DEBUG (1) all: True/10 locking: False/0 dest: struct server_id tdb: False/0 msdfs: False/0 id : 0x000077d0 (30672) dmapi: False/0 printdrivers: False/0 registry: False/0 lanman: False/0 vnn : 0xffffffff (4294967295) smb: False/0 src: struct server_id rpc_parse: False/0 id : 0x00001297 (4759) rpc_srv: False/0 vnn : 0xffffffff (4294967295) rpc_cli: False/0 buf : DATA_BLOB length=3 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 [2011/03/03 16:52:46.827339, 10] ../lib/util/util.c:278(_dump_data) quota: False/0 acls: False/0 locking: False/0 [0000] 31 30 00 10. msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.827339, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.827384, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x0000744a (29770) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.827410, 5] lib/debug.c:405(debug_dump_status) [2011/03/03 16:52:46.827851, 10] ../lib/util/util.c:278(_dump_data) INFO: Current debug levels: [0000] 31 30 00 10. all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.828425, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.828621, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.828635, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00007448 (29768) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.828715, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.828793, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.828808, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x00006013 (24595) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.828868, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.828970, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 [2011/03/03 16:52:46.829008, 5] lib/debug.c:405(debug_dump_status) vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.829248, 10] lib/messages_local.c:234(messaging_tdb_store) messaging_tdb_store: [2011/03/03 16:52:46.829262, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) array: struct messaging_array num_messages : 0x00000001 (1) messages: ARRAY(1) messages: struct messaging_rec msg_version : 0x00000002 (2) msg_type : MSG_DEBUG (1) dest: struct server_id id : 0x000012aa (4778) vnn : 0xffffffff (4294967295) src: struct server_id id : 0x00001297 (4759) vnn : 0xffffffff (4294967295) buf : DATA_BLOB length=3 [2011/03/03 16:52:46.829332, 10] ../lib/util/util.c:278(_dump_data) [0000] 31 30 00 10. [2011/03/03 16:52:46.829462, 5] lib/debug.c:405(debug_dump_status) INFO: Current debug levels: all: True/10 tdb: False/0 printdrivers: False/0 lanman: False/0 smb: False/0 rpc_parse: False/0 rpc_srv: False/0 rpc_cli: False/0 passdb: False/0 sam: False/0 auth: False/0 winbind: False/0 vfs: False/0 idmap: False/0 quota: False/0 acls: False/0 locking: False/0 msdfs: False/0 dmapi: False/0 registry: False/0 [2011/03/03 16:52:46.850517, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 100 [2011/03/03 16:52:46.850600, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x64 [2011/03/03 16:52:46.850620, 3] smbd/process.c:1485(process_smb) Transaction 11 of length 104 (0 toread) [2011/03/03 16:52:46.850662, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.850675, 5] lib/util.c:627(show_msg) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=148 smb_uid=100 smb_mid=704 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2011/03/03 16:52:46.850792, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [0010] 00 . [2011/03/03 16:52:46.850797, 3] smbd/process.c:1294(switch_message) switch message SMBntcreateX (pid 19582) conn 0x2db92b0 [2011/03/03 16:52:46.850802, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.850805, 10] smbd/nttrans.c:498(reply_ntcreate_and_X) reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = lsarpc [2011/03/03 16:52:46.850809, 4] smbd/nttrans.c:283(nt_open_pipe) nt_open_pipe: Opening pipe \lsarpc. [2011/03/03 16:52:46.850814, 5] smbd/files.c:119(file_new) allocated file structure 13619, fnum = 17715 (1 used) [2011/03/03 16:52:46.850816, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p) Create pipe requested \lsarpc [2011/03/03 16:52:46.850846, 10] rpc_server/srv_lsa_hnd.c:114(init_pipe_handle_list) init_pipe_handles: created handle list for pipe \lsarpc [2011/03/03 16:52:46.850862, 10] rpc_server/srv_lsa_hnd.c:131(init_pipe_handle_list) init_pipe_handles: pipe_handles ref count = 1 for pipe \lsarpc [2011/03/03 16:52:46.850862, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.850862, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.850862, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.851098, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.851098, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.851098, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:46.851098, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.851098, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:46.851098, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:46.851098, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:46.851099, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:46.851099, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:46.851099, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:46.851099, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:46.851099, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:46.851099, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:46.851099, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.851099, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.851099, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.851099, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.851099, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.851099, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:46.851099, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.851099, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:46.851099, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:46.851099, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:46.851099, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p) Created internal pipe \lsarpc (pipes_open=0) [2011/03/03 16:52:46.851099, 5] smbd/nttrans.c:372(do_ntcreate_pipe_open) do_ntcreate_pipe_open: open pipe = \lsarpc [2011/03/03 16:52:46.853274, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 136 [2011/03/03 16:52:46.853382, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x88 [2011/03/03 16:52:46.853413, 3] smbd/process.c:1485(process_smb) Transaction 12 of length 140 (0 toread) [2011/03/03 16:52:46.853433, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.853509, 5] lib/util.c:627(show_msg) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=768 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17715 (0x4533) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2011/03/03 16:52:46.853595, 10] ../lib/util/util.c:278(_dump_data) [0000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [0010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [0020] 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xW4.4.. ....#Eg. [0030] AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [0040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2011/03/03 16:52:46.853677, 3] smbd/process.c:1294(switch_message) switch message SMBwriteX (pid 19582) conn 0x2db92b0 [2011/03/03 16:52:46.853715, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.853748, 6] smbd/pipes.c:291(reply_pipe_write_and_X) reply_pipe_write_and_X: 4533 name: lsarpc len: 72 [2011/03/03 16:52:46.853771, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 72 [2011/03/03 16:52:46.853804, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.853818, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:46.853850, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.853864, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.853878, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:46.853896, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2011/03/03 16:52:46.853916, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0048 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.853979, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.854008, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 11, flags = 3 [2011/03/03 16:52:46.854022, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.854033, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:46.854044, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2011/03/03 16:52:46.854056, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 11 [2011/03/03 16:52:46.854079, 5] rpc_server/srv_pipe.c:1641(api_pipe_bind_req) api_pipe_bind_req: decode request. 1641 [2011/03/03 16:52:46.854115, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_rb [2011/03/03 16:52:46.854128, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 00000000 0008 num_contexts: 01 000c context_id : 0000 000e num_transfer_syntaxes: 01 [2011/03/03 16:52:46.854160, 6] rpc_parse/parse_prs.c:89(prs_debug) 00000f smb_io_rpc_iface [2011/03/03 16:52:46.854175, 7] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_uuid uuid 0010 data : 12345778 0014 data : 1234 0016 data : abcd 0018 data : ef 00 001a data : 01 23 45 67 89 ab 0020 version: 00000000 [2011/03/03 16:52:46.854230, 6] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_rpc_iface [2011/03/03 16:52:46.854243, 7] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_uuid uuid 0024 data : 8a885d04 0028 data : 1ceb 002a data : 11c9 002c data : 9f e8 002e data : 08 00 2b 10 48 60 0034 version: 00000002 [2011/03/03 16:52:46.854278, 3] rpc_server/srv_pipe.c:1667(api_pipe_bind_req) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc [2011/03/03 16:52:46.854306, 5] rpc_server/srv_pipe.c:1717(api_pipe_bind_req) api_pipe_bind_req: make response. 1717 [2011/03/03 16:52:46.854321, 3] rpc_server/srv_pipe.c:998(check_bind_req) check_bind_req for \lsarpc checking lsarpc [2011/03/03 16:52:46.854350, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_ba [2011/03/03 16:52:46.854364, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 000053f0 [2011/03/03 16:52:46.854385, 6] rpc_parse/parse_prs.c:89(prs_debug) 000008 smb_io_rpc_addr_str 0008 len: 000d 000a str: \PIPE\lsarpc. [2011/03/03 16:52:46.854441, 6] rpc_parse/parse_prs.c:89(prs_debug) 000017 smb_io_rpc_results 0018 num_results: 01 001c result : 0000 001e reason : 0000 [2011/03/03 16:52:46.854466, 6] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_rpc_iface [2011/03/03 16:52:46.854489, 7] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_uuid uuid 0020 data : 8a885d04 0024 data : 1ceb 0026 data : 11c9 0028 data : 9f e8 002a data : 08 00 2b 10 48 60 0030 version: 00000002 [2011/03/03 16:52:46.854524, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.854572, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 56 [2011/03/03 16:52:46.854610, 3] smbd/pipes.c:352(pipe_write_andx_done) writeX-IPC nwritten=72 [2011/03/03 16:52:46.855329, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 59 [2011/03/03 16:52:46.855364, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x3b [2011/03/03 16:52:46.855383, 3] smbd/process.c:1485(process_smb) Transaction 13 of length 63 (0 toread) [2011/03/03 16:52:46.855405, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.855417, 5] lib/util.c:627(show_msg) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=832 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17715 (0x4533) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2011/03/03 16:52:46.855487, 3] smbd/process.c:1294(switch_message) switch message SMBreadX (pid 19582) conn 0x2db92b0 [2011/03/03 16:52:46.855509, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.855533, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.855555, 10] rpc_server/srv_pipe_hnd.c:854(read_from_internal_pipe) read_from_pipe: \lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2011/03/03 16:52:46.855582, 3] smbd/pipes.c:462(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=68 [2011/03/03 16:52:46.856376, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 172 [2011/03/03 16:52:46.856410, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xac [2011/03/03 16:52:46.856424, 3] smbd/process.c:1485(process_smb) Transaction 14 of length 176 (0 toread) [2011/03/03 16:52:46.856437, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.856446, 5] lib/util.c:627(show_msg) size=172 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=148 smb_uid=100 smb_mid=896 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 88 (0x58) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17715 (0x4533) smb_bcc=105 [2011/03/03 16:52:46.856532, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 58 00 00 00 01 00 00 ........ .X...... [0020] 00 40 00 00 00 00 00 2C 00 80 9C 0E 00 06 00 00 .@....., ........ [0030] 00 00 00 00 00 06 00 00 00 5C 00 5C 00 50 00 44 ........ .\.\.P.D [0040] 00 43 00 00 00 18 00 00 00 00 00 00 00 00 00 00 .C...... ........ [0050] 00 00 00 00 00 00 00 00 00 9C F6 BC 00 0C 00 00 ........ ........ [0060] 00 02 00 01 00 01 08 00 00 ........ . [2011/03/03 16:52:46.856639, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19582) conn 0x2db92b0 [2011/03/03 16:52:46.856717, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.856735, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=88 params=0 setup=2 [2011/03/03 16:52:46.856756, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.856770, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.856785, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.856824, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4533) [2011/03/03 16:52:46.856840, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db57d0 max_trans_reply: 1024 [2011/03/03 16:52:46.856853, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 88 [2011/03/03 16:52:46.856869, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 88 [2011/03/03 16:52:46.856882, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 88 [2011/03/03 16:52:46.856900, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 88, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.856915, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.856928, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.856939, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:46.856951, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0058 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.857011, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.857025, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.857038, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.857049, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.857061, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 72, incoming data = 72 [2011/03/03 16:52:46.857073, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.857085, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000040 0004 context_id: 0000 0006 opnum : 002c [2011/03/03 16:52:46.857118, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 75 [2011/03/03 16:52:46.857148, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.857165, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2011/03/03 16:52:46.857188, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[44].fn == 0x621b60 [2011/03/03 16:52:46.857225, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '\\PDC' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x00000801 (2049) 1: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 1: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2011/03/03 16:52:46.857526, 4] rpc_server/srv_samr_nt.c:230(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x00000801, granted: 0x00000801) [2011/03/03 16:52:46.857566, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal) Opened policy hnd[1] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 7E 4C 00 00 ~L.. [2011/03/03 16:52:46.857600, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-6f4d-4eb97e4c0000 result : NT_STATUS_OK [2011/03/03 16:52:46.857672, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.857690, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 1084 [2011/03/03 16:52:46.857711, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 72 [2011/03/03 16:52:46.857729, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.857743, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:46.857757, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.857824, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.857853, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:46.857867, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.857902, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=148 smb_uid=100 smb_mid=896 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:46.857967, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ [0020] 00 00 00 00 00 6F 4D 4E B9 7E 4C 00 00 00 00 00 .....oMN .~L..... [0030] 00 . [2011/03/03 16:52:46.858776, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 208 [2011/03/03 16:52:46.858794, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xd0 [2011/03/03 16:52:46.858813, 3] smbd/process.c:1485(process_smb) Transaction 15 of length 212 (0 toread) [2011/03/03 16:52:46.858826, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.858835, 5] lib/util.c:627(show_msg) size=208 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=148 smb_uid=100 smb_mid=960 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 124 (0x7C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17715 (0x4533) smb_bcc=141 [2011/03/03 16:52:46.858940, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 7C 00 00 00 02 00 00 ........ .|...... [0020] 00 64 00 00 00 00 00 3A 00 00 00 00 00 02 00 00 .d.....: ........ [0030] 00 00 00 00 00 6F 4D 4E B9 7E 4C 00 00 01 00 00 .....oMN .~L..... [0040] 00 01 00 00 00 1A 00 1C 00 D8 DD 0F 00 0E 00 00 ........ ........ [0050] 00 00 00 00 00 0D 00 00 00 74 00 68 00 69 00 40 ........ .t.h.i.@ [0060] 00 53 00 41 00 41 00 43 00 4B 00 45 00 2E 00 44 .D.O.M.A .I.N...Q [0070] 00 45 00 00 00 00 00 00 00 00 00 00 00 02 00 00 .A...... ........ [0080] 00 00 00 00 00 00 00 00 00 02 00 00 00 ........ ..... [2011/03/03 16:52:46.859038, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19582) conn 0x2db92b0 [2011/03/03 16:52:46.859051, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.859065, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=124 params=0 setup=2 [2011/03/03 16:52:46.859079, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.859124, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.859136, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.859147, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4533) [2011/03/03 16:52:46.859159, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db57d0 max_trans_reply: 1024 [2011/03/03 16:52:46.859171, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 124 [2011/03/03 16:52:46.859184, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 124 [2011/03/03 16:52:46.859195, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 124 [2011/03/03 16:52:46.859219, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 124, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.859239, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.859252, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:46.859263, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 108 [2011/03/03 16:52:46.859275, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 007c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:46.859355, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.859368, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.859380, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.859392, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:46.859410, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 108, incoming data = 108 [2011/03/03 16:52:46.859423, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.859435, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000064 0004 context_id: 0000 0006 opnum : 003a [2011/03/03 16:52:46.859457, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.859470, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.859482, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x3a - api_rpcTNP: rpc command: LSA_LOOKUPNAMES2 [2011/03/03 16:52:46.859524, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[58].fn == 0x61f3a0 [2011/03/03 16:52:46.859548, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 in: struct lsa_LookupNames2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-6f4d-4eb97e4c0000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001a (26) size : 0x001a (26) string : * string : 'thi@DOMAIN.QA' sids : * sids: struct lsa_TransSidArray2 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2011/03/03 16:52:46.859712, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 7E 4C 00 00 ~L.. [2011/03/03 16:52:46.859744, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.859766, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.859793, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.859815, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.859832, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.859861, 5] rpc_server/srv_lsa_nt.c:188(lookup_lsa_rids) lookup_lsa_rids: looking up name thi@DOMAIN.QA [2011/03/03 16:52:46.859880, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: thi@DOMAIN.QA => (domain), thi@DOMAIN.QA (name) [2011/03/03 16:52:46.859930, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x043 [2011/03/03 16:52:46.859946, 10] passdb/pdb_ldap.c:6185(ldapsam_get_trusteddom_pw) ldapsam_get_trusteddom_pw called for domain thi@DOMAIN.QA [2011/03/03 16:52:46.859975, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [sambaDomainName=thi@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa], filter => [(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=thi@DOMAIN.QA))], scope => [2] [2011/03/03 16:52:46.861085, 10] lib/smbldap.c:1424(smbldap_search_ext) Failed search for base: sambaDomainName=thi@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa, error: 32 (No such object) (unknown) [2011/03/03 16:52:46.861512, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.861544, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:46.861560, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.861577, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.861668, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.861824, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=thi@DOMAIN.QA)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:46.862349, 4] passdb/pdb_ldap.c:1598(ldapsam_getsampwnam) ldapsam_getsampwnam: Unable to locate user [thi@DOMAIN.QA] count=0 [2011/03/03 16:52:46.862383, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.862412, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.862429, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:46.862445, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.862459, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.862461, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.862463, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=thi@DOMAIN.QA)(cn=thi@DOMAIN.QA)))], scope => [2] [2011/03/03 16:52:46.862979, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(|(displayName=thi@DOMAIN.QA)(cn=thi@DOMAIN.QA))) [2011/03/03 16:52:46.862985, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.863387, 5] rpc_server/srv_lsa_nt.c:207(lookup_lsa_rids) init_lsa_rids: thi@DOMAIN.QA not found [2011/03/03 16:52:46.863413, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.863440, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 out: struct lsa_LookupNames2 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray2 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid2 sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) unknown : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2011/03/03 16:52:46.863797, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.863832, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 68 [2011/03/03 16:52:46.863857, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 108 [2011/03/03 16:52:46.863926, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.863941, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 52. [2011/03/03 16:52:46.863965, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 004c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:46.864032, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000034 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.864067, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..76] (align 0) [2011/03/03 16:52:46.864091, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.864104, 5] lib/util.c:627(show_msg) size=132 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=148 smb_uid=100 smb_mid=960 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 76 (0x4C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=77 [2011/03/03 16:52:46.864175, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 4C 00 00 00 02 00 00 ........ .L...... [0010] 00 34 00 00 00 00 00 00 00 00 00 02 00 00 00 00 .4...... ........ [0020] 00 00 00 00 00 00 00 00 00 01 00 00 00 04 00 02 ........ ........ [0030] 00 01 00 00 00 08 00 00 00 00 00 00 00 FF FF FF ........ ........ [0040] FF 00 00 00 00 00 00 00 00 73 00 00 C0 ........ .s... [2011/03/03 16:52:46.864966, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 128 [2011/03/03 16:52:46.864985, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x80 [2011/03/03 16:52:46.865010, 3] smbd/process.c:1485(process_smb) Transaction 16 of length 132 (0 toread) [2011/03/03 16:52:46.865024, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.865033, 5] lib/util.c:627(show_msg) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=148 smb_uid=100 smb_mid=1024 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17715 (0x4533) smb_bcc=61 [2011/03/03 16:52:46.865132, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... [0020] 00 14 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ [0030] 00 00 00 00 00 6F 4D 4E B9 7E 4C 00 00 .....oMN .~L.. [2011/03/03 16:52:46.865196, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19582) conn 0x2db92b0 [2011/03/03 16:52:46.865217, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.865242, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=44 params=0 setup=2 [2011/03/03 16:52:46.865258, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.865270, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.865293, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.865311, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4533) [2011/03/03 16:52:46.865329, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db57d0 max_trans_reply: 1024 [2011/03/03 16:52:46.865406, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 44 [2011/03/03 16:52:46.865419, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 44 [2011/03/03 16:52:46.865431, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2011/03/03 16:52:46.865443, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.865457, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.865468, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:46.865479, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2011/03/03 16:52:46.865498, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 002c 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:46.865543, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.865556, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.865568, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.865579, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:46.865597, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2011/03/03 16:52:46.865609, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.865621, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000014 0004 context_id: 0000 0006 opnum : 0000 [2011/03/03 16:52:46.865643, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.865669, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.865682, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2011/03/03 16:52:46.865703, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[0].fn == 0x629770 [2011/03/03 16:52:46.865731, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-6f4d-4eb97e4c0000 [2011/03/03 16:52:46.865779, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 7E 4C 00 00 ~L.. [2011/03/03 16:52:46.865815, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 7E 4C 00 00 ~L.. [2011/03/03 16:52:46.865841, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd) Closed policy [2011/03/03 16:52:46.865854, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2011/03/03 16:52:46.865907, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.865922, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.865934, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 28 [2011/03/03 16:52:46.865952, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.865964, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:46.865978, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:46.865986, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.865986, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:46.865986, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.865986, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=148 smb_uid=100 smb_mid=1024 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:46.865986, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 . [2011/03/03 16:52:46.866836, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 41 [2011/03/03 16:52:46.866836, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x29 [2011/03/03 16:52:46.866836, 3] smbd/process.c:1485(process_smb) Transaction 17 of length 45 (0 toread) [2011/03/03 16:52:46.866836, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.866836, 5] lib/util.c:627(show_msg) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1088 smt_wct=3 smb_vwv[ 0]=17715 (0x4533) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2011/03/03 16:52:46.866836, 3] smbd/process.c:1294(switch_message) switch message SMBclose (pid 19582) conn 0x2db92b0 [2011/03/03 16:52:46.866836, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.866836, 3] smbd/reply.c:4634(reply_close) close fd=-1 fnum=17715 (numopen=1) [2011/03/03 16:52:46.866836, 6] smbd/close.c:501(set_close_write_time) close_write_time: Sun Feb 7 07:28:15 2106 [2011/03/03 16:52:46.866836, 10] rpc_server/srv_lsa_hnd.c:290(close_policy_by_pipe) close_policy_by_pipe: deleted handle list for pipe \lsarpc [2011/03/03 16:52:46.866836, 5] smbd/files.c:497(file_free) freed files structure 17715 (0 used) [2011/03/03 16:52:46.866836, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.866836, 5] lib/util.c:627(show_msg) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1088 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:46.894585, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 100 [2011/03/03 16:52:46.894872, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x64 [2011/03/03 16:52:46.894898, 3] smbd/process.c:1485(process_smb) Transaction 11 of length 104 (0 toread) [2011/03/03 16:52:46.894920, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.894939, 5] lib/util.c:627(show_msg) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=396 smb_uid=100 smb_mid=704 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2011/03/03 16:52:46.895051, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [0010] 00 . [2011/03/03 16:52:46.895132, 3] smbd/process.c:1294(switch_message) switch message SMBntcreateX (pid 19583) conn 0x2db92b0 [2011/03/03 16:52:46.895168, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.895212, 10] smbd/nttrans.c:498(reply_ntcreate_and_X) reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = lsarpc [2011/03/03 16:52:46.895242, 4] smbd/nttrans.c:283(nt_open_pipe) nt_open_pipe: Opening pipe \lsarpc. [2011/03/03 16:52:46.895276, 5] smbd/files.c:119(file_new) allocated file structure 13620, fnum = 17716 (1 used) [2011/03/03 16:52:46.895283, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p) Create pipe requested \lsarpc [2011/03/03 16:52:46.895448, 10] rpc_server/srv_lsa_hnd.c:114(init_pipe_handle_list) init_pipe_handles: created handle list for pipe \lsarpc [2011/03/03 16:52:46.895470, 10] rpc_server/srv_lsa_hnd.c:131(init_pipe_handle_list) init_pipe_handles: pipe_handles ref count = 1 for pipe \lsarpc [2011/03/03 16:52:46.895512, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.895537, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.895552, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.895575, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.895600, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.895717, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:46.895826, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.895871, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:46.895890, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:46.895905, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:46.895921, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:46.895950, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:46.895974, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:46.895994, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:46.896015, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:46.896031, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:46.896047, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.896069, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.896084, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.896099, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.896113, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.896140, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:46.896175, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.896192, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:46.896215, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:46.896246, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:46.896271, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p) Created internal pipe \lsarpc (pipes_open=0) [2011/03/03 16:52:46.896299, 5] smbd/nttrans.c:372(do_ntcreate_pipe_open) do_ntcreate_pipe_open: open pipe = \lsarpc [2011/03/03 16:52:46.896802, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 136 [2011/03/03 16:52:46.896832, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x88 [2011/03/03 16:52:46.896846, 3] smbd/process.c:1485(process_smb) Transaction 12 of length 140 (0 toread) [2011/03/03 16:52:46.896864, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.896874, 5] lib/util.c:627(show_msg) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=768 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17716 (0x4534) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2011/03/03 16:52:46.896947, 10] ../lib/util/util.c:278(_dump_data) [0000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [0010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [0020] 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xW4.4.. ....#Eg. [0030] AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [0040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2011/03/03 16:52:46.897008, 3] smbd/process.c:1294(switch_message) switch message SMBwriteX (pid 19583) conn 0x2db92b0 [2011/03/03 16:52:46.897022, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.897038, 6] smbd/pipes.c:291(reply_pipe_write_and_X) reply_pipe_write_and_X: 4534 name: lsarpc len: 72 [2011/03/03 16:52:46.897056, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 72 [2011/03/03 16:52:46.897119, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.897134, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:46.897146, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.897166, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.897179, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:46.897191, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2011/03/03 16:52:46.897208, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0048 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.897278, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.897291, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 11, flags = 3 [2011/03/03 16:52:46.897304, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.897315, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:46.897326, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2011/03/03 16:52:46.897339, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 11 [2011/03/03 16:52:46.897356, 5] rpc_server/srv_pipe.c:1641(api_pipe_bind_req) api_pipe_bind_req: decode request. 1641 [2011/03/03 16:52:46.897398, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_rb [2011/03/03 16:52:46.897412, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 00000000 0008 num_contexts: 01 000c context_id : 0000 000e num_transfer_syntaxes: 01 [2011/03/03 16:52:46.897449, 6] rpc_parse/parse_prs.c:89(prs_debug) 00000f smb_io_rpc_iface [2011/03/03 16:52:46.897470, 7] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_uuid uuid 0010 data : 12345778 0014 data : 1234 0016 data : abcd 0018 data : ef 00 001a data : 01 23 45 67 89 ab 0020 version: 00000000 [2011/03/03 16:52:46.897517, 6] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_rpc_iface [2011/03/03 16:52:46.897529, 7] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_uuid uuid 0024 data : 8a885d04 0028 data : 1ceb 002a data : 11c9 002c data : 9f e8 002e data : 08 00 2b 10 48 60 0034 version: 00000002 [2011/03/03 16:52:46.897568, 3] rpc_server/srv_pipe.c:1667(api_pipe_bind_req) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc [2011/03/03 16:52:46.897587, 5] rpc_server/srv_pipe.c:1717(api_pipe_bind_req) api_pipe_bind_req: make response. 1717 [2011/03/03 16:52:46.897602, 3] rpc_server/srv_pipe.c:998(check_bind_req) check_bind_req for \lsarpc checking lsarpc [2011/03/03 16:52:46.897623, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_ba [2011/03/03 16:52:46.897637, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 000053f0 [2011/03/03 16:52:46.897663, 6] rpc_parse/parse_prs.c:89(prs_debug) 000008 smb_io_rpc_addr_str 0008 len: 000d 000a str: \PIPE\lsarpc. [2011/03/03 16:52:46.897689, 6] rpc_parse/parse_prs.c:89(prs_debug) 000017 smb_io_rpc_results 0018 num_results: 01 001c result : 0000 001e reason : 0000 [2011/03/03 16:52:46.897711, 6] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_rpc_iface [2011/03/03 16:52:46.897723, 7] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_uuid uuid 0020 data : 8a885d04 0024 data : 1ceb 0026 data : 11c9 0028 data : 9f e8 002a data : 08 00 2b 10 48 60 0030 version: 00000002 [2011/03/03 16:52:46.897756, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.897810, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 56 [2011/03/03 16:52:46.897836, 3] smbd/pipes.c:352(pipe_write_andx_done) writeX-IPC nwritten=72 [2011/03/03 16:52:46.898200, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 59 [2011/03/03 16:52:46.898218, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x3b [2011/03/03 16:52:46.898230, 3] smbd/process.c:1485(process_smb) Transaction 13 of length 63 (0 toread) [2011/03/03 16:52:46.898246, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.898254, 5] lib/util.c:627(show_msg) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=832 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17716 (0x4534) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2011/03/03 16:52:46.898374, 3] smbd/process.c:1294(switch_message) switch message SMBreadX (pid 19583) conn 0x2db92b0 [2011/03/03 16:52:46.898388, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.898404, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.898420, 10] rpc_server/srv_pipe_hnd.c:854(read_from_internal_pipe) read_from_pipe: \lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2011/03/03 16:52:46.898439, 3] smbd/pipes.c:462(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=68 [2011/03/03 16:52:46.898858, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 172 [2011/03/03 16:52:46.898858, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xac [2011/03/03 16:52:46.898858, 3] smbd/process.c:1485(process_smb) Transaction 14 of length 176 (0 toread) [2011/03/03 16:52:46.898858, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.898858, 5] lib/util.c:627(show_msg) size=172 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=396 smb_uid=100 smb_mid=896 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 88 (0x58) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17716 (0x4534) smb_bcc=105 [2011/03/03 16:52:46.899032, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 58 00 00 00 01 00 00 ........ .X...... [0020] 00 40 00 00 00 00 00 2C 00 00 00 02 00 06 00 00 .@....., ........ [0030] 00 00 00 00 00 06 00 00 00 5C 00 5C 00 50 00 44 ........ .\.\.P.D [0040] 00 43 00 00 00 18 00 00 00 00 00 00 00 00 00 00 .C...... ........ [0050] 00 00 00 00 00 00 00 00 00 04 00 02 00 0C 00 00 ........ ........ [0060] 00 02 00 01 00 01 08 00 00 ........ . [2011/03/03 16:52:46.899113, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19583) conn 0x2db92b0 [2011/03/03 16:52:46.899127, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.899146, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=88 params=0 setup=2 [2011/03/03 16:52:46.899175, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.899187, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.899199, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.899212, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4534) [2011/03/03 16:52:46.899224, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dbf890 max_trans_reply: 1024 [2011/03/03 16:52:46.899237, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 88 [2011/03/03 16:52:46.899250, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 88 [2011/03/03 16:52:46.899269, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 88 [2011/03/03 16:52:46.899281, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 88, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.899294, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.899305, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.899317, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:46.899355, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0058 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.899358, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.899358, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.899358, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.899453, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.899473, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 72, incoming data = 72 [2011/03/03 16:52:46.899489, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.899503, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000040 0004 context_id: 0000 0006 opnum : 002c [2011/03/03 16:52:46.899529, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 75 [2011/03/03 16:52:46.899557, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.899578, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2011/03/03 16:52:46.899607, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[44].fn == 0x621b60 [2011/03/03 16:52:46.899673, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '\\PDC' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x00000801 (2049) 1: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 1: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2011/03/03 16:52:46.899858, 4] rpc_server/srv_samr_nt.c:230(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x00000801, granted: 0x00000801) [2011/03/03 16:52:46.899914, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal) Opened policy hnd[1] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 7F 4C 00 00 .L.. [2011/03/03 16:52:46.899918, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-6f4d-4eb97f4c0000 result : NT_STATUS_OK [2011/03/03 16:52:46.900044, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.900067, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 1084 [2011/03/03 16:52:46.900082, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 72 [2011/03/03 16:52:46.900105, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.900121, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:46.900121, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.900238, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.900277, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:46.900293, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.900294, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=396 smb_uid=100 smb_mid=896 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:46.900375, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ [0020] 00 00 00 00 00 6F 4D 4E B9 7F 4C 00 00 00 00 00 .....oMN ..L..... [0030] 00 . [2011/03/03 16:52:46.900804, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 208 [2011/03/03 16:52:46.900822, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xd0 [2011/03/03 16:52:46.900835, 3] smbd/process.c:1485(process_smb) Transaction 15 of length 212 (0 toread) [2011/03/03 16:52:46.900847, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.900855, 5] lib/util.c:627(show_msg) size=208 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=396 smb_uid=100 smb_mid=960 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 124 (0x7C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17716 (0x4534) smb_bcc=141 [2011/03/03 16:52:46.900942, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 7C 00 00 00 02 00 00 ........ .|...... [0020] 00 64 00 00 00 00 00 3A 00 00 00 00 00 02 00 00 .d.....: ........ [0030] 00 00 00 00 00 6F 4D 4E B9 7F 4C 00 00 01 00 00 .....oMN ..L..... [0040] 00 01 00 00 00 1A 00 1C 00 00 00 02 00 0E 00 00 ........ ........ [0050] 00 00 00 00 00 0D 00 00 00 6B 00 6F 00 76 00 40 ........ .k.o.v.@ [0060] 00 53 00 41 00 41 00 43 00 4B 00 45 00 2E 00 44 .D.O.M.A .I.N...Q [0070] 00 45 00 00 05 00 00 00 00 00 00 00 00 02 00 BE .A...... ........ [0080] E6 00 00 00 00 00 00 00 00 02 00 00 00 ........ ..... [2011/03/03 16:52:46.900953, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19583) conn 0x2db92b0 [2011/03/03 16:52:46.901073, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.901089, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=124 params=0 setup=2 [2011/03/03 16:52:46.901104, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.901118, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.901132, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.901146, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4534) [2011/03/03 16:52:46.901167, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dbf890 max_trans_reply: 1024 [2011/03/03 16:52:46.901182, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 124 [2011/03/03 16:52:46.901197, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 124 [2011/03/03 16:52:46.901211, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 124 [2011/03/03 16:52:46.901212, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 124, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.901213, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.901253, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:46.901273, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 108 [2011/03/03 16:52:46.901287, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 007c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:46.901335, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.901349, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.901370, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.901383, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:46.901397, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 108, incoming data = 108 [2011/03/03 16:52:46.901411, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.901425, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000064 0004 context_id: 0000 0006 opnum : 003a [2011/03/03 16:52:46.901427, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.901428, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.901429, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x3a - api_rpcTNP: rpc command: LSA_LOOKUPNAMES2 [2011/03/03 16:52:46.901431, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[58].fn == 0x61f3a0 [2011/03/03 16:52:46.901432, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 in: struct lsa_LookupNames2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-6f4d-4eb97f4c0000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001a (26) size : 0x001a (26) string : * string : 'kov@DOMAIN.QA' sids : * sids: struct lsa_TransSidArray2 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2011/03/03 16:52:46.901433, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 7F 4C 00 00 .L.. [2011/03/03 16:52:46.901433, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.901739, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.901754, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.901775, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.901789, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.901813, 5] rpc_server/srv_lsa_nt.c:188(lookup_lsa_rids) lookup_lsa_rids: looking up name kov@DOMAIN.QA [2011/03/03 16:52:46.901831, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: kov@DOMAIN.QA => (domain), kov@DOMAIN.QA (name) [2011/03/03 16:52:46.901845, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x043 [2011/03/03 16:52:46.901869, 10] passdb/pdb_ldap.c:6185(ldapsam_get_trusteddom_pw) ldapsam_get_trusteddom_pw called for domain kov@DOMAIN.QA [2011/03/03 16:52:46.901874, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [sambaDomainName=kov@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa], filter => [(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=kov@DOMAIN.QA))], scope => [2] [2011/03/03 16:52:46.902693, 10] lib/smbldap.c:1424(smbldap_search_ext) Failed search for base: sambaDomainName=kov@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa, error: 32 (No such object) (unknown) [2011/03/03 16:52:46.902788, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.902805, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:46.902819, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.902821, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.902822, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.902903, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=kov@DOMAIN.QA)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:46.904199, 4] passdb/pdb_ldap.c:1598(ldapsam_getsampwnam) ldapsam_getsampwnam: Unable to locate user [kov@DOMAIN.QA] count=0 [2011/03/03 16:52:46.904385, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.904405, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.904422, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:46.904438, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.904454, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.904478, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.904537, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=kov@DOMAIN.QA)(cn=kov@DOMAIN.QA)))], scope => [2] [2011/03/03 16:52:46.905196, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(|(displayName=kov@DOMAIN.QA)(cn=kov@DOMAIN.QA))) [2011/03/03 16:52:46.905235, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.905775, 5] rpc_server/srv_lsa_nt.c:207(lookup_lsa_rids) init_lsa_rids: kov@DOMAIN.QA not found [2011/03/03 16:52:46.905808, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.905823, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 out: struct lsa_LookupNames2 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray2 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid2 sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) unknown : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2011/03/03 16:52:46.906104, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.906138, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 68 [2011/03/03 16:52:46.906159, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 108 [2011/03/03 16:52:46.906212, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.906228, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 52. [2011/03/03 16:52:46.906246, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 004c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:46.906279, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000034 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.906304, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..76] (align 0) [2011/03/03 16:52:46.906328, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.906335, 5] lib/util.c:627(show_msg) size=132 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=396 smb_uid=100 smb_mid=960 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 76 (0x4C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=77 [2011/03/03 16:52:46.906462, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 4C 00 00 00 02 00 00 ........ .L...... [0010] 00 34 00 00 00 00 00 00 00 00 00 02 00 00 00 00 .4...... ........ [0020] 00 00 00 00 00 00 00 00 00 01 00 00 00 04 00 02 ........ ........ [0030] 00 01 00 00 00 08 00 00 00 00 00 00 00 FF FF FF ........ ........ [0040] FF 00 00 00 00 00 00 00 00 73 00 00 C0 ........ .s... [2011/03/03 16:52:46.906918, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 128 [2011/03/03 16:52:46.906939, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x80 [2011/03/03 16:52:46.906958, 3] smbd/process.c:1485(process_smb) Transaction 16 of length 132 (0 toread) [2011/03/03 16:52:46.906973, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.906984, 5] lib/util.c:627(show_msg) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=396 smb_uid=100 smb_mid=1024 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17716 (0x4534) smb_bcc=61 [2011/03/03 16:52:46.907071, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... [0020] 00 14 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ [0030] 00 00 00 00 00 6F 4D 4E B9 7F 4C 00 00 .....oMN ..L.. [2011/03/03 16:52:46.907153, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19583) conn 0x2db92b0 [2011/03/03 16:52:46.907173, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.907203, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=44 params=0 setup=2 [2011/03/03 16:52:46.907221, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.907235, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.907251, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.907267, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4534) [2011/03/03 16:52:46.907296, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dbf890 max_trans_reply: 1024 [2011/03/03 16:52:46.907304, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 44 [2011/03/03 16:52:46.907325, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 44 [2011/03/03 16:52:46.907339, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2011/03/03 16:52:46.907353, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.907388, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.907402, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:46.907416, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2011/03/03 16:52:46.907430, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 002c 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:46.907477, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.907498, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.907512, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.907526, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:46.907539, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2011/03/03 16:52:46.907553, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.907572, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req [2011/03/03 16:52:46.907639, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 100 [2011/03/03 16:52:46.907693, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x64 [2011/03/03 16:52:46.907718, 3] smbd/process.c:1485(process_smb) Transaction 25 of length 104 (0 toread) [2011/03/03 16:52:46.907731, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.907743, 5] lib/util.c:627(show_msg) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=784 smb_uid=100 smb_mid=1600 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2011/03/03 16:52:46.907851, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [0010] 00 . [2011/03/03 16:52:46.907880, 3] smbd/process.c:1294(switch_message) switch message SMBntcreateX (pid 19562) conn 0x2db92b0 [2011/03/03 16:52:46.907880, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.907897, 10] smbd/nttrans.c:498(reply_ntcreate_and_X) reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = lsarpc [2011/03/03 16:52:46.907930, 4] smbd/nttrans.c:283(nt_open_pipe) nt_open_pipe: Opening pipe \lsarpc. [2011/03/03 16:52:46.907952, 5] smbd/files.c:119(file_new) allocated file structure 13605, fnum = 17701 (1 used) [2011/03/03 16:52:46.907987, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p) Create pipe requested \lsarpc [2011/03/03 16:52:46.908120, 10] rpc_server/srv_lsa_hnd.c:114(init_pipe_handle_list) init_pipe_handles: created handle list for pipe \lsarpc [2011/03/03 16:52:46.908136, 10] rpc_server/srv_lsa_hnd.c:131(init_pipe_handle_list) init_pipe_handles: pipe_handles ref count = 1 for pipe \lsarpc [2011/03/03 16:52:46.908166, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.908194, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.908209, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.908224, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.908287, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.908327, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:46.908419, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.908421, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:46.908423, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:46.908488, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:46.908504, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:46.908523, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:46.908539, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:46.908564, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:46.908590, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:46.908606, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:46.908621, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.908638, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.908638, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.908638, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.908691, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.908718, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:46.908748, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.908765, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:46.908795, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:46.908820, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:46.908822, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p) Created internal pipe \lsarpc (pipes_open=0) [2011/03/03 16:52:46.908824, 5] smbd/nttrans.c:372(do_ntcreate_pipe_open) do_ntcreate_pipe_open: open pipe = \lsarpc 0000 alloc_hint: 00000014 0004 context_id: 0000 0006 opnum : 0000 [2011/03/03 16:52:46.908943, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.908959, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.908979, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2011/03/03 16:52:46.909000, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[0].fn == 0x629770 [2011/03/03 16:52:46.909024, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000002-0000-0000-6f4d-4eb97f4c0000 [2011/03/03 16:52:46.909079, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 7F 4C 00 00 .L.. [2011/03/03 16:52:46.909114, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 02 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 7F 4C 00 00 .L.. [2011/03/03 16:52:46.909142, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd) Closed policy [2011/03/03 16:52:46.909156, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) [2011/03/03 16:52:46.909226, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 136 [2011/03/03 16:52:46.909251, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x88 [2011/03/03 16:52:46.909267, 3] smbd/process.c:1485(process_smb) Transaction 26 of length 140 (0 toread) [2011/03/03 16:52:46.909279, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.909296, 5] lib/util.c:627(show_msg) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1664 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17701 (0x4525) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2011/03/03 16:52:46.909369, 10] ../lib/util/util.c:278(_dump_data) [0000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [0010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [0020] 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xW4.4.. ....#Eg. [0030] AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [0040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2011/03/03 16:52:46.909431, 3] smbd/process.c:1294(switch_message) switch message SMBwriteX (pid 19562) conn 0x2db92b0 [2011/03/03 16:52:46.909444, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.909456, 6] smbd/pipes.c:291(reply_pipe_write_and_X) reply_pipe_write_and_X: 4525 name: lsarpc len: 72 [2011/03/03 16:52:46.909475, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 72 [2011/03/03 16:52:46.909495, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.909507, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:46.909533, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.909547, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.909558, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:46.909569, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2011/03/03 16:52:46.909589, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0048 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.909643, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.909656, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 11, flags = 3 [2011/03/03 16:52:46.909668, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.909679, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:46.909698, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2011/03/03 16:52:46.909710, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 11 [2011/03/03 16:52:46.909725, 5] rpc_server/srv_pipe.c:1641(api_pipe_bind_req) api_pipe_bind_req: decode request. 1641 [2011/03/03 16:52:46.909747, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_rb [2011/03/03 16:52:46.909766, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 00000000 0008 num_contexts: 01 000c context_id : 0000 000e num_transfer_syntaxes: 01 [2011/03/03 16:52:46.909805, 6] rpc_parse/parse_prs.c:89(prs_debug) 00000f smb_io_rpc_iface [2011/03/03 16:52:46.909818, 7] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_uuid uuid 0010 data : 12345778 0014 data : 1234 0016 data : abcd 0018 data : ef 00 001a data : 01 23 45 67 89 ab 0020 version: 00000000 [2011/03/03 16:52:46.909861, 6] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_rpc_iface [2011/03/03 16:52:46.909878, 7] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_uuid uuid 0024 data : 8a885d04 0028 data : 1ceb 002a data : 11c9 002c data : 9f e8 002e data : 08 00 2b 10 48 60 0034 version: 00000002 [2011/03/03 16:52:46.909916, 3] rpc_server/srv_pipe.c:1667(api_pipe_bind_req) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc [2011/03/03 16:52:46.909929, 5] rpc_server/srv_pipe.c:1717(api_pipe_bind_req) api_pipe_bind_req: make response. 1717 [2011/03/03 16:52:46.909941, 3] rpc_server/srv_pipe.c:998(check_bind_req) check_bind_req for \lsarpc checking lsarpc [2011/03/03 16:52:46.909956, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_ba [2011/03/03 16:52:46.909968, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 000053f0 [2011/03/03 16:52:46.909997, 6] rpc_parse/parse_prs.c:89(prs_debug) 000008 smb_io_rpc_addr_str 0008 len: 000d 000a str: \PIPE\lsarpc. [2011/03/03 16:52:46.910018, 6] rpc_parse/parse_prs.c:89(prs_debug) 000017 smb_io_rpc_results 0018 num_results: 01 001c result : 0000 001e reason : 0000 [2011/03/03 16:52:46.910052, 6] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_rpc_iface [2011/03/03 16:52:46.910065, 7] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_uuid uuid 0020 data : 8a885d04 0024 data : 1ceb 0026 data : 11c9 0028 data : 9f e8 002a data : 08 00 2b 10 48 60 0030 version: 00000002 [2011/03/03 16:52:46.910104, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.910149, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 56 [2011/03/03 16:52:46.910168, 3] smbd/pipes.c:352(pipe_write_andx_done) writeX-IPC nwritten=72 uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2011/03/03 16:52:46.910224, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.910240, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.910252, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 28 [2011/03/03 16:52:46.910273, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.910293, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:46.910307, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:46.910351, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.910379, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:46.910393, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.910404, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=396 smb_uid=100 smb_mid=1024 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:46.910409, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 . [2011/03/03 16:52:46.910651, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 59 [2011/03/03 16:52:46.910782, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x3b [2011/03/03 16:52:46.910816, 3] smbd/process.c:1485(process_smb) Transaction 27 of length 63 (0 toread) [2011/03/03 16:52:46.910835, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.910917, 5] lib/util.c:627(show_msg) size=59 [2011/03/03 16:52:46.910922, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) smb_com=0x2e got smb length of 41 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 [2011/03/03 16:52:46.910956, 6] smbd/process.c:1482(process_smb) smb_uid=100 got message type 0x0 of len 0x29 smb_mid=1728 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17701 (0x4525) smb_vwv[ 3]= 0 (0x0) [2011/03/03 16:52:46.910976, 3] smbd/process.c:1485(process_smb) smb_vwv[ 4]= 0 (0x0) Transaction 17 of length 45 (0 toread) smb_vwv[ 5]= 1024 (0x400) [2011/03/03 16:52:46.910999, 5] lib/util.c:617(show_msg) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) [2011/03/03 16:52:46.911015, 5] lib/util.c:627(show_msg) smb_vwv[ 9]= 1024 (0x400) size=41 smb_vwv[10]= 0 (0x0) smb_com=0x4 smb_vwv[11]= 0 (0x0) smb_rcls=0 smb_bcc=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 [2011/03/03 16:52:46.911044, 3] smbd/process.c:1294(switch_message) smb_mid=1088 smt_wct=3 switch message SMBreadX (pid 19562) conn 0x2db92b0 smb_vwv[ 0]=17716 (0x4534) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2011/03/03 16:52:46.911071, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.911086, 3] smbd/process.c:1294(switch_message) switch message SMBclose (pid 19583) conn 0x2db92b0 [2011/03/03 16:52:46.911101, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.911106, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) [2011/03/03 16:52:46.911113, 3] smbd/reply.c:4634(reply_close) name: \lsarpc len: 1024 close fd=-1 fnum=17716 (numopen=1) [2011/03/03 16:52:46.911133, 10] rpc_server/srv_pipe_hnd.c:854(read_from_internal_pipe) read_from_pipe: \lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2011/03/03 16:52:46.911142, 6] smbd/close.c:501(set_close_write_time) [2011/03/03 16:52:46.911159, 3] smbd/pipes.c:462(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=68 close_write_time: Sun Feb 7 07:28:15 2106 [2011/03/03 16:52:46.911265, 10] rpc_server/srv_lsa_hnd.c:290(close_policy_by_pipe) close_policy_by_pipe: deleted handle list for pipe \lsarpc [2011/03/03 16:52:46.911325, 5] smbd/files.c:497(file_free) freed files structure 17716 (0 used) [2011/03/03 16:52:46.911345, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.911356, 5] lib/util.c:627(show_msg) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1088 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:46.911557, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 172 [2011/03/03 16:52:46.911584, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xac [2011/03/03 16:52:46.911609, 3] smbd/process.c:1485(process_smb) Transaction 28 of length 176 (0 toread) [2011/03/03 16:52:46.911630, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.911644, 5] lib/util.c:627(show_msg) size=172 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=784 smb_uid=100 smb_mid=1792 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 88 (0x58) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17701 (0x4525) smb_bcc=105 [2011/03/03 16:52:46.911777, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 58 00 00 00 01 00 00 ........ .X...... [0020] 00 40 00 00 00 00 00 2C 00 00 00 02 00 06 00 00 .@....., ........ [0030] 00 00 00 00 00 06 00 00 00 5C 00 5C 00 50 00 44 ........ .\.\.P.D [0040] 00 43 00 00 00 18 00 00 00 00 00 00 00 00 00 00 .C...... ........ [0050] 00 00 00 00 00 00 00 00 00 04 00 02 00 0C 00 00 ........ ........ [0060] 00 02 00 01 00 01 08 00 00 ........ . [2011/03/03 16:52:46.912030, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19562) conn 0x2db92b0 [2011/03/03 16:52:46.912045, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.912071, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=88 params=0 setup=2 [2011/03/03 16:52:46.912094, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.912114, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.912130, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.912144, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4525) [2011/03/03 16:52:46.912162, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db50c0 max_trans_reply: 1024 [2011/03/03 16:52:46.912162, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 88 [2011/03/03 16:52:46.912162, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 88 [2011/03/03 16:52:46.912217, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 88 [2011/03/03 16:52:46.912232, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 88, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.912246, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.912260, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.912273, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:46.912290, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0058 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.912349, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.912350, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.912378, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.912391, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.912414, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 72, incoming data = 72 [2011/03/03 16:52:46.912428, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.912442, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000040 0004 context_id: 0000 0006 opnum : 002c [2011/03/03 16:52:46.912469, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 75 [2011/03/03 16:52:46.912724, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.912741, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2011/03/03 16:52:46.912766, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[44].fn == 0x621b60 [2011/03/03 16:52:46.912832, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '\\PDC' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x00000801 (2049) 1: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 1: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2011/03/03 16:52:46.913170, 4] rpc_server/srv_samr_nt.c:230(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x00000801, granted: 0x00000801) [2011/03/03 16:52:46.913170, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal) Opened policy hnd[1] [0000] 00 00 00 00 04 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 6A 4C 00 00 jL.. [2011/03/03 16:52:46.913170, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000004-0000-0000-6f4d-4eb96a4c0000 result : NT_STATUS_OK [2011/03/03 16:52:46.913170, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.913170, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 1084 [2011/03/03 16:52:46.913170, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 72 [2011/03/03 16:52:46.913170, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.913170, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:46.913170, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.913170, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.913170, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:46.913170, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.913170, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=784 smb_uid=100 smb_mid=1792 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:46.913170, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 04 00 00 ........ ........ [0020] 00 00 00 00 00 6F 4D 4E B9 6A 4C 00 00 00 00 00 .....oMN .jL..... [0030] 00 . [2011/03/03 16:52:46.914416, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 212 [2011/03/03 16:52:46.914523, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xd4 [2011/03/03 16:52:46.914544, 3] smbd/process.c:1485(process_smb) Transaction 29 of length 216 (0 toread) [2011/03/03 16:52:46.914559, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.914572, 5] lib/util.c:627(show_msg) size=212 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=784 smb_uid=100 smb_mid=1856 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 128 (0x80) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 128 (0x80) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17701 (0x4525) smb_bcc=145 [2011/03/03 16:52:46.914676, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 80 00 00 00 02 00 00 ........ ........ [0020] 00 68 00 00 00 00 00 3A 00 00 00 00 00 04 00 00 .h.....: ........ [0030] 00 00 00 00 00 6F 4D 4E B9 6A 4C 00 00 01 00 00 .....oMN .jL..... [0040] 00 01 00 00 00 20 00 22 00 00 00 02 00 11 00 00 ..... ." ........ [0050] 00 00 00 00 00 10 00 00 00 64 00 62 00 77 00 73 ........ .d.b.w.s [0060] 00 72 00 76 00 40 00 53 00 41 00 41 00 43 00 4B .r.v.@.D .O.M.A.I [0070] 00 45 00 2E 00 44 00 45 00 00 00 00 00 00 00 00 .N...Q.A ........ [0080] 00 02 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ [0090] 00 . [2011/03/03 16:52:46.914991, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19562) conn 0x2db92b0 [2011/03/03 16:52:46.915013, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.915043, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=128 params=0 setup=2 [2011/03/03 16:52:46.915066, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.915090, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.915104, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.915121, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4525) [2011/03/03 16:52:46.915140, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db50c0 max_trans_reply: 1024 [2011/03/03 16:52:46.915155, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 128 [2011/03/03 16:52:46.915236, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 128 [2011/03/03 16:52:46.915250, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 128 [2011/03/03 16:52:46.915263, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 128, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.915320, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.915333, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 112 [2011/03/03 16:52:46.915345, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 112 [2011/03/03 16:52:46.915359, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0080 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:46.915440, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.915453, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.915466, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.915484, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 112 [2011/03/03 16:52:46.915496, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 112, incoming data = 112 [2011/03/03 16:52:46.915508, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.915519, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000068 0004 context_id: 0000 0006 opnum : 003a [2011/03/03 16:52:46.915546, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.915561, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.915601, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x3a - api_rpcTNP: rpc command: LSA_LOOKUPNAMES2 [2011/03/03 16:52:46.915621, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[58].fn == 0x61f3a0 [2011/03/03 16:52:46.915694, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 in: struct lsa_LookupNames2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000004-0000-0000-6f4d-4eb96a4c0000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x0020 (32) size : 0x0020 (32) string : * string : 'dbwsrv@DOMAIN.QA' sids : * sids: struct lsa_TransSidArray2 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2011/03/03 16:52:46.915980, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 04 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 6A 4C 00 00 jL.. [2011/03/03 16:52:46.916016, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.916041, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.916068, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.916093, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.916095, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.916097, 5] rpc_server/srv_lsa_nt.c:188(lookup_lsa_rids) lookup_lsa_rids: looking up name dbwsrv@DOMAIN.QA [2011/03/03 16:52:46.916098, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: dbwsrv@DOMAIN.QA => (domain), dbwsrv@DOMAIN.QA (name) [2011/03/03 16:52:46.916197, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x043 [2011/03/03 16:52:46.916227, 10] passdb/pdb_ldap.c:6185(ldapsam_get_trusteddom_pw) ldapsam_get_trusteddom_pw called for domain dbwsrv@DOMAIN.QA [2011/03/03 16:52:46.916257, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [sambaDomainName=dbwsrv@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa], filter => [(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=dbwsrv@DOMAIN.QA))], scope => [2] [2011/03/03 16:52:46.916877, 10] lib/smbldap.c:1424(smbldap_search_ext) Failed search for base: sambaDomainName=dbwsrv@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa, error: 32 (No such object) (unknown) [2011/03/03 16:52:46.917189, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.917205, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:46.917217, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.917228, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.917240, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.917314, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=dbwsrv@DOMAIN.QA)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:46.917686, 4] passdb/pdb_ldap.c:1598(ldapsam_getsampwnam) ldapsam_getsampwnam: Unable to locate user [dbwsrv@DOMAIN.QA] count=0 [2011/03/03 16:52:46.917708, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.917729, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.917742, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:46.917753, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.917765, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.917776, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.917806, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=dbwsrv@DOMAIN.QA)(cn=dbwsrv@DOMAIN.QA)))], scope => [2] [2011/03/03 16:52:46.918420, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(|(displayName=dbwsrv@DOMAIN.QA)(cn=dbwsrv@DOMAIN.QA))) [2011/03/03 16:52:46.918486, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.918797, 5] rpc_server/srv_lsa_nt.c:207(lookup_lsa_rids) init_lsa_rids: dbwsrv@DOMAIN.QA not found [2011/03/03 16:52:46.918826, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.918847, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 out: struct lsa_LookupNames2 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray2 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid2 sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) unknown : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2011/03/03 16:52:46.919108, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.919149, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 68 [2011/03/03 16:52:46.919171, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 112 [2011/03/03 16:52:46.919272, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.919288, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 52. [2011/03/03 16:52:46.919326, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 004c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:46.919380, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000034 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.919421, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..76] (align 0) [2011/03/03 16:52:46.919438, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.919452, 5] lib/util.c:627(show_msg) size=132 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=784 smb_uid=100 smb_mid=1856 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 76 (0x4C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=77 [2011/03/03 16:52:46.919533, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 4C 00 00 00 02 00 00 ........ .L...... [0010] 00 34 00 00 00 00 00 00 00 00 00 02 00 00 00 00 .4...... ........ [0020] 00 00 00 00 00 00 00 00 00 01 00 00 00 04 00 02 ........ ........ [0030] 00 01 00 00 00 08 00 00 00 00 00 00 00 FF FF FF ........ ........ [0040] FF 00 00 00 00 00 00 00 00 73 00 00 C0 ........ .s... [2011/03/03 16:52:46.919950, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 128 [2011/03/03 16:52:46.919987, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x80 [2011/03/03 16:52:46.920011, 3] smbd/process.c:1485(process_smb) Transaction 30 of length 132 (0 toread) [2011/03/03 16:52:46.920024, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.920032, 5] lib/util.c:627(show_msg) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=784 smb_uid=100 smb_mid=1920 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17701 (0x4525) smb_bcc=61 [2011/03/03 16:52:46.920139, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... [0020] 00 14 00 00 00 00 00 00 00 00 00 00 00 04 00 00 ........ ........ [0030] 00 00 00 00 00 6F 4D 4E B9 6A 4C 00 00 .....oMN .jL.. [2011/03/03 16:52:46.920214, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19562) conn 0x2db92b0 [2011/03/03 16:52:46.920238, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.920260, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=44 params=0 setup=2 [2011/03/03 16:52:46.920277, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.920361, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.920383, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.920400, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4525) [2011/03/03 16:52:46.920414, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db50c0 max_trans_reply: 1024 [2011/03/03 16:52:46.920427, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 44 [2011/03/03 16:52:46.920440, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 44 [2011/03/03 16:52:46.920451, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2011/03/03 16:52:46.920486, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.920498, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.920510, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:46.920521, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2011/03/03 16:52:46.920533, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 002c 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:46.920688, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.920700, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.920713, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.920724, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:46.920735, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2011/03/03 16:52:46.920747, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.920758, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000014 0004 context_id: 0000 0006 opnum : 0000 [2011/03/03 16:52:46.920802, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.920816, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.920828, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2011/03/03 16:52:46.920841, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[0].fn == 0x629770 [2011/03/03 16:52:46.920862, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000004-0000-0000-6f4d-4eb96a4c0000 [2011/03/03 16:52:46.920945, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 04 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 6A 4C 00 00 jL.. [2011/03/03 16:52:46.920972, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 04 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 6A 4C 00 00 jL.. [2011/03/03 16:52:46.921014, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd) Closed policy [2011/03/03 16:52:46.921029, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2011/03/03 16:52:46.921074, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.921095, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.921110, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 28 [2011/03/03 16:52:46.921136, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.921151, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:46.921167, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:46.921235, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.921267, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:46.921281, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.921298, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=784 smb_uid=100 smb_mid=1920 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:46.921307, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 . [2011/03/03 16:52:46.921787, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 41 [2011/03/03 16:52:46.921818, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x29 [2011/03/03 16:52:46.921833, 3] smbd/process.c:1485(process_smb) Transaction 31 of length 45 (0 toread) [2011/03/03 16:52:46.921847, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.921858, 5] lib/util.c:627(show_msg) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1984 smt_wct=3 smb_vwv[ 0]=17701 (0x4525) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2011/03/03 16:52:46.921914, 3] smbd/process.c:1294(switch_message) switch message SMBclose (pid 19562) conn 0x2db92b0 [2011/03/03 16:52:46.921929, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.921950, 3] smbd/reply.c:4634(reply_close) close fd=-1 fnum=17701 (numopen=1) [2011/03/03 16:52:46.921952, 6] smbd/close.c:501(set_close_write_time) close_write_time: Sun Feb 7 07:28:15 2106 [2011/03/03 16:52:46.922118, 10] rpc_server/srv_lsa_hnd.c:290(close_policy_by_pipe) close_policy_by_pipe: deleted handle list for pipe \lsarpc [2011/03/03 16:52:46.922138, 5] smbd/files.c:497(file_free) freed files structure 17701 (0 used) [2011/03/03 16:52:46.922161, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.922171, 5] lib/util.c:627(show_msg) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=1984 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:46.955536, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 100 [2011/03/03 16:52:46.955626, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x64 [2011/03/03 16:52:46.955629, 3] smbd/process.c:1485(process_smb) Transaction 32 of length 104 (0 toread) [2011/03/03 16:52:46.955630, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.955692, 5] lib/util.c:627(show_msg) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=976 smb_uid=100 smb_mid=2048 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2011/03/03 16:52:46.955805, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [0010] 00 . [2011/03/03 16:52:46.955998, 3] smbd/process.c:1294(switch_message) switch message SMBntcreateX (pid 19503) conn 0x2db92b0 [2011/03/03 16:52:46.956094, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.956119, 10] smbd/nttrans.c:498(reply_ntcreate_and_X) reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = lsarpc [2011/03/03 16:52:46.956145, 4] smbd/nttrans.c:283(nt_open_pipe) nt_open_pipe: Opening pipe \lsarpc. [2011/03/03 16:52:46.956170, 5] smbd/files.c:119(file_new) allocated file structure 13676, fnum = 17772 (1 used) [2011/03/03 16:52:46.956206, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p) Create pipe requested \lsarpc [2011/03/03 16:52:46.956272, 10] rpc_server/srv_lsa_hnd.c:114(init_pipe_handle_list) init_pipe_handles: created handle list for pipe \lsarpc [2011/03/03 16:52:46.956292, 10] rpc_server/srv_lsa_hnd.c:131(init_pipe_handle_list) init_pipe_handles: pipe_handles ref count = 1 for pipe \lsarpc [2011/03/03 16:52:46.956318, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.956338, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.956351, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.956370, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.956401, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.956450, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:46.956547, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.956577, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:46.956603, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:46.956617, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:46.956634, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:46.956661, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:46.956664, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:46.956664, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:46.956680, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:46.956696, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:46.956716, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.956790, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.956805, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.956820, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.956834, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.956872, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:46.956906, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.956922, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:46.956947, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:46.956947, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:46.957004, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p) Created internal pipe \lsarpc (pipes_open=0) [2011/03/03 16:52:46.957029, 5] smbd/nttrans.c:372(do_ntcreate_pipe_open) do_ntcreate_pipe_open: open pipe = \lsarpc [2011/03/03 16:52:46.958165, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 136 [2011/03/03 16:52:46.958208, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x88 [2011/03/03 16:52:46.958231, 3] smbd/process.c:1485(process_smb) Transaction 33 of length 140 (0 toread) [2011/03/03 16:52:46.958254, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.958280, 5] lib/util.c:627(show_msg) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2112 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17772 (0x456C) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2011/03/03 16:52:46.958289, 10] ../lib/util/util.c:278(_dump_data) [0000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [0010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [0020] 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xW4.4.. ....#Eg. [0030] AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [0040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2011/03/03 16:52:46.958427, 3] smbd/process.c:1294(switch_message) switch message SMBwriteX (pid 19503) conn 0x2db92b0 [2011/03/03 16:52:46.958443, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.958458, 6] smbd/pipes.c:291(reply_pipe_write_and_X) reply_pipe_write_and_X: 456c name: lsarpc len: 72 [2011/03/03 16:52:46.958480, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 72 [2011/03/03 16:52:46.958503, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.958518, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:46.958533, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.958547, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.958548, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:46.958588, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2011/03/03 16:52:46.958603, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0048 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.958670, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.958685, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 11, flags = 3 [2011/03/03 16:52:46.958700, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.958714, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:46.958728, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2011/03/03 16:52:46.958742, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 11 [2011/03/03 16:52:46.958742, 5] rpc_server/srv_pipe.c:1641(api_pipe_bind_req) api_pipe_bind_req: decode request. 1641 [2011/03/03 16:52:46.958805, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_rb [2011/03/03 16:52:46.958821, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 00000000 0008 num_contexts: 01 000c context_id : 0000 000e num_transfer_syntaxes: 01 [2011/03/03 16:52:46.958882, 6] rpc_parse/parse_prs.c:89(prs_debug) 00000f smb_io_rpc_iface [2011/03/03 16:52:46.958896, 7] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_uuid uuid 0010 data : 12345778 0014 data : 1234 0016 data : abcd 0018 data : ef 00 001a data : 01 23 45 67 89 ab 0020 version: 00000000 [2011/03/03 16:52:46.958944, 6] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_rpc_iface [2011/03/03 16:52:46.958957, 7] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_uuid uuid 0024 data : 8a885d04 0028 data : 1ceb 002a data : 11c9 002c data : 9f e8 002e data : 08 00 2b 10 48 60 0034 version: 00000002 [2011/03/03 16:52:46.959004, 3] rpc_server/srv_pipe.c:1667(api_pipe_bind_req) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc [2011/03/03 16:52:46.959025, 5] rpc_server/srv_pipe.c:1717(api_pipe_bind_req) api_pipe_bind_req: make response. 1717 [2011/03/03 16:52:46.959040, 3] rpc_server/srv_pipe.c:998(check_bind_req) check_bind_req for \lsarpc checking lsarpc [2011/03/03 16:52:46.959058, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_ba [2011/03/03 16:52:46.959078, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 000053f0 [2011/03/03 16:52:46.959102, 6] rpc_parse/parse_prs.c:89(prs_debug) 000008 smb_io_rpc_addr_str 0008 len: 000d 000a str: \PIPE\lsarpc. [2011/03/03 16:52:46.959126, 6] rpc_parse/parse_prs.c:89(prs_debug) 000017 smb_io_rpc_results 0018 num_results: 01 001c result : 0000 001e reason : 0000 [2011/03/03 16:52:46.959152, 6] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_rpc_iface [2011/03/03 16:52:46.959152, 7] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_uuid uuid 0020 data : 8a885d04 0024 data : 1ceb 0026 data : 11c9 0028 data : 9f e8 002a data : 08 00 2b 10 48 60 0030 version: 00000002 [2011/03/03 16:52:46.959222, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.959279, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 56 [2011/03/03 16:52:46.959306, 3] smbd/pipes.c:352(pipe_write_andx_done) writeX-IPC nwritten=72 [2011/03/03 16:52:46.960062, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 59 [2011/03/03 16:52:46.960089, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x3b [2011/03/03 16:52:46.960108, 3] smbd/process.c:1485(process_smb) Transaction 34 of length 63 (0 toread) [2011/03/03 16:52:46.960298, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.960307, 5] lib/util.c:627(show_msg) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2176 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17772 (0x456C) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2011/03/03 16:52:46.960403, 3] smbd/process.c:1294(switch_message) switch message SMBreadX (pid 19503) conn 0x2db92b0 [2011/03/03 16:52:46.960418, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.960434, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.960450, 10] rpc_server/srv_pipe_hnd.c:854(read_from_internal_pipe) read_from_pipe: \lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2011/03/03 16:52:46.960476, 3] smbd/pipes.c:462(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=68 [2011/03/03 16:52:46.961475, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 172 [2011/03/03 16:52:46.961492, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xac [2011/03/03 16:52:46.961505, 3] smbd/process.c:1485(process_smb) Transaction 35 of length 176 (0 toread) [2011/03/03 16:52:46.961517, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.961526, 5] lib/util.c:627(show_msg) size=172 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=976 smb_uid=100 smb_mid=2240 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 88 (0x58) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17772 (0x456C) smb_bcc=105 [2011/03/03 16:52:46.961612, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 58 00 00 00 01 00 00 ........ .X...... [0020] 00 40 00 00 00 00 00 2C 00 00 00 02 00 06 00 00 .@....., ........ [0030] 00 00 00 00 00 06 00 00 00 5C 00 5C 00 50 00 44 ........ .\.\.P.D [0040] 00 43 00 00 00 18 00 00 00 00 00 00 00 00 00 00 .C...... ........ [0050] 00 00 00 00 00 00 00 00 00 04 00 02 00 0C 00 00 ........ ........ [0060] 00 02 00 01 00 01 08 00 00 ........ . [2011/03/03 16:52:46.961692, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19503) conn 0x2db92b0 [2011/03/03 16:52:46.961705, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.961720, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=88 params=0 setup=2 [2011/03/03 16:52:46.961738, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.961749, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.961766, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.961785, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 456c) [2011/03/03 16:52:46.961798, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db56f0 max_trans_reply: 1024 [2011/03/03 16:52:46.961811, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 88 [2011/03/03 16:52:46.961823, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 88 [2011/03/03 16:52:46.961835, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 88 [2011/03/03 16:52:46.961846, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 88, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.961859, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.961877, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.961915, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:46.961927, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0058 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.961980, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.961993, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.962009, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.962020, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:46.962031, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 72, incoming data = 72 [2011/03/03 16:52:46.962043, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.962054, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000040 0004 context_id: 0000 0006 opnum : 002c [2011/03/03 16:52:46.962084, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 75 [2011/03/03 16:52:46.962113, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.962126, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2011/03/03 16:52:46.962150, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[44].fn == 0x621b60 [2011/03/03 16:52:46.962177, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '\\PDC' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x00000801 (2049) 1: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 1: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2011/03/03 16:52:46.962391, 4] rpc_server/srv_samr_nt.c:230(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x00000801, granted: 0x00000801) [2011/03/03 16:52:46.962481, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal) Opened policy hnd[1] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 2F 4C 00 00 /L.. [2011/03/03 16:52:46.962525, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-6f4d-4eb92f4c0000 result : NT_STATUS_OK [2011/03/03 16:52:46.962609, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.962623, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 1084 [2011/03/03 16:52:46.962636, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 72 [2011/03/03 16:52:46.962653, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.962675, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:46.962692, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:46.962750, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.962788, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:46.962809, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.962818, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=976 smb_uid=100 smb_mid=2240 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:46.962880, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 05 00 00 ........ ........ [0020] 00 00 00 00 00 6F 4D 4E B9 2F 4C 00 00 00 00 00 .....oMN ./L..... [0030] 00 . [2011/03/03 16:52:46.963966, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 208 [2011/03/03 16:52:46.964002, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xd0 [2011/03/03 16:52:46.964022, 3] smbd/process.c:1485(process_smb) Transaction 36 of length 212 (0 toread) [2011/03/03 16:52:46.964042, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.964056, 5] lib/util.c:627(show_msg) size=208 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=976 smb_uid=100 smb_mid=2304 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 124 (0x7C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17772 (0x456C) smb_bcc=141 [2011/03/03 16:52:46.964186, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 7C 00 00 00 02 00 00 ........ .|...... [0020] 00 64 00 00 00 00 00 3A 00 00 00 00 00 05 00 00 .d.....: ........ [0030] 00 00 00 00 00 6F 4D 4E B9 2F 4C 00 00 01 00 00 .....oMN ./L..... [0040] 00 01 00 00 00 1A 00 1C 00 00 00 02 00 0E 00 00 ........ ........ [0050] 00 00 00 00 00 0D 00 00 00 62 00 72 00 64 00 40 ........ .b.r.d.@ [0060] 00 53 00 41 00 41 00 43 00 4B 00 45 00 2E 00 44 .D.O.M.A .I.N...Q [0070] 00 45 00 00 00 00 00 00 00 00 00 00 00 02 00 00 .A...... ........ [0080] 00 00 00 00 00 00 00 00 00 02 00 00 00 ........ ..... [2011/03/03 16:52:46.964306, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19503) conn 0x2db92b0 [2011/03/03 16:52:46.964319, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.964332, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=124 params=0 setup=2 [2011/03/03 16:52:46.964346, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.964357, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.964375, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.964388, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 456c) [2011/03/03 16:52:46.964400, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db56f0 max_trans_reply: 1024 [2011/03/03 16:52:46.964412, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 124 [2011/03/03 16:52:46.964424, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 124 [2011/03/03 16:52:46.964436, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 124 [2011/03/03 16:52:46.964447, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 124, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.964460, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.964479, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:46.964491, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 108 [2011/03/03 16:52:46.964502, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 007c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:46.964547, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.964559, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.964574, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.964587, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:46.964598, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 108, incoming data = 108 [2011/03/03 16:52:46.964610, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.964621, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000064 0004 context_id: 0000 0006 opnum : 003a [2011/03/03 16:52:46.964643, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.964686, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.964700, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x3a - api_rpcTNP: rpc command: LSA_LOOKUPNAMES2 [2011/03/03 16:52:46.964717, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[58].fn == 0x61f3a0 [2011/03/03 16:52:46.964734, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 in: struct lsa_LookupNames2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-6f4d-4eb92f4c0000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001a (26) size : 0x001a (26) string : * string : 'brd@DOMAIN.QA' sids : * sids: struct lsa_TransSidArray2 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2011/03/03 16:52:46.964887, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 2F 4C 00 00 /L.. [2011/03/03 16:52:46.964918, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.964933, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:46.964935, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.964936, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.964988, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.965015, 5] rpc_server/srv_lsa_nt.c:188(lookup_lsa_rids) lookup_lsa_rids: looking up name brd@DOMAIN.QA [2011/03/03 16:52:46.965031, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: brd@DOMAIN.QA => (domain), brd@DOMAIN.QA (name) [2011/03/03 16:52:46.965046, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x043 [2011/03/03 16:52:46.965061, 10] passdb/pdb_ldap.c:6185(ldapsam_get_trusteddom_pw) ldapsam_get_trusteddom_pw called for domain brd@DOMAIN.QA [2011/03/03 16:52:46.965088, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [sambaDomainName=brd@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa], filter => [(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=brd@DOMAIN.QA))], scope => [2] [2011/03/03 16:52:46.965799, 10] lib/smbldap.c:1424(smbldap_search_ext) Failed search for base: sambaDomainName=brd@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa, error: 32 (No such object) (unknown) [2011/03/03 16:52:46.966208, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.966232, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:46.966253, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.966267, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.966292, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.966430, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=brd@DOMAIN.QA)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:46.966902, 4] passdb/pdb_ldap.c:1598(ldapsam_getsampwnam) ldapsam_getsampwnam: Unable to locate user [brd@DOMAIN.QA] count=0 [2011/03/03 16:52:46.966907, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.966926, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.966941, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:46.966955, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:46.966976, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:46.966990, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:46.967022, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=brd@DOMAIN.QA)(cn=brd@DOMAIN.QA)))], scope => [2] [2011/03/03 16:52:46.967636, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(|(displayName=brd@DOMAIN.QA)(cn=brd@DOMAIN.QA))) [2011/03/03 16:52:46.967663, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:46.968044, 5] rpc_server/srv_lsa_nt.c:207(lookup_lsa_rids) init_lsa_rids: brd@DOMAIN.QA not found [2011/03/03 16:52:46.968082, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:46.968103, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 out: struct lsa_LookupNames2 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray2 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid2 sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) unknown : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2011/03/03 16:52:46.968268, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.968347, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 68 [2011/03/03 16:52:46.968363, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 108 [2011/03/03 16:52:46.968389, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.968403, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 52. [2011/03/03 16:52:46.968422, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 004c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:46.968492, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000034 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.968520, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..76] (align 0) [2011/03/03 16:52:46.968533, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.968542, 5] lib/util.c:627(show_msg) size=132 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=976 smb_uid=100 smb_mid=2304 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 76 (0x4C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=77 [2011/03/03 16:52:46.968615, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 4C 00 00 00 02 00 00 ........ .L...... [0010] 00 34 00 00 00 00 00 00 00 00 00 02 00 00 00 00 .4...... ........ [0020] 00 00 00 00 00 00 00 00 00 01 00 00 00 04 00 02 ........ ........ [0030] 00 01 00 00 00 08 00 00 00 00 00 00 00 FF FF FF ........ ........ [0040] FF 00 00 00 00 00 00 00 00 73 00 00 C0 ........ .s... [2011/03/03 16:52:46.970032, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 128 [2011/03/03 16:52:46.970293, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x80 [2011/03/03 16:52:46.970406, 3] smbd/process.c:1485(process_smb) Transaction 37 of length 132 (0 toread) [2011/03/03 16:52:46.970421, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.970434, 5] lib/util.c:627(show_msg) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=976 smb_uid=100 smb_mid=2368 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17772 (0x456C) smb_bcc=61 [2011/03/03 16:52:46.970472, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... [0020] 00 14 00 00 00 00 00 00 00 00 00 00 00 05 00 00 ........ ........ [0030] 00 00 00 00 00 6F 4D 4E B9 2F 4C 00 00 .....oMN ./L.. [2011/03/03 16:52:46.970479, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19503) conn 0x2db92b0 [2011/03/03 16:52:46.970479, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.970527, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=44 params=0 setup=2 [2011/03/03 16:52:46.970551, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:46.970575, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:46.970592, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:46.970710, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 456c) [2011/03/03 16:52:46.970748, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db56f0 max_trans_reply: 1024 [2011/03/03 16:52:46.970849, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 44 [2011/03/03 16:52:46.970851, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 44 [2011/03/03 16:52:46.970853, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2011/03/03 16:52:46.970920, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:46.970940, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:46.970954, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:46.970968, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2011/03/03 16:52:46.971107, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 002c 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:46.971175, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:46.971204, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:46.971319, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:46.971361, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:46.971375, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2011/03/03 16:52:46.971397, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:46.971420, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000014 0004 context_id: 0000 0006 opnum : 0000 [2011/03/03 16:52:46.971454, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.971471, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:46.971575, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2011/03/03 16:52:46.971599, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[0].fn == 0x629770 [2011/03/03 16:52:46.971656, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-6f4d-4eb92f4c0000 [2011/03/03 16:52:46.971735, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 2F 4C 00 00 /L.. [2011/03/03 16:52:46.971766, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 6F 4D 4E B9 ........ ....oMN. [0010] 2F 4C 00 00 /L.. [2011/03/03 16:52:46.971792, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd) Closed policy [2011/03/03 16:52:46.971808, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2011/03/03 16:52:46.971886, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:46.971928, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:46.972006, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 28 [2011/03/03 16:52:46.972047, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:46.972073, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:46.972094, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:46.972156, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:46.972201, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:46.972225, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.972236, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=976 smb_uid=100 smb_mid=2368 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:46.972301, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 . [2011/03/03 16:52:46.973694, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 41 [2011/03/03 16:52:46.973932, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x29 [2011/03/03 16:52:46.973954, 3] smbd/process.c:1485(process_smb) Transaction 38 of length 45 (0 toread) [2011/03/03 16:52:46.973969, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.973982, 5] lib/util.c:627(show_msg) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2432 smt_wct=3 smb_vwv[ 0]=17772 (0x456C) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2011/03/03 16:52:46.974053, 3] smbd/process.c:1294(switch_message) switch message SMBclose (pid 19503) conn 0x2db92b0 [2011/03/03 16:52:46.974073, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:46.974100, 3] smbd/reply.c:4634(reply_close) close fd=-1 fnum=17772 (numopen=1) [2011/03/03 16:52:46.974141, 6] smbd/close.c:501(set_close_write_time) close_write_time: Sun Feb 7 07:28:15 2106 [2011/03/03 16:52:46.974371, 10] rpc_server/srv_lsa_hnd.c:290(close_policy_by_pipe) close_policy_by_pipe: deleted handle list for pipe \lsarpc [2011/03/03 16:52:46.974424, 5] smbd/files.c:497(file_free) freed files structure 17772 (0 used) [2011/03/03 16:52:46.974445, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:46.974456, 5] lib/util.c:627(show_msg) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2432 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:47.043108, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 39 [2011/03/03 16:52:47.043214, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x27 [2011/03/03 16:52:47.043262, 3] smbd/process.c:1485(process_smb) Transaction 46 of length 43 (0 toread) [2011/03/03 16:52:47.043282, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.043295, 5] lib/util.c:627(show_msg) size=39 smb_com=0x74 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=100 smb_mid=2944 smt_wct=2 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_bcc=0 [2011/03/03 16:52:47.043370, 3] smbd/process.c:1294(switch_message) switch message SMBulogoffX (pid 19486) conn 0x0 [2011/03/03 16:52:47.043422, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.043455, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.043480, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.043519, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.043639, 3] smbd/reply.c:2055(reply_ulogoffX) ulogoffX vuid=100 [2011/03/03 16:52:47.043939, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 35 [2011/03/03 16:52:47.043956, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x23 [2011/03/03 16:52:47.043969, 3] smbd/process.c:1485(process_smb) Transaction 47 of length 39 (0 toread) [2011/03/03 16:52:47.043981, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.043990, 5] lib/util.c:627(show_msg) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=3008 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:47.044053, 3] smbd/process.c:1294(switch_message) switch message SMBtdis (pid 19486) conn 0x2db92b0 [2011/03/03 16:52:47.044066, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.044078, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.044089, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.044112, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.044131, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.044150, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.044161, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.044178, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.044190, 3] smbd/service.c:1251(close_cnum) pwkpc (192.9.211.153) closed connection to service IPC$ [2011/03/03 16:52:47.044250, 3] smbd/connection.c:31(yield_connection) Yielding connection to IPC$ [2011/03/03 16:52:47.044331, 10] lib/dbwrap_tdb.c:100(db_tdb_fetch_locked) Locking key 1E4C0000FFFFFFFF0100 [2011/03/03 16:52:47.044402, 10] lib/dbwrap_tdb.c:129(db_tdb_fetch_locked) Allocated locked data 0x0x2db56a0 [2011/03/03 16:52:47.044449, 10] lib/dbwrap_tdb.c:42(db_tdb_record_destr) Unlocking key 1E4C0000FFFFFFFF0100 [2011/03/03 16:52:47.044497, 4] smbd/vfs.c:721(vfs_ChDir) vfs_ChDir to / [2011/03/03 16:52:47.044530, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.044543, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.044555, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.044574, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.044624, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.044635, 5] lib/util.c:627(show_msg) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=3008 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:47.045039, 5] lib/util_sock.c:462(read_fd_with_timeout) read_fd_with_timeout: blocking read. EOF from client. [2011/03/03 16:52:47.045059, 10] smbd/process.c:286(receive_smb_raw_talloc) receive_smb_raw: NT_STATUS_END_OF_FILE [2011/03/03 16:52:47.045169, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.045183, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.045195, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.045221, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.045244, 3] smbd/connection.c:31(yield_connection) Yielding connection to [2011/03/03 16:52:47.045292, 10] lib/dbwrap_tdb.c:100(db_tdb_fetch_locked) Locking key 1E4C0000FFFFFFFFFFFF [2011/03/03 16:52:47.045534, 10] lib/dbwrap_tdb.c:129(db_tdb_fetch_locked) Allocated locked data 0x0x2d7c210 [2011/03/03 16:52:47.045554, 10] lib/dbwrap_tdb.c:42(db_tdb_record_destr) Unlocking key 1E4C0000FFFFFFFFFFFF [2011/03/03 16:52:47.045755, 3] smbd/server.c:906(exit_server_common) Server exit (failed to receive smb request) [2011/03/03 16:52:47.089403, 5] lib/util_sock.c:304(print_socket_options) Socket options: SO_KEEPALIVE = 1 SO_REUSEADDR = 1 SO_BROADCAST = 0 TCP_NODELAY = 1 TCP_KEEPCNT = 9 TCP_KEEPIDLE = 7200 TCP_KEEPINTVL = 75 IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_SNDBUF = 16384 SO_RCVBUF = 87380 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 TCP_QUICKACK = 1 [2011/03/03 16:52:47.090445, 5] lib/util_sock.c:304(print_socket_options) Socket options: SO_KEEPALIVE = 1 SO_REUSEADDR = 1 SO_BROADCAST = 0 TCP_NODELAY = 1 TCP_KEEPCNT = 9 TCP_KEEPIDLE = 7200 TCP_KEEPINTVL = 75 IPTOS_LOWDELAY = 0 IPTOS_THROUGHPUT = 0 SO_SNDBUF = 16384 SO_RCVBUF = 87380 SO_SNDLOWAT = 1 SO_RCVLOWAT = 1 SO_SNDTIMEO = 0 SO_RCVTIMEO = 0 TCP_QUICKACK = 1 [2011/03/03 16:52:47.090718, 6] param/loadparm.c:7156(lp_file_list_changed) lp_file_list_changed() file /etc/samba/local.conf -> /etc/samba/local.conf last mod_time: Tue May 11 16:47:00 2010 file /etc/samba/printers.conf -> /etc/samba/printers.conf last mod_time: Mon Jul 19 20:35:11 2010 file /etc/samba/shares.conf -> /etc/samba/shares.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/installs.conf -> /etc/samba/installs.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/base.conf -> /etc/samba/base.conf last mod_time: Thu Jan 6 19:15:37 2011 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Wed Jan 26 22:30:30 2011 [2011/03/03 16:52:47.091221, 3] smbd/oplock.c:894(init_oplocks) init_oplocks: initializing messages. [2011/03/03 16:52:47.091403, 3] smbd/oplock_linux.c:224(linux_init_kernel_oplocks) Linux kernel oplocks enabled [2011/03/03 16:52:47.091424, 5] lib/messages.c:329(messaging_deregister) Deregistering messaging pointer for type 1 - private_data=(nil) [2011/03/03 16:52:47.091458, 10] smbd/process.c:740(event_add_idle) event_add_idle: idle_evt(keepalive) 0x2dc4180 [2011/03/03 16:52:47.091513, 10] smbd/process.c:740(event_add_idle) event_add_idle: idle_evt(deadtime) 0x2db2750 [2011/03/03 16:52:47.091529, 10] smbd/process.c:740(event_add_idle) event_add_idle: idle_evt(housekeeping) 0x2db8390 [2011/03/03 16:52:47.091707, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 133 [2011/03/03 16:52:47.091740, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x85 [2011/03/03 16:52:47.091755, 3] smbd/process.c:1485(process_smb) Transaction 0 of length 137 (0 toread) [2011/03/03 16:52:47.091767, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.091828, 5] lib/util.c:627(show_msg) size=133 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51283 smb_tid=0 smb_pid=65279 smb_uid=0 smb_mid=0 smt_wct=0 smb_bcc=98 [2011/03/03 16:52:47.091867, 10] ../lib/util/util.c:278(_dump_data) [0000] 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 .PC NETW ORK PROG [0010] 52 41 4D 20 31 2E 30 00 02 4C 41 4E 4D 41 4E 31 RAM 1.0. .LANMAN1 [0020] 2E 30 00 02 57 69 6E 64 6F 77 73 20 66 6F 72 20 .0..Wind ows for [0030] 57 6F 72 6B 67 72 6F 75 70 73 20 33 2E 31 61 00 Workgrou ps 3.1a. [0040] 02 4C 4D 31 2E 32 58 30 30 32 00 02 4C 41 4E 4D .LM1.2X0 02..LANM [0050] 41 4E 32 2E 31 00 02 4E 54 20 4C 4D 20 30 2E 31 AN2.1..N T LM 0.1 [0060] 32 00 2. [2011/03/03 16:52:47.092015, 3] smbd/process.c:1294(switch_message) switch message SMBnegprot (pid 19600) conn 0x0 [2011/03/03 16:52:47.092044, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.092069, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.092134, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.092170, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.092388, 3] smbd/negprot.c:586(reply_negprot) Requested protocol [PC NETWORK PROGRAM 1.0] [2011/03/03 16:52:47.092425, 3] smbd/negprot.c:586(reply_negprot) Requested protocol [LANMAN1.0] [2011/03/03 16:52:47.092453, 3] smbd/negprot.c:586(reply_negprot) Requested protocol [Windows for Workgroups 3.1a] [2011/03/03 16:52:47.092467, 3] smbd/negprot.c:586(reply_negprot) Requested protocol [LM1.2X002] [2011/03/03 16:52:47.092515, 3] smbd/negprot.c:586(reply_negprot) Requested protocol [LANMAN2.1] [2011/03/03 16:52:47.092530, 3] smbd/negprot.c:586(reply_negprot) Requested protocol [NT LM 0.12] [2011/03/03 16:52:47.092551, 10] lib/util.c:1969(set_remote_arch) set_remote_arch: Client arch is 'Win2K' [2011/03/03 16:52:47.092572, 6] param/loadparm.c:7156(lp_file_list_changed) lp_file_list_changed() file /etc/samba/local.conf -> /etc/samba/local.conf last mod_time: Tue May 11 16:47:00 2010 file /etc/samba/printers.conf -> /etc/samba/printers.conf last mod_time: Mon Jul 19 20:35:11 2010 file /etc/samba/shares.conf -> /etc/samba/shares.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/installs.conf -> /etc/samba/installs.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/base.conf -> /etc/samba/base.conf last mod_time: Thu Jan 6 19:15:37 2011 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Wed Jan 26 22:30:30 2011 [2011/03/03 16:52:47.092667, 5] smbd/connection.c:142(claim_connection) claiming [] [2011/03/03 16:52:47.092754, 10] lib/dbwrap_tdb.c:100(db_tdb_fetch_locked) Locking key 904C0000FFFFFFFFFFFF [2011/03/03 16:52:47.092818, 10] lib/dbwrap_tdb.c:129(db_tdb_fetch_locked) Allocated locked data 0x0x2d85450 [2011/03/03 16:52:47.092863, 10] lib/dbwrap_tdb.c:42(db_tdb_record_destr) Unlocking key 904C0000FFFFFFFFFFFF [2011/03/03 16:52:47.093004, 6] param/loadparm.c:7156(lp_file_list_changed) lp_file_list_changed() file /etc/samba/local.conf -> /etc/samba/local.conf last mod_time: Tue May 11 16:47:00 2010 file /etc/samba/printers.conf -> /etc/samba/printers.conf last mod_time: Mon Jul 19 20:35:11 2010 file /etc/samba/shares.conf -> /etc/samba/shares.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/installs.conf -> /etc/samba/installs.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/base.conf -> /etc/samba/base.conf last mod_time: Thu Jan 6 19:15:37 2011 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Wed Jan 26 22:30:30 2011 [2011/03/03 16:52:47.093186, 3] smbd/negprot.c:404(reply_nt1) using SPNEGO [2011/03/03 16:52:47.093220, 3] smbd/negprot.c:691(reply_negprot) Selected protocol NT LM 0.12 [2011/03/03 16:52:47.093233, 5] smbd/negprot.c:698(reply_negprot) negprot index=5 [2011/03/03 16:52:47.093245, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.093254, 5] lib/util.c:627(show_msg) size=127 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51283 smb_tid=0 smb_pid=65279 smb_uid=0 smb_mid=0 smt_wct=17 smb_vwv[ 0]= 5 (0x5) smb_vwv[ 1]=12803 (0x3203) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]=65280 (0xFF00) smb_vwv[ 4]= 255 (0xFF) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]=36864 (0x9000) smb_vwv[ 8]= 76 (0x4C) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]=32995 (0x80E3) smb_vwv[11]=32896 (0x8080) smb_vwv[12]=38769 (0x9771) smb_vwv[13]=47882 (0xBB0A) smb_vwv[14]=52185 (0xCBD9) smb_vwv[15]=50177 (0xC401) smb_vwv[16]= 255 (0xFF) smb_bcc=58 [2011/03/03 16:52:47.093368, 10] ../lib/util/util.c:278(_dump_data) [0000] 70 64 63 00 00 00 00 00 00 00 00 00 00 00 00 00 pdc..... ........ [0010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... [0020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... [0030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE [2011/03/03 16:52:47.094658, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 236 [2011/03/03 16:52:47.094963, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xec [2011/03/03 16:52:47.094992, 3] smbd/process.c:1485(process_smb) Transaction 1 of length 240 (0 toread) [2011/03/03 16:52:47.095017, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.095030, 5] lib/util.c:627(show_msg) size=236 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=0 smb_mid=64 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 236 (0xEC) smb_vwv[ 2]=65535 (0xFFFF) smb_vwv[ 3]= 50 (0x32) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 74 (0x4A) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 212 (0xD4) smb_vwv[11]=40960 (0xA000) smb_bcc=177 [2011/03/03 16:52:47.095116, 10] ../lib/util/util.c:278(_dump_data) [0000] 60 48 06 06 2B 06 01 05 05 02 A0 3E 30 3C A0 0E `H..+... ...>0<.. [0010] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A2 2A 0...+... ..7....* [0020] 04 28 4E 54 4C 4D 53 53 50 00 01 00 00 00 07 82 .(NTLMSS P....... [0030] 08 A2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 05 01 28 0A 00 00 00 0F 00 57 00 69 00 6E ....(... ...W.i.n [0050] 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 .d.o.w.s . .2.0.0 [0060] 00 32 00 20 00 53 00 65 00 72 00 76 00 69 00 63 .2. .S.e .r.v.i.c [0070] 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 .e. .P.a .c.k. .3 [0080] 00 20 00 32 00 36 00 30 00 30 00 00 00 57 00 69 . .2.6.0 .0...W.i [0090] 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 .n.d.o.w .s. .2.0 [00A0] 00 30 00 32 00 20 00 35 00 2E 00 31 00 00 00 00 .0.2. .5 ...1.... [00B0] 00 . [2011/03/03 16:52:47.095295, 3] smbd/process.c:1294(switch_message) switch message SMBsesssetupX (pid 19600) conn 0x0 [2011/03/03 16:52:47.095327, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.095350, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.095358, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.095400, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.095432, 3] smbd/sesssetup.c:1435(reply_sesssetup_and_X) wct=12 flg2=0xc807 [2011/03/03 16:52:47.095465, 2] smbd/sesssetup.c:1390(setup_new_vc_session) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2011/03/03 16:52:47.095529, 3] smbd/sesssetup.c:1189(reply_sesssetup_and_X_spnego) Doing spnego session setup [2011/03/03 16:52:47.095557, 3] smbd/sesssetup.c:1231(reply_sesssetup_and_X_spnego) NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2011/03/03 16:52:47.095578, 10] lib/util.c:1969(set_remote_arch) set_remote_arch: Client arch is 'WinXP' [2011/03/03 16:52:47.095675, 10] smbd/password.c:184(register_initial_vuid) register_initial_vuid: allocated vuid = 100 [2011/03/03 16:52:47.095771, 10] smbd/sesssetup.c:1134(check_spnego_blob_complete) check_spnego_blob_complete: needed_len = 74, pblob->length = 74 [2011/03/03 16:52:47.096252, 5] smbd/sesssetup.c:753(parse_spnego_mechanisms) parse_spnego_mechanisms: Got OID 1.3.6.1.4.1.311.2.2.10 [2011/03/03 16:52:47.096283, 3] smbd/sesssetup.c:805(reply_spnego_negotiate) reply_spnego_negotiate: Got secblob of size 40 [2011/03/03 16:52:47.096335, 5] auth/auth.c:520(make_auth_context_subsystem) Using specified auth order [2011/03/03 16:52:47.096367, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend sam [2011/03/03 16:52:47.096392, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'sam' [2011/03/03 16:52:47.096409, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend sam_ignoredomain [2011/03/03 16:52:47.096421, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'sam_ignoredomain' [2011/03/03 16:52:47.096436, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend unix [2011/03/03 16:52:47.096450, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'unix' [2011/03/03 16:52:47.096474, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend winbind [2011/03/03 16:52:47.096486, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'winbind' [2011/03/03 16:52:47.096498, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend wbc [2011/03/03 16:52:47.096509, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'wbc' [2011/03/03 16:52:47.096526, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend smbserver [2011/03/03 16:52:47.096537, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'smbserver' [2011/03/03 16:52:47.096552, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend trustdomain [2011/03/03 16:52:47.096558, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'trustdomain' [2011/03/03 16:52:47.096591, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend ntdomain [2011/03/03 16:52:47.096618, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'ntdomain' [2011/03/03 16:52:47.096640, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend guest [2011/03/03 16:52:47.096662, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'guest' [2011/03/03 16:52:47.096676, 5] auth/auth.c:46(smb_register_auth) Attempting to register auth backend netlogond [2011/03/03 16:52:47.096698, 5] auth/auth.c:58(smb_register_auth) Successfully added auth method 'netlogond' [2011/03/03 16:52:47.096712, 5] auth/auth.c:383(load_auth_module) load_auth_module: Attempting to find an auth method to match guest [2011/03/03 16:52:47.096739, 5] auth/auth.c:408(load_auth_module) load_auth_module: auth method guest has a valid init [2011/03/03 16:52:47.096739, 5] auth/auth.c:383(load_auth_module) load_auth_module: Attempting to find an auth method to match sam [2011/03/03 16:52:47.096783, 5] auth/auth.c:408(load_auth_module) load_auth_module: auth method sam has a valid init [2011/03/03 16:52:47.096801, 5] auth/auth.c:383(load_auth_module) load_auth_module: Attempting to find an auth method to match winbind [2011/03/03 16:52:47.096827, 5] auth/auth.c:408(load_auth_module) load_auth_module: auth method winbind has a valid init [2011/03/03 16:52:47.096897, 3] libsmb/ntlmssp.c:65(debug_ntlmssp_flags) Got NTLMSSP neg_flags=0xa2088207 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_NEGOTIATE_OEM NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_56 [2011/03/03 16:52:47.097096, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) &negotiate: struct NEGOTIATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmNegotiate (1) NegotiateFlags : 0xa2088207 (2718466567) 1: NTLMSSP_NEGOTIATE_UNICODE 1: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 0: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 0: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 DomainNameLen : 0x0000 (0) DomainNameMaxLen : 0x0000 (0) DomainName : NULL WorkstationLen : 0x0000 (0) WorkstationMaxLen : 0x0000 (0) Workstation : NULL Version: struct VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_5 (5) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_1 (1) ProductBuild : 0x0a28 (2600) Reserved: ARRAY(3) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (15) [2011/03/03 16:52:47.097420, 5] auth/auth.c:97(get_ntlm_challenge) auth_get_challenge: module guest did not want to specify a challenge [2011/03/03 16:52:47.097437, 5] auth/auth.c:97(get_ntlm_challenge) auth_get_challenge: module sam did not want to specify a challenge [2011/03/03 16:52:47.097473, 5] auth/auth.c:97(get_ntlm_challenge) auth_get_challenge: module winbind did not want to specify a challenge [2011/03/03 16:52:47.097501, 5] auth/auth.c:132(get_ntlm_challenge) auth_context challenge created by random [2011/03/03 16:52:47.097519, 5] auth/auth.c:133(get_ntlm_challenge) challenge is: [2011/03/03 16:52:47.097521, 5] ../lib/util/util.c:278(_dump_data) [0000] 68 85 5E 29 BC 92 64 8F h.^)..d. [2011/03/03 16:52:47.098145, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) &challenge: struct CHALLENGE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmChallenge (0x2) TargetNameLen : 0x0012 (18) TargetNameMaxLen : 0x0012 (18) TargetName : * TargetName : 'DOMAIN.QA' NegotiateFlags : 0xa2898205 (2726920709) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 0: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 0: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 1: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 ServerChallenge : 68855e29bc92648f Reserved : 0000000000000000 TargetInfoLen : 0x0056 (86) TargetNameInfoMaxLen : 0x0056 (86) TargetInfo : * TargetInfo: struct AV_PAIR_LIST count : 0x00000005 (5) pair: ARRAY(5) pair: struct AV_PAIR AvId : MsvAvNbDomainName (0x2) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x2) AvNbDomainName : 'DOMAIN.QA' pair: struct AV_PAIR AvId : MsvAvNbComputerName (0x1) AvLen : 0x0006 (6) Value : union ntlmssp_AvValue(case 0x1) AvNbComputerName : 'PDC' pair: struct AV_PAIR AvId : MsvAvDnsDomainName (0x4) AvLen : 0x0012 (18) Value : union ntlmssp_AvValue(case 0x4) AvDnsDomainName : 'domain.qa' pair: struct AV_PAIR AvId : MsvAvDnsComputerName (0x3) AvLen : 0x0018 (24) Value : union ntlmssp_AvValue(case 0x3) AvDnsComputerName : 'ox.domain.qa' pair: struct AV_PAIR AvId : MsvAvEOL (0x0) AvLen : 0x0000 (0) Value : union ntlmssp_AvValue(case 0x0) Version: struct VERSION ProductMajorVersion : UNKNOWN_ENUM_VALUE (0x53) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_0 (0x0) ProductBuild : 0x0041 (65) Reserved : 410043 NTLMRevisionCurrent : UNKNOWN_ENUM_VALUE (0x0) [2011/03/03 16:52:47.098645, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.098664, 5] lib/util.c:627(show_msg) size=280 smb_com=0x73 smb_rcls=22 smb_reh=0 smb_err=49152 smb_flg=136 smb_flg2=51203 smb_tid=0 smb_pid=65279 smb_uid=100 smb_mid=64 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 183 (0xB7) smb_bcc=237 [2011/03/03 16:52:47.098667, 10] ../lib/util/util.c:278(_dump_data) [0000] A1 81 B4 30 81 B1 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ [0010] 06 01 04 01 82 37 02 02 0A A2 81 9B 04 81 98 4E .....7.. .......N [0020] 54 4C 4D 53 53 50 00 02 00 00 00 12 00 12 00 30 TLMSSP.. .......0 [0030] 00 00 00 05 82 89 A2 68 85 5E 29 BC 92 64 8F 00 .......h .^)..d.. [0040] 00 00 00 00 00 00 00 56 00 56 00 42 00 00 00 53 .......V .V.B...S [0050] 00 41 00 41 00 43 00 4B 00 45 00 2E 00 44 00 45 .A.A.C.K .E...D.E [0060] 00 02 00 12 00 53 00 41 00 41 00 43 00 4B 00 45 .....S.A .A.C.K.E [0070] 00 2E 00 44 00 45 00 01 00 06 00 50 00 44 00 43 ...D.E.. ...P.D.C [0080] 00 04 00 12 00 73 00 61 00 61 00 63 00 6B 00 65 .....s.a .a.c.k.e [0090] 00 2E 00 64 00 65 00 03 00 18 00 6F 00 78 00 2E ...d.e.. ...o.x.. [00A0] 00 73 00 61 00 61 00 63 00 6B 00 65 00 2E 00 64 .s.a.a.c .k.e...d [00B0] 00 65 00 00 00 00 00 55 00 6E 00 69 00 78 00 00 .e.....U .n.i.x.. [00C0] 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 00 2E .S.a.m.b .a. .3.. [00D0] 00 35 00 2E 00 34 00 00 00 53 00 41 00 41 00 43 .5...4.. .S.A.A.C [00E0] 00 4B 00 45 00 2E 00 44 00 45 00 00 00 .K.E...D .E... [2011/03/03 16:52:47.099782, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 254 [2011/03/03 16:52:47.099956, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xfe [2011/03/03 16:52:47.099988, 3] smbd/process.c:1485(process_smb) Transaction 2 of length 258 (0 toread) [2011/03/03 16:52:47.100012, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.100029, 5] lib/util.c:627(show_msg) size=254 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=100 smb_mid=128 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 254 (0xFE) smb_vwv[ 2]=65535 (0xFFFF) smb_vwv[ 3]= 50 (0x32) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 93 (0x5D) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 212 (0xD4) smb_vwv[11]=40960 (0xA000) smb_bcc=195 [2011/03/03 16:52:47.100120, 10] ../lib/util/util.c:278(_dump_data) [0000] A1 5B 30 59 A2 57 04 55 4E 54 4C 4D 53 53 50 00 .[0Y.W.U NTLMSSP. [0010] 03 00 00 00 01 00 01 00 54 00 00 00 00 00 00 00 ........ T....... [0020] 55 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 U....... H....... [0030] 48 00 00 00 0C 00 0C 00 48 00 00 00 00 00 00 00 H....... H....... [0040] 55 00 00 00 05 8A 88 A2 05 01 28 0A 00 00 00 0F U....... ..(..... [0050] 50 00 45 00 54 00 2D 00 4E 00 42 00 00 57 00 69 P.E.T.-. N.B..W.i [0060] 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 .n.d.o.w .s. .2.0 [0070] 00 30 00 32 00 20 00 53 00 65 00 72 00 76 00 69 .0.2. .S .e.r.v.i [0080] 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 .c.e. .P .a.c.k. [0090] 00 33 00 20 00 32 00 36 00 30 00 30 00 00 00 57 .3. .2.6 .0.0...W [00A0] 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 .i.n.d.o .w.s. .2 [00B0] 00 30 00 30 00 32 00 20 00 35 00 2E 00 31 00 00 .0.0.2. .5...1.. [00C0] 00 00 00 ... [2011/03/03 16:52:47.100351, 3] smbd/process.c:1294(switch_message) switch message SMBsesssetupX (pid 19600) conn 0x0 [2011/03/03 16:52:47.100387, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.100409, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.100434, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.100463, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.100488, 3] smbd/sesssetup.c:1435(reply_sesssetup_and_X) wct=12 flg2=0xc807 [2011/03/03 16:52:47.100506, 2] smbd/sesssetup.c:1390(setup_new_vc_session) setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources. [2011/03/03 16:52:47.100547, 3] smbd/sesssetup.c:1189(reply_sesssetup_and_X_spnego) Doing spnego session setup [2011/03/03 16:52:47.100583, 3] smbd/sesssetup.c:1231(reply_sesssetup_and_X_spnego) NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[] [2011/03/03 16:52:47.100635, 10] smbd/sesssetup.c:1134(check_spnego_blob_complete) check_spnego_blob_complete: needed_len = 93, pblob->length = 93 [2011/03/03 16:52:47.100813, 1] ../librpc/ndr/ndr.c:214(ndr_print_debug) &authenticate: struct AUTHENTICATE_MESSAGE Signature : 'NTLMSSP' MessageType : NtLmAuthenticate (3) LmChallengeResponseLen : 0x0001 (1) LmChallengeResponseMaxLen: 0x0001 (1) LmChallengeResponse : * LmChallengeResponse : union ntlmssp_LM_RESPONSE(case 1) NtChallengeResponseLen : 0x0000 (0) NtChallengeResponseMaxLen: 0x0000 (0) NtChallengeResponse : * NtChallengeResponse : union ntlmssp_NTLM_RESPONSE(case 0) DomainNameLen : 0x0000 (0) DomainNameMaxLen : 0x0000 (0) DomainName : * DomainName : '' UserNameLen : 0x0000 (0) UserNameMaxLen : 0x0000 (0) UserName : * UserName : '' WorkstationLen : 0x000c (12) WorkstationMaxLen : 0x000c (12) Workstation : * Workstation : 'PET-NB' EncryptedRandomSessionKeyLen: 0x0000 (0) EncryptedRandomSessionKeyMaxLen: 0x0000 (0) EncryptedRandomSessionKey: * EncryptedRandomSessionKey: DATA_BLOB length=0 NegotiateFlags : 0xa2888a05 (2726857221) 1: NTLMSSP_NEGOTIATE_UNICODE 0: NTLMSSP_NEGOTIATE_OEM 1: NTLMSSP_REQUEST_TARGET 0: NTLMSSP_NEGOTIATE_SIGN 0: NTLMSSP_NEGOTIATE_SEAL 0: NTLMSSP_NEGOTIATE_DATAGRAM 0: NTLMSSP_NEGOTIATE_LM_KEY 0: NTLMSSP_NEGOTIATE_NETWARE 1: NTLMSSP_NEGOTIATE_NTLM 0: NTLMSSP_NEGOTIATE_NT_ONLY 1: NTLMSSP_ANONYMOUS 0: NTLMSSP_NEGOTIATE_OEM_DOMAIN_SUPPLIED 0: NTLMSSP_NEGOTIATE_OEM_WORKSTATION_SUPPLIED 0: NTLMSSP_NEGOTIATE_THIS_IS_LOCAL_CALL 1: NTLMSSP_NEGOTIATE_ALWAYS_SIGN 0: NTLMSSP_TARGET_TYPE_DOMAIN 0: NTLMSSP_TARGET_TYPE_SERVER 0: NTLMSSP_TARGET_TYPE_SHARE 1: NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0: NTLMSSP_NEGOTIATE_IDENTIFY 0: NTLMSSP_REQUEST_NON_NT_SESSION_KEY 1: NTLMSSP_NEGOTIATE_TARGET_INFO 1: NTLMSSP_NEGOTIATE_VERSION 1: NTLMSSP_NEGOTIATE_128 0: NTLMSSP_NEGOTIATE_KEY_EXCH 1: NTLMSSP_NEGOTIATE_56 Version: struct VERSION ProductMajorVersion : NTLMSSP_WINDOWS_MAJOR_VERSION_5 (5) ProductMinorVersion : NTLMSSP_WINDOWS_MINOR_VERSION_1 (1) ProductBuild : 0x0a28 (2600) Reserved: ARRAY(3) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) NTLMRevisionCurrent : NTLMSSP_REVISION_W2K3 (15) [2011/03/03 16:52:47.101190, 3] libsmb/ntlmssp.c:747(ntlmssp_server_auth) Got user=[] domain=[] workstation=[PET-NB] len1=1 len2=0 [2011/03/03 16:52:47.101250, 6] param/loadparm.c:7156(lp_file_list_changed) lp_file_list_changed() file /etc/samba/local.conf -> /etc/samba/local.conf last mod_time: Tue May 11 16:47:00 2010 file /etc/samba/printers.conf -> /etc/samba/printers.conf last mod_time: Mon Jul 19 20:35:11 2010 file /etc/samba/shares.conf -> /etc/samba/shares.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/installs.conf -> /etc/samba/installs.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/base.conf -> /etc/samba/base.conf last mod_time: Thu Jan 6 19:15:37 2011 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Wed Jan 26 22:30:30 2011 [2011/03/03 16:52:47.101509, 5] auth/auth_util.c:211(make_user_info_map) Mapping user []\[] from workstation [PET-NB] [2011/03/03 16:52:47.101525, 5] auth/auth_util.c:232(make_user_info_map) Mapped domain from [] to [DOMAIN.QA] for user [] from workstation [PET-NB] [2011/03/03 16:52:47.101525, 5] auth/auth_util.c:122(make_user_info) attempting to make a user_info for () [2011/03/03 16:52:47.101578, 5] auth/auth_util.c:132(make_user_info) making strings for 's user_info struct [2011/03/03 16:52:47.101592, 5] auth/auth_util.c:164(make_user_info) making blobs for 's user_info struct [2011/03/03 16:52:47.101640, 10] auth/auth_util.c:182(make_user_info) made an encrypted user_info for () [2011/03/03 16:52:47.101714, 3] auth/auth.c:216(check_ntlm_password) check_ntlm_password: Checking password for unmapped user []\[]@[PET-NB] with the new password interface [2011/03/03 16:52:47.101741, 3] auth/auth.c:219(check_ntlm_password) check_ntlm_password: mapped user is: [DOMAIN.QA]\[]@[PET-NB] [2011/03/03 16:52:47.101754, 10] auth/auth.c:228(check_ntlm_password) check_ntlm_password: auth_context challenge created by random [2011/03/03 16:52:47.101765, 10] auth/auth.c:230(check_ntlm_password) challenge is: [2011/03/03 16:52:47.101777, 5] ../lib/util/util.c:278(_dump_data) [0000] 68 85 5E 29 BC 92 64 8F h.^)..d. [2011/03/03 16:52:47.101957, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=65534))], scope => [2] [2011/03/03 16:52:47.102013, 5] lib/smbldap.c:1262(smbldap_close) The connection to the LDAP server was closed [2011/03/03 16:52:47.102054, 10] lib/smbldap.c:751(smb_ldap_setup_conn) smb_ldap_setup_connection: ldap://ox.domain.qa [2011/03/03 16:52:47.107901, 3] lib/smbldap.c:735(smb_ldap_start_tls) StartTLS issued: using a TLS connection [2011/03/03 16:52:47.107901, 2] lib/smbldap.c:950(smbldap_open_connection) smbldap_open_connection: connection opened [2011/03/03 16:52:47.107901, 10] lib/smbldap.c:1120(smbldap_connect_system) ldap_connect_system: Binding to ldap server ldap://ox.domain.qa as "cn=admin,dc=domain,dc=qa" [2011/03/03 16:52:47.110039, 3] lib/smbldap.c:1166(smbldap_connect_system) ldap_connect_system: successful connection to the LDAP server ldap_connect_system: LDAP server does support paged results [2011/03/03 16:52:47.110122, 4] lib/smbldap.c:1242(smbldap_open) The LDAP server is successfully connected [2011/03/03 16:52:47.110758, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(gidNumber=65534)) [2011/03/03 16:52:47.110807, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.110823, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.110836, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.110880, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.110894, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.111119, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.111233, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.111336, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:47.111371, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.111386, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:47.111387, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:47.111469, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:47.111489, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.111509, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.111524, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.111540, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.111570, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.111591, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.111605, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.111606, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.111607, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.111608, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.111610, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.111611, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:47.111611, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:47.111612, 10] lib/gencache.c:334(gencache_get_data_blob) Cache entry with key = IDMAP/SID2GID/S-1-5-21-3337506086-3871218678-1542260769-513 couldn't be found [2011/03/03 16:52:47.111634, 10] passdb/lookup_sid.c:1511(sid_to_gid) winbind failed to find a gid for sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:47.111657, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.111671, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.111683, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.111683, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.111683, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.111683, 5] passdb/pdb_interface.c:1473(lookup_global_sam_rid) lookup_global_sam_rid: looking up RID 513. [2011/03/03 16:52:47.111683, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.111683, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.111683, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.111683, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.111725, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.111900, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(sambaSID=S-1-5-21-3337506086-3871218678-1542260769-513)(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:47.112658, 4] passdb/pdb_ldap.c:1692(ldapsam_getsampwsid) ldapsam_getsampwsid: Unable to locate SID [S-1-5-21-3337506086-3871218678-1542260769-513] count=0 [2011/03/03 16:52:47.112707, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-21-3337506086-3871218678-1542260769-513))], scope => [2] [2011/03/03 16:52:47.113308, 2] passdb/pdb_ldap.c:2443(init_group_from_ldap) init_group_from_ldap: Entry found for group: 5001 [2011/03/03 16:52:47.113310, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute displayName does not exist [2011/03/03 16:52:47.113367, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute description does not exist [2011/03/03 16:52:47.113400, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.113419, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.113434, 10] passdb/lookup_sid.c:1288(legacy_sid_to_gid) LEGACY: sid S-1-5-21-3337506086-3871218678-1542260769-513 -> gid 5001 [2011/03/03 16:52:47.113452, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:47.113478, 3] auth/auth.c:265(check_ntlm_password) check_ntlm_password: guest authentication for user [] succeeded [2011/03/03 16:52:47.113500, 5] auth/auth.c:304(check_ntlm_password) check_ntlm_password: guest authentication for user [] -> [] -> [nobody] succeeded [2011/03/03 16:52:47.113502, 5] auth/auth_util.c:2119(free_user_info) attempting to free (and zero) a user_info structure [2011/03/03 16:52:47.113504, 10] auth/auth_util.c:2123(free_user_info) structure was created for [2011/03/03 16:52:47.113557, 10] auth/token_util.c:356(create_local_nt_token) Create local NT token for S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:47.113606, 3] lib/privileges.c:63(get_privileges) get_privileges: No privileges assigned to SID [S-1-5-21-3337506086-3871218678-1542260769-501] [2011/03/03 16:52:47.113628, 5] lib/privileges.c:128(get_privileges_for_sids) get_privileges_for_sids: sid = S-1-1-0 Privilege set: SE_PRIV 0x0 0x0 0x0 0x0 [2011/03/03 16:52:47.113654, 3] lib/privileges.c:63(get_privileges) get_privileges: No privileges assigned to SID [S-1-5-2] [2011/03/03 16:52:47.113680, 3] lib/privileges.c:63(get_privileges) get_privileges: No privileges assigned to SID [S-1-5-32-546] [2011/03/03 16:52:47.113701, 10] lib/gencache.c:334(gencache_get_data_blob) Cache entry with key = IDMAP/SID2GID/S-1-1-0 couldn't be found [2011/03/03 16:52:47.113703, 10] passdb/lookup_sid.c:1511(sid_to_gid) winbind failed to find a gid for sid S-1-1-0 [2011/03/03 16:52:47.113705, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.113706, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.113772, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.113787, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.113801, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.113826, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-1-0))], scope => [2] [2011/03/03 16:52:47.114369, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(sambaSID=S-1-1-0)) [2011/03/03 16:52:47.114441, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.114459, 10] passdb/lookup_sid.c:1256(legacy_sid_to_gid) LEGACY: mapping failed for sid S-1-1-0 [2011/03/03 16:52:47.114493, 10] auth/auth_util.c:753(create_local_token) Could not convert SID S-1-1-0 to gid, ignoring it [2011/03/03 16:52:47.114667, 10] lib/gencache.c:334(gencache_get_data_blob) Cache entry with key = IDMAP/SID2GID/S-1-5-2 couldn't be found [2011/03/03 16:52:47.114764, 10] passdb/lookup_sid.c:1511(sid_to_gid) winbind failed to find a gid for sid S-1-5-2 [2011/03/03 16:52:47.114784, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.114802, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.114818, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.114833, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.114850, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.114906, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-2))], scope => [2] [2011/03/03 16:52:47.115287, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-2)) [2011/03/03 16:52:47.115309, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.115310, 10] passdb/lookup_sid.c:1256(legacy_sid_to_gid) LEGACY: mapping failed for sid S-1-5-2 [2011/03/03 16:52:47.115311, 10] auth/auth_util.c:753(create_local_token) Could not convert SID S-1-5-2 to gid, ignoring it [2011/03/03 16:52:47.115331, 10] auth/token_util.c:531(debug_nt_user_token) NT user token of user S-1-5-21-3337506086-3871218678-1542260769-501 contains 6 SIDs SID[ 0]: S-1-5-21-3337506086-3871218678-1542260769-501 SID[ 1]: S-1-1-0 SID[ 2]: S-1-5-2 SID[ 3]: S-1-5-32-546 SID[ 4]: S-1-22-1-65534 SID[ 5]: S-1-22-2-5012 SE_PRIV 0x0 0x0 0x0 0x0 [2011/03/03 16:52:47.115331, 10] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 65534 Primary group is 65534 and contains 1 supplementary groups Group[ 0]: 5012 [2011/03/03 16:52:47.115331, 10] auth/auth_ntlmssp.c:139(auth_ntlmssp_check_password) Got NT session key of length 16 [2011/03/03 16:52:47.115400, 10] auth/auth_ntlmssp.c:146(auth_ntlmssp_check_password) Got LM session key of length 16 [2011/03/03 16:52:47.115420, 10] libsmb/ntlmssp.c:853(ntlmssp_server_auth) ntlmssp_server_auth: Using unmodified nt session key. [2011/03/03 16:52:47.115450, 3] libsmb/ntlmssp_sign.c:343(ntlmssp_sign_init) NTLMSSP Sign/Seal - Initialising with flags: [2011/03/03 16:52:47.115468, 3] libsmb/ntlmssp.c:65(debug_ntlmssp_flags) Got NTLMSSP neg_flags=0xa2088205 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_ALWAYS_SIGN NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_VERSION NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_56 [2011/03/03 16:52:47.115632, 10] smbd/password.c:278(register_existing_vuid) register_existing_vuid: (65534,65534) nobody DOMAIN.QA guest=1 [2011/03/03 16:52:47.115663, 3] smbd/password.c:282(register_existing_vuid) register_existing_vuid: User name: nobody Real name: nobody [2011/03/03 16:52:47.115677, 3] smbd/password.c:292(register_existing_vuid) register_existing_vuid: UNIX uid 65534 is UNIX user nobody, and will be vuid 100 [2011/03/03 16:52:47.115683, 6] param/loadparm.c:7156(lp_file_list_changed) lp_file_list_changed() file /etc/samba/local.conf -> /etc/samba/local.conf last mod_time: Tue May 11 16:47:00 2010 file /etc/samba/printers.conf -> /etc/samba/printers.conf last mod_time: Mon Jul 19 20:35:11 2010 file /etc/samba/shares.conf -> /etc/samba/shares.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/installs.conf -> /etc/samba/installs.conf last mod_time: Thu Jan 1 01:00:00 1970 file /etc/samba/base.conf -> /etc/samba/base.conf last mod_time: Thu Jan 6 19:15:37 2011 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Wed Jan 26 22:30:30 2011 [2011/03/03 16:52:47.115881, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.115981, 5] lib/util.c:627(show_msg) size=106 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=0 smb_pid=65279 smb_uid=100 smb_mid=128 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_vwv[ 3]= 9 (0x9) smb_bcc=63 [2011/03/03 16:52:47.116032, 10] ../lib/util/util.c:278(_dump_data) [0000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x [0010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 [0020] 00 2E 00 35 00 2E 00 34 00 00 00 53 00 41 00 41 ...5...4 ...S.A.A [0030] 00 43 00 4B 00 45 00 2E 00 44 00 45 00 00 00 .C.K.E.. .D.E... [2011/03/03 16:52:47.116844, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 72 [2011/03/03 16:52:47.117099, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x48 [2011/03/03 16:52:47.117125, 3] smbd/process.c:1485(process_smb) Transaction 3 of length 76 (0 toread) [2011/03/03 16:52:47.117143, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.117155, 5] lib/util.c:627(show_msg) size=72 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=0 smb_pid=65279 smb_uid=100 smb_mid=192 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 8 (0x8) smb_vwv[ 3]= 1 (0x1) smb_bcc=29 [2011/03/03 16:52:47.117255, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 5C 00 50 00 44 00 43 00 5C 00 49 00 50 .\.\.P.D .C.\.I.P [0010] 00 43 00 24 00 00 00 3F 3F 3F 3F 3F 00 .C.$...? ????. [2011/03/03 16:52:47.117321, 3] smbd/process.c:1294(switch_message) switch message SMBtconX (pid 19600) conn 0x0 [2011/03/03 16:52:47.117348, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.117395, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.117416, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.117485, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.117595, 4] smbd/reply.c:767(reply_tcon_and_X) Client requested device type [?????] for share [IPC$] [2011/03/03 16:52:47.117670, 5] smbd/service.c:1227(make_connection) making a connection to 'normal' service ipc$ [2011/03/03 16:52:47.117743, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.117786, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.117800, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.117812, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.117823, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.117905, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.117946, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.118007, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:47.118024, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.118037, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:47.118052, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:47.118077, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:47.118090, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.118125, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.118141, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.118155, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.118194, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.118206, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.118218, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.118230, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.118241, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.118275, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.118301, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.118314, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:47.118373, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:47.118411, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:47.118431, 5] lib/username.c:133(Get_Pwnam_alloc) Finding user nobody [2011/03/03 16:52:47.118445, 5] lib/username.c:77(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is nobody [2011/03/03 16:52:47.118458, 5] lib/username.c:110(Get_Pwnam_internals) Get_Pwnam_internals did find user [nobody]! [2011/03/03 16:52:47.118512, 10] smbd/service.c:163(set_conn_connectpath) set_conn_connectpath: service IPC$, connectpath = /tmp [2011/03/03 16:52:47.118528, 3] smbd/service.c:807(make_connection_snum) Connect path is '/tmp' for service [IPC$] [2011/03/03 16:52:47.118606, 10] lib/util_seaccess.c:58(se_map_generic) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2011/03/03 16:52:47.118634, 3] smbd/vfs.c:97(vfs_init_default) Initialising default vfs hooks [2011/03/03 16:52:47.118660, 10] smbd/vfs.c:48(vfs_find_backend_entry) vfs_find_backend_entry called for /[Default VFS]/ [2011/03/03 16:52:47.118686, 5] smbd/vfs.c:87(smb_register_vfs) Successfully added vfs backend '/[Default VFS]/' [2011/03/03 16:52:47.118707, 10] smbd/vfs.c:48(vfs_find_backend_entry) vfs_find_backend_entry called for posixacl [2011/03/03 16:52:47.118721, 5] smbd/vfs.c:87(smb_register_vfs) Successfully added vfs backend 'posixacl' [2011/03/03 16:52:47.118732, 3] smbd/vfs.c:122(vfs_init_custom) Initialising custom vfs hooks from [/[Default VFS]/] [2011/03/03 16:52:47.118744, 10] smbd/vfs.c:48(vfs_find_backend_entry) vfs_find_backend_entry called for /[Default VFS]/ Successfully loaded vfs module [/[Default VFS]/] with the new modules system [2011/03/03 16:52:47.118796, 5] smbd/connection.c:142(claim_connection) claiming [IPC$] [2011/03/03 16:52:47.118856, 10] lib/dbwrap_tdb.c:100(db_tdb_fetch_locked) Locking key 904C0000FFFFFFFF0100 [2011/03/03 16:52:47.118922, 10] lib/dbwrap_tdb.c:129(db_tdb_fetch_locked) Allocated locked data 0x0x2dbba60 [2011/03/03 16:52:47.119048, 10] lib/dbwrap_tdb.c:42(db_tdb_record_destr) Unlocking key 904C0000FFFFFFFF0100 [2011/03/03 16:52:47.119288, 10] smbd/service.c:163(set_conn_connectpath) set_conn_connectpath: service IPC$, connectpath = /tmp [2011/03/03 16:52:47.119319, 3] lib/util_sid.c:228(string_to_sid) string_to_sid: Sid None does not start with 'S-'. [2011/03/03 16:52:47.119412, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: DOMAIN.QA\None => DOMAIN.QA (domain), None (name) [2011/03/03 16:52:47.119432, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x073 [2011/03/03 16:52:47.119462, 5] smbd/share_access.c:106(token_contains_name) None is a Domain Group, expected a user [2011/03/03 16:52:47.119484, 10] smbd/share_access.c:238(user_ok_token) user_ok_token: share IPC$ is ok for unix user nobody [2011/03/03 16:52:47.119501, 10] smbd/share_access.c:283(is_share_read_only_for_token) is_share_read_only_for_user: share IPC$ is read-only for unix user nobody [2011/03/03 16:52:47.119502, 10] lib/util_seaccess.c:58(se_map_generic) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2011/03/03 16:52:47.119591, 3] lib/util_sid.c:228(string_to_sid) string_to_sid: Sid administrator does not start with 'S-'. [2011/03/03 16:52:47.119606, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: DOMAIN.QA\administrator => DOMAIN.QA (domain), administrator (name) [2011/03/03 16:52:47.119618, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x073 [2011/03/03 16:52:47.119630, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.119643, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.119655, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.119674, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.119686, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.119741, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=administrator)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:47.120692, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: Administrator [2011/03/03 16:52:47.120723, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username Administrator, was [2011/03/03 16:52:47.120743, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.120764, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username Administrator, was [2011/03/03 16:52:47.120798, 10] passdb/pdb_get_set.c:550(pdb_set_user_sid_from_string) pdb_set_user_sid_from_string: setting user sid S-1-5-21-3337506086-3871218678-1542260769-500 [2011/03/03 16:52:47.120817, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-500 [2011/03/03 16:52:47.120849, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaLogoffTime does not exist [2011/03/03 16:52:47.120873, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaKickoffTime does not exist [2011/03/03 16:52:47.120891, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaPwdCanChange does not exist [2011/03/03 16:52:47.120909, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaPwdMustChange does not exist [2011/03/03 16:52:47.120911, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name Administrator, was [2011/03/03 16:52:47.120912, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaHomeDrive does not exist [2011/03/03 16:52:47.120976, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.120998, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaHomePath does not exist [2011/03/03 16:52:47.121027, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\administrator, was [2011/03/03 16:52:47.121080, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaLogonScript does not exist [2011/03/03 16:52:47.121081, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.121081, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaProfilePath does not exist [2011/03/03 16:52:47.121081, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.121234, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute description does not exist [2011/03/03 16:52:47.121255, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaUserWorkstations does not exist [2011/03/03 16:52:47.121311, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.121369, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.121387, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.121408, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.121467, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.121533, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.121574, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.121576, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaBadPasswordCount does not exist [2011/03/03 16:52:47.121628, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaBadPasswordTime does not exist [2011/03/03 16:52:47.121646, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaLogonHours does not exist [2011/03/03 16:52:47.121707, 5] passdb/login_cache.c:44(login_cache_init) Opening cache file at /var/cache/samba/login_cache.tdb [2011/03/03 16:52:47.121892, 7] passdb/login_cache.c:88(login_cache_read) Looking up login cache for user Administrator [2011/03/03 16:52:47.121914, 7] passdb/login_cache.c:104(login_cache_read) No cache entry found [2011/03/03 16:52:47.121931, 9] passdb/pdb_ldap.c:1127(init_sam_from_ldap) No cache entry, bad count = 0, bad time = 0 [2011/03/03 16:52:47.121963, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.121978, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.121992, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.121993, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.121995, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.121996, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/maximum password age, value = 4294967295 , timeout = Thu Mar 3 16:52:51 2011 [2011/03/03 16:52:47.122083, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.122112, 5] lib/username.c:133(Get_Pwnam_alloc) Finding user Administrator [2011/03/03 16:52:47.122127, 5] lib/username.c:77(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is administrator [2011/03/03 16:52:47.122385, 5] lib/username.c:110(Get_Pwnam_internals) Get_Pwnam_internals did find user [Administrator]! [2011/03/03 16:52:47.122482, 10] lib/gencache.c:334(gencache_get_data_blob) Cache entry with key = IDMAP/GID2SID/5000 couldn't be found [2011/03/03 16:52:47.122660, 5] passdb/lookup_sid.c:1387(gid_to_sid) gid_to_sid: winbind failed to find a sid for gid 5000 [2011/03/03 16:52:47.122676, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.122699, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.122712, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.122724, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.122736, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.122772, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=5000))], scope => [2] [2011/03/03 16:52:47.124614, 2] passdb/pdb_ldap.c:2443(init_group_from_ldap) init_group_from_ldap: Entry found for group: 5000 [2011/03/03 16:52:47.124867, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute displayName does not exist [2011/03/03 16:52:47.124893, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute description does not exist [2011/03/03 16:52:47.125034, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.125054, 10] passdb/lookup_sid.c:1182(legacy_gid_to_sid) LEGACY: gid 5000 -> sid S-1-5-21-3337506086-3871218678-1542260769-512 [2011/03/03 16:52:47.125060, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.125129, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.125147, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.125164, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.125191, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.125266, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.125320, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.125367, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username Administrator, was [2011/03/03 16:52:47.125393, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.125408, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username Administrator, was [2011/03/03 16:52:47.125427, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name Administrator, was [2011/03/03 16:52:47.125429, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\administrator, was [2011/03/03 16:52:47.125430, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.125499, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.125517, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.125538, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.125555, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.125570, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.125591, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.125605, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.125621, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.125688, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.125722, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.125743, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-500 [2011/03/03 16:52:47.125760, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-500 from rid 500 [2011/03/03 16:52:47.125783, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-512 [2011/03/03 16:52:47.125806, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.125810, 3] lib/util_sid.c:228(string_to_sid) string_to_sid: Sid join-backup does not start with 'S-'. [2011/03/03 16:52:47.125814, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: DOMAIN.QA\join-backup => DOMAIN.QA (domain), join-backup (name) [2011/03/03 16:52:47.125887, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x073 [2011/03/03 16:52:47.125911, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.125935, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.125949, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.125963, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.125978, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.126092, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=join-backup)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:47.126743, 2] passdb/pdb_ldap.c:572(init_sam_from_ldap) init_sam_from_ldap: Entry found for user: join-backup [2011/03/03 16:52:47.126762, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username join-backup, was [2011/03/03 16:52:47.126775, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.126787, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username join-backup, was [2011/03/03 16:52:47.126808, 10] passdb/pdb_get_set.c:550(pdb_set_user_sid_from_string) pdb_set_user_sid_from_string: setting user sid S-1-5-21-3337506086-3871218678-1542260769-5004 [2011/03/03 16:52:47.126823, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-5004 [2011/03/03 16:52:47.126843, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaLogonTime does not exist [2011/03/03 16:52:47.126859, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaLogoffTime does not exist [2011/03/03 16:52:47.126874, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaKickoffTime does not exist [2011/03/03 16:52:47.126889, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaPwdCanChange does not exist [2011/03/03 16:52:47.126904, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaPwdMustChange does not exist [2011/03/03 16:52:47.126919, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name Joinuser, was [2011/03/03 16:52:47.126935, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaHomeDrive does not exist [2011/03/03 16:52:47.126947, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.126962, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaHomePath does not exist [2011/03/03 16:52:47.126991, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\join-backup, was [2011/03/03 16:52:47.127008, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaLogonScript does not exist [2011/03/03 16:52:47.127021, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.127036, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaProfilePath does not exist [2011/03/03 16:52:47.127049, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.127064, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute description does not exist [2011/03/03 16:52:47.127080, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaUserWorkstations does not exist [2011/03/03 16:52:47.127106, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.127119, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.127131, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.127143, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.127155, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.127180, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.127205, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.127225, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaBadPasswordCount does not exist [2011/03/03 16:52:47.127241, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaBadPasswordTime does not exist [2011/03/03 16:52:47.127257, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute sambaLogonHours does not exist [2011/03/03 16:52:47.127291, 7] passdb/login_cache.c:88(login_cache_read) Looking up login cache for user join-backup [2011/03/03 16:52:47.127311, 7] passdb/login_cache.c:104(login_cache_read) No cache entry found [2011/03/03 16:52:47.127324, 9] passdb/pdb_ldap.c:1127(init_sam_from_ldap) No cache entry, bad count = 0, bad time = 0 [2011/03/03 16:52:47.127340, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.127352, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.127364, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.127376, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.127387, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.127417, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/maximum password age, value = 4294967295 , timeout = Thu Mar 3 16:52:51 2011 [2011/03/03 16:52:47.127440, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.127455, 5] lib/username.c:133(Get_Pwnam_alloc) Finding user join-backup [2011/03/03 16:52:47.127467, 5] lib/username.c:77(Get_Pwnam_internals) Trying _Get_Pwnam(), username as lowercase is join-backup [2011/03/03 16:52:47.127603, 5] lib/username.c:110(Get_Pwnam_internals) Get_Pwnam_internals did find user [join-backup]! [2011/03/03 16:52:47.127630, 10] lib/gencache.c:334(gencache_get_data_blob) Cache entry with key = IDMAP/GID2SID/5008 couldn't be found [2011/03/03 16:52:47.127657, 5] passdb/lookup_sid.c:1387(gid_to_sid) gid_to_sid: winbind failed to find a sid for gid 5008 [2011/03/03 16:52:47.127674, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.127674, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.127694, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.127708, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.127719, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.127751, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=5008))], scope => [2] [2011/03/03 16:52:47.128257, 2] passdb/pdb_ldap.c:2443(init_group_from_ldap) init_group_from_ldap: Entry found for group: 5008 [2011/03/03 16:52:47.128279, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute displayName does not exist [2011/03/03 16:52:47.128300, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.128314, 10] passdb/lookup_sid.c:1182(legacy_gid_to_sid) LEGACY: gid 5008 -> sid S-1-5-21-3337506086-3871218678-1542260769-11017 [2011/03/03 16:52:47.128338, 10] passdb/pdb_get_set.c:257(pdb_get_group_sid) do lookup_sid(S-1-5-21-3337506086-3871218678-1542260769-11017) for group of user S-1-5-21-3337506086-3871218678-1542260769-5004 [2011/03/03 16:52:47.128355, 10] passdb/lookup_sid.c:965(lookup_sid) lookup_sid called for SID 'S-1-5-21-3337506086-3871218678-1542260769-11017' [2011/03/03 16:52:47.128392, 10] passdb/lookup_sid.c:720(check_dom_sid_to_level) Accepting SID S-1-5-21-3337506086-3871218678-1542260769 in level 1 [2011/03/03 16:52:47.128409, 10] passdb/lookup_sid.c:480(lookup_rids) lookup_rids called for domain sid 'S-1-5-21-3337506086-3871218678-1542260769' [2011/03/03 16:52:47.128423, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.128423, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.128423, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.128423, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.128423, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.128423, 5] passdb/pdb_interface.c:1473(lookup_global_sam_rid) lookup_global_sam_rid: looking up RID 11017. [2011/03/03 16:52:47.128423, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3 [2011/03/03 16:52:47.128423, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 2 [2011/03/03 16:52:47.128423, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3 [2011/03/03 16:52:47.128423, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.128423, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.128423, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(sambaSID=S-1-5-21-3337506086-3871218678-1542260769-11017)(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:47.129376, 4] passdb/pdb_ldap.c:1692(ldapsam_getsampwsid) ldapsam_getsampwsid: Unable to locate SID [S-1-5-21-3337506086-3871218678-1542260769-11017] count=0 [2011/03/03 16:52:47.129400, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(sambaSID=S-1-5-21-3337506086-3871218678-1542260769-11017))], scope => [2] [2011/03/03 16:52:47.129782, 2] passdb/pdb_ldap.c:2443(init_group_from_ldap) init_group_from_ldap: Entry found for group: 5008 [2011/03/03 16:52:47.129802, 10] lib/smbldap.c:310(smbldap_talloc_single_attribute) attribute displayName does not exist [2011/03/03 16:52:47.129843, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.129857, 5] passdb/pdb_interface.c:1595(pdb_default_lookup_rids) lookup_rids: Backup Join:2 [2011/03/03 16:52:47.129871, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.129884, 10] passdb/lookup_sid.c:1000(lookup_sid) Sid S-1-5-21-3337506086-3871218678-1542260769-11017 -> DOMAIN.QA\Backup Join(2) [2011/03/03 16:52:47.129900, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.129912, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.129924, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.129943, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.129954, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.129977, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.130001, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.130017, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username join-backup, was [2011/03/03 16:52:47.130036, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.130048, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username join-backup, was [2011/03/03 16:52:47.130060, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name Joinuser, was [2011/03/03 16:52:47.130074, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\join-backup, was [2011/03/03 16:52:47.130087, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.130099, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.130112, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.130123, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.130143, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.130155, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.130167, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.130178, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.130189, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.130216, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.130247, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.130260, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-5004 [2011/03/03 16:52:47.130274, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-5004 from rid 5004 [2011/03/03 16:52:47.130293, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-11017 [2011/03/03 16:52:47.130311, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.130387, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.130403, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.130416, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.130436, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.130450, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.130474, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.130503, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.130504, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:47.130549, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.130565, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:47.130579, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:47.130595, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:47.130610, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.130630, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.130646, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.130660, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.130675, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.130691, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.130692, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.130693, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.130744, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.130774, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.130807, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.130822, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:47.130823, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:47.130824, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:47.130825, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.130877, 5] auth/token_util.c:531(debug_nt_user_token) NT user token of user S-1-5-21-3337506086-3871218678-1542260769-501 contains 6 SIDs SID[ 0]: S-1-5-21-3337506086-3871218678-1542260769-501 SID[ 1]: S-1-1-0 SID[ 2]: S-1-5-2 SID[ 3]: S-1-5-32-546 SID[ 4]: S-1-22-1-65534 SID[ 5]: S-1-22-2-5012 SE_PRIV 0x0 0x0 0x0 0x0 [2011/03/03 16:52:47.130904, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 65534 Primary group is 65534 and contains 1 supplementary groups Group[ 0]: 5012 [2011/03/03 16:52:47.130944, 5] smbd/uid.c:354(change_to_user) change_to_user uid=(0,65534) gid=(0,65534) [2011/03/03 16:52:47.130997, 10] smbd/service.c:163(set_conn_connectpath) set_conn_connectpath: service IPC$, connectpath = /tmp [2011/03/03 16:52:47.131044, 3] smbd/service.c:1070(make_connection_snum) pet-nb (192.9.221.112) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 19600) [2011/03/03 16:52:47.131143, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.131158, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.131172, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.131199, 5] smbd/uid.c:369(change_to_root_user) change_to_root_user: now uid=(0,0) gid=(0,0) [2011/03/03 16:52:47.131236, 3] smbd/reply.c:846(reply_tcon_and_X) tconX service=IPC$ [2011/03/03 16:52:47.132073, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 100 [2011/03/03 16:52:47.132110, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x64 [2011/03/03 16:52:47.132131, 3] smbd/process.c:1485(process_smb) Transaction 4 of length 104 (0 toread) [2011/03/03 16:52:47.132144, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.132153, 5] lib/util.c:627(show_msg) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=136 smb_uid=100 smb_mid=256 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2011/03/03 16:52:47.132300, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [0010] 00 . [2011/03/03 16:52:47.132337, 3] smbd/process.c:1294(switch_message) switch message SMBntcreateX (pid 19600) conn 0x2db9e20 [2011/03/03 16:52:47.132353, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.132365, 5] auth/token_util.c:531(debug_nt_user_token) NT user token of user S-1-5-21-3337506086-3871218678-1542260769-501 contains 6 SIDs SID[ 0]: S-1-5-21-3337506086-3871218678-1542260769-501 SID[ 1]: S-1-1-0 SID[ 2]: S-1-5-2 SID[ 3]: S-1-5-32-546 SID[ 4]: S-1-22-1-65534 SID[ 5]: S-1-22-2-5012 SE_PRIV 0x0 0x0 0x0 0x0 [2011/03/03 16:52:47.132413, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 65534 Primary group is 65534 and contains 1 supplementary groups Group[ 0]: 5012 [2011/03/03 16:52:47.132463, 5] smbd/uid.c:354(change_to_user) change_to_user uid=(0,65534) gid=(0,65534) [2011/03/03 16:52:47.132501, 4] smbd/vfs.c:721(vfs_ChDir) vfs_ChDir to /tmp [2011/03/03 16:52:47.132562, 10] smbd/nttrans.c:498(reply_ntcreate_and_X) reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = lsarpc [2011/03/03 16:52:47.132606, 4] smbd/nttrans.c:283(nt_open_pipe) nt_open_pipe: Opening pipe \lsarpc. [2011/03/03 16:52:47.132654, 5] smbd/files.c:119(file_new) allocated file structure 13791, fnum = 17887 (1 used) [2011/03/03 16:52:47.132705, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p) Create pipe requested \lsarpc [2011/03/03 16:52:47.132788, 10] rpc_server/srv_lsa_hnd.c:114(init_pipe_handle_list) init_pipe_handles: created handle list for pipe \lsarpc [2011/03/03 16:52:47.132804, 10] rpc_server/srv_lsa_hnd.c:131(init_pipe_handle_list) init_pipe_handles: pipe_handles ref count = 1 for pipe \lsarpc [2011/03/03 16:52:47.132846, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.132866, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.132886, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.132900, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.132912, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.132945, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.132979, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.133003, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:47.133016, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.133052, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:47.133065, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:47.133091, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:47.133105, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.133118, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.133130, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.133143, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.133154, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.133172, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.133192, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.133205, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.133216, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.133264, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.133302, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.133316, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:47.133330, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:47.133348, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:47.133362, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p) Created internal pipe \lsarpc (pipes_open=0) [2011/03/03 16:52:47.133391, 5] smbd/nttrans.c:372(do_ntcreate_pipe_open) do_ntcreate_pipe_open: open pipe = \lsarpc [2011/03/03 16:52:47.133930, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 136 [2011/03/03 16:52:47.133947, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x88 [2011/03/03 16:52:47.133960, 3] smbd/process.c:1485(process_smb) Transaction 5 of length 140 (0 toread) [2011/03/03 16:52:47.133972, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.133988, 5] lib/util.c:627(show_msg) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=320 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17887 (0x45DF) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2011/03/03 16:52:47.134102, 10] ../lib/util/util.c:278(_dump_data) [0000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [0010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [0020] 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xW4.4.. ....#Eg. [0030] AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [0040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2011/03/03 16:52:47.134162, 3] smbd/process.c:1294(switch_message) switch message SMBwriteX (pid 19600) conn 0x2db9e20 [2011/03/03 16:52:47.134179, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.134227, 6] smbd/pipes.c:291(reply_pipe_write_and_X) reply_pipe_write_and_X: 45df name: lsarpc len: 72 [2011/03/03 16:52:47.134247, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 72 [2011/03/03 16:52:47.134270, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:47.134297, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:47.134310, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.134323, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.134366, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:47.134378, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2011/03/03 16:52:47.134409, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0048 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.134518, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.134554, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 11, flags = 3 [2011/03/03 16:52:47.134569, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.134580, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:47.134599, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2011/03/03 16:52:47.134611, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 11 [2011/03/03 16:52:47.134630, 5] rpc_server/srv_pipe.c:1641(api_pipe_bind_req) api_pipe_bind_req: decode request. 1641 [2011/03/03 16:52:47.134666, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_rb [2011/03/03 16:52:47.134680, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 00000000 0008 num_contexts: 01 000c context_id : 0000 000e num_transfer_syntaxes: 01 [2011/03/03 16:52:47.134719, 6] rpc_parse/parse_prs.c:89(prs_debug) 00000f smb_io_rpc_iface [2011/03/03 16:52:47.134758, 7] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_uuid uuid 0010 data : 12345778 0014 data : 1234 0016 data : abcd 0018 data : ef 00 001a data : 01 23 45 67 89 ab 0020 version: 00000000 [2011/03/03 16:52:47.134811, 6] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_rpc_iface [2011/03/03 16:52:47.134824, 7] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_uuid uuid 0024 data : 8a885d04 0028 data : 1ceb 002a data : 11c9 002c data : 9f e8 002e data : 08 00 2b 10 48 60 0034 version: 00000002 [2011/03/03 16:52:47.134856, 3] rpc_server/srv_pipe.c:1667(api_pipe_bind_req) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc [2011/03/03 16:52:47.134869, 5] rpc_server/srv_pipe.c:1717(api_pipe_bind_req) api_pipe_bind_req: make response. 1717 [2011/03/03 16:52:47.134891, 3] rpc_server/srv_pipe.c:998(check_bind_req) check_bind_req for \lsarpc checking lsarpc [2011/03/03 16:52:47.134916, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_ba [2011/03/03 16:52:47.134952, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 000053f0 [2011/03/03 16:52:47.134976, 6] rpc_parse/parse_prs.c:89(prs_debug) 000008 smb_io_rpc_addr_str 0008 len: 000d 000a str: \PIPE\lsarpc. [2011/03/03 16:52:47.135009, 6] rpc_parse/parse_prs.c:89(prs_debug) 000017 smb_io_rpc_results 0018 num_results: 01 001c result : 0000 001e reason : 0000 [2011/03/03 16:52:47.135031, 6] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_rpc_iface [2011/03/03 16:52:47.135044, 7] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_uuid uuid 0020 data : 8a885d04 0024 data : 1ceb 0026 data : 11c9 0028 data : 9f e8 002a data : 08 00 2b 10 48 60 0030 version: 00000002 [2011/03/03 16:52:47.135076, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.135154, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 56 [2011/03/03 16:52:47.135207, 3] smbd/pipes.c:352(pipe_write_andx_done) writeX-IPC nwritten=72 [2011/03/03 16:52:47.135573, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 100 [2011/03/03 16:52:47.135767, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x64 [2011/03/03 16:52:47.135794, 3] smbd/process.c:1485(process_smb) Transaction 32 of length 104 (0 toread) [2011/03/03 16:52:47.135813, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.135824, 5] lib/util.c:627(show_msg) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=440 smb_uid=100 smb_mid=2048 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2011/03/03 16:52:47.135970, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [0010] 00 . [2011/03/03 16:52:47.136142, 3] smbd/process.c:1294(switch_message) switch message SMBntcreateX (pid 19502) conn 0x2db92b0 [2011/03/03 16:52:47.136262, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.136310, 10] smbd/nttrans.c:498(reply_ntcreate_and_X) reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = lsarpc [2011/03/03 16:52:47.136355, 4] smbd/nttrans.c:283(nt_open_pipe) nt_open_pipe: Opening pipe \lsarpc. [2011/03/03 16:52:47.136389, 5] smbd/files.c:119(file_new) allocated file structure 13677, fnum = 17773 (1 used) [2011/03/03 16:52:47.136304, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) [2011/03/03 16:52:47.136425, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p) got smb length of 59 Create pipe requested \lsarpc [2011/03/03 16:52:47.136478, 10] rpc_server/srv_lsa_hnd.c:114(init_pipe_handle_list) init_pipe_handles: created handle list for pipe \lsarpc [2011/03/03 16:52:47.136500, 10] rpc_server/srv_lsa_hnd.c:131(init_pipe_handle_list) init_pipe_handles: pipe_handles ref count = 1 for pipe \lsarpc [2011/03/03 16:52:47.136477, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x3b [2011/03/03 16:52:47.136532, 3] smbd/sec_ctx.c:210(push_sec_ctx) [2011/03/03 16:52:47.136537, 3] smbd/process.c:1485(process_smb) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 Transaction 6 of length 63 (0 toread) [2011/03/03 16:52:47.136555, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.136563, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.136570, 3] smbd/sec_ctx.c:310(set_sec_ctx) [2011/03/03 16:52:47.136577, 5] lib/util.c:627(show_msg) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=384 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17887 (0x45DF) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2011/03/03 16:52:47.136674, 3] smbd/process.c:1294(switch_message) switch message SMBreadX (pid 19600) conn 0x2db9e20 setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.136700, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.136714, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.136752, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) [2011/03/03 16:52:47.136758, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups name: \lsarpc len: 1024 [2011/03/03 16:52:47.136782, 10] rpc_server/srv_pipe_hnd.c:854(read_from_internal_pipe) read_from_pipe: \lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2011/03/03 16:52:47.136819, 10] lib/gencache.c:345(gencache_get_data_blob) [2011/03/03 16:52:47.136824, 3] smbd/pipes.c:462(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=68 Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.136963, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.136995, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:47.137014, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.137027, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:47.137039, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:47.137068, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:47.137091, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.137107, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.137123, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.137139, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.137154, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.137170, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.137192, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.137206, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.137221, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.137248, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.137274, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.137290, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:47.137309, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:47.137334, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:47.137402, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p) Created internal pipe \lsarpc (pipes_open=0) [2011/03/03 16:52:47.137427, 5] smbd/nttrans.c:372(do_ntcreate_pipe_open) do_ntcreate_pipe_open: open pipe = \lsarpc [2011/03/03 16:52:47.137468, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 172 [2011/03/03 16:52:47.137515, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xac [2011/03/03 16:52:47.137530, 3] smbd/process.c:1485(process_smb) Transaction 7 of length 176 (0 toread) [2011/03/03 16:52:47.137545, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.137556, 5] lib/util.c:627(show_msg) size=172 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=136 smb_uid=100 smb_mid=448 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 88 (0x58) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17887 (0x45DF) smb_bcc=105 [2011/03/03 16:52:47.137568, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 58 00 00 00 01 00 00 ........ .X...... [0020] 00 40 00 00 00 00 00 2C 00 00 00 02 00 06 00 00 .@....., ........ [0030] 00 00 00 00 00 06 00 00 00 5C 00 5C 00 50 00 44 ........ .\.\.P.D [0040] 00 43 00 00 00 18 00 00 00 00 00 00 00 00 00 00 .C...... ........ [0050] 00 00 00 00 00 00 00 00 00 04 00 02 00 0C 00 00 ........ ........ [0060] 00 02 00 01 00 01 08 00 00 ........ . [2011/03/03 16:52:47.137751, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19600) conn 0x2db9e20 [2011/03/03 16:52:47.137766, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.137796, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=88 params=0 setup=2 [2011/03/03 16:52:47.137818, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.137832, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.137834, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.137835, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 45df) [2011/03/03 16:52:47.137837, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dbead0 max_trans_reply: 1024 [2011/03/03 16:52:47.137902, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 88 [2011/03/03 16:52:47.137917, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 88 [2011/03/03 16:52:47.137931, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 88 [2011/03/03 16:52:47.137945, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 88, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.137960, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.137974, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:47.137993, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:47.138008, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0058 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.138013, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.138017, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.138092, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.138106, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:47.138120, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 72, incoming data = 72 [2011/03/03 16:52:47.138134, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.138149, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000040 0004 context_id: 0000 0006 opnum : 002c [2011/03/03 16:52:47.138175, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 75 [2011/03/03 16:52:47.138206, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.138240, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2011/03/03 16:52:47.138240, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[44].fn == 0x621b60 [2011/03/03 16:52:47.138449, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '\\PDC' attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x00000801 (2049) 1: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 1: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2011/03/03 16:52:47.138660, 4] rpc_server/srv_samr_nt.c:230(access_check_object) [2011/03/03 16:52:47.138727, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 224 [2011/03/03 16:52:47.138758, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xe0 [2011/03/03 16:52:47.138773, 3] smbd/process.c:1485(process_smb) Transaction 33 of length 228 (0 toread) [2011/03/03 16:52:47.138793, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.138804, 5] lib/util.c:627(show_msg) size=224 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2112 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17773 (0x456D) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 160 (0xA0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 160 (0xA0) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=161 [2011/03/03 16:52:47.138811, 10] ../lib/util/util.c:278(_dump_data) [0000] EE 05 00 0B 03 10 00 00 00 A0 00 00 00 01 00 00 ........ ........ [0010] 00 B8 10 B8 10 00 00 00 00 03 00 00 00 00 00 01 ........ ........ [0020] 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xW4.4.. ....#Eg. [0030] AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [0040] 00 2B 10 48 60 02 00 00 00 01 00 01 00 78 57 34 .+.H`... .....xW4 [0050] 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 .4...... #Eg..... [0060] 00 33 05 71 71 BA BE 37 49 83 19 B5 DB EF 9C CC .3.qq..7 I....... [0070] 36 01 00 00 00 02 00 01 00 78 57 34 12 34 12 CD 6....... .xW4.4.. [0080] AB EF 00 01 23 45 67 89 AB 00 00 00 00 2C 1C B7 ....#Eg. .....,.. [0090] 6C 12 98 40 45 01 00 00 00 00 00 00 00 01 00 00 l..@E... ........ [00A0] 00 . [2011/03/03 16:52:47.139002, 3] smbd/process.c:1294(switch_message) switch message SMBwriteX (pid 19502) conn 0x2db92b0 [2011/03/03 16:52:47.139031, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.139046, 6] smbd/pipes.c:291(reply_pipe_write_and_X) reply_pipe_write_and_X: 456d name: lsarpc len: 160 [2011/03/03 16:52:47.139046, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 160 [2011/03/03 16:52:47.139046, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 160 [2011/03/03 16:52:47.139103, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 160 [2011/03/03 16:52:47.139117, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 160, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.139132, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.139145, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 144 [2011/03/03 16:52:47.139159, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 144 [2011/03/03 16:52:47.139173, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 00a0 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.139236, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.139237, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 11, flags = 3 [2011/03/03 16:52:47.139239, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.139240, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 144 [2011/03/03 16:52:47.139300, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 144, incoming data = 144 [2011/03/03 16:52:47.139314, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 11 [2011/03/03 16:52:47.139317, 5] rpc_server/srv_pipe.c:1641(api_pipe_bind_req) api_pipe_bind_req: decode request. 1641 [2011/03/03 16:52:47.139319, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_rb [2011/03/03 16:52:47.139321, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 00000000 0008 num_contexts: 03 000c context_id : 0000 000e num_transfer_syntaxes: 01 [2011/03/03 16:52:47.139437, 6] rpc_parse/parse_prs.c:89(prs_debug) 00000f smb_io_rpc_iface [2011/03/03 16:52:47.139439, 7] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_uuid uuid 0010 data : 12345778 0014 data : 1234 0016 data : abcd 0018 data : ef 00 001a data : 01 23 45 67 89 ab 0020 version: 00000000 [2011/03/03 16:52:47.139495, 6] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_rpc_iface [2011/03/03 16:52:47.139510, 7] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_uuid uuid 0024 data : 8a885d04 0028 data : 1ceb 002a data : 11c9 002c data : 9f e8 002e data : 08 00 2b 10 48 60 0034 version: 00000002 0038 context_id : 0001 003a num_transfer_syntaxes: 01 [2011/03/03 16:52:47.139550, 6] rpc_parse/parse_prs.c:89(prs_debug) 00003b smb_io_rpc_iface [2011/03/03 16:52:47.139564, 7] rpc_parse/parse_prs.c:89(prs_debug) 00003c smb_io_uuid uuid 003c data : 12345778 0040 data : 1234 0042 data : abcd 0044 data : ef 00 0046 data : 01 23 45 67 89 ab 004c version: 00000000 [2011/03/03 16:52:47.139617, 6] rpc_parse/parse_prs.c:89(prs_debug) 000050 smb_io_rpc_iface [2011/03/03 16:52:47.139632, 7] rpc_parse/parse_prs.c:89(prs_debug) 000050 smb_io_uuid uuid 0050 data : 71710533 0054 data : beba 0056 data : 4937 0058 data : 83 19 005a data : b5 db ef 9c cc 36 0060 version: 00000001 0064 context_id : 0002 0066 num_transfer_syntaxes: 01 [2011/03/03 16:52:47.139690, 6] rpc_parse/parse_prs.c:89(prs_debug) 000067 smb_io_rpc_iface [2011/03/03 16:52:47.139707, 7] rpc_parse/parse_prs.c:89(prs_debug) 000068 smb_io_uuid uuid 0068 data : 12345778 006c data : 1234 006e data : abcd 0070 data : ef 00 0072 data : 01 23 45 67 89 ab 0078 version: 00000000 [2011/03/03 16:52:47.139742, 6] rpc_parse/parse_prs.c:89(prs_debug) 00007c smb_io_rpc_iface [2011/03/03 16:52:47.139757, 7] rpc_parse/parse_prs.c:89(prs_debug) 00007c smb_io_uuid uuid 007c data : 6cb71c2c 0080 data : 9812 0082 data : 4540 0084 data : 01 00 0086 data : 00 00 00 00 00 00 008c version: 00000001 [2011/03/03 16:52:47.139801, 3] rpc_server/srv_pipe.c:1667(api_pipe_bind_req) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc [2011/03/03 16:52:47.139802, 5] rpc_server/srv_pipe.c:1717(api_pipe_bind_req) api_pipe_bind_req: make response. 1717 [2011/03/03 16:52:47.139834, 3] rpc_server/srv_pipe.c:998(check_bind_req) check_bind_req for \lsarpc checking lsarpc [2011/03/03 16:52:47.139854, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_ba [2011/03/03 16:52:47.139871, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 000053f0 [2011/03/03 16:52:47.139904, 6] rpc_parse/parse_prs.c:89(prs_debug) 000008 smb_io_rpc_addr_str 0008 len: 000d 000a str: \PIPE\lsarpc. [2011/03/03 16:52:47.139931, 6] rpc_parse/parse_prs.c:89(prs_debug) 000017 smb_io_rpc_results 0018 num_results: 01 001c result : 0000 001e reason : 0000 [2011/03/03 16:52:47.139955, 6] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_rpc_iface [2011/03/03 16:52:47.139969, 7] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_uuid uuid 0020 data : 8a885d04 0024 data : 1ceb 0026 data : 11c9 0028 data : 9f e8 002a data : 08 00 2b 10 48 60 0030 version: 00000002 [2011/03/03 16:52:47.139972, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.140058, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 144 [2011/03/03 16:52:47.140078, 3] smbd/pipes.c:352(pipe_write_andx_done) writeX-IPC nwritten=160 _lsa_OpenPolicy2: access GRANTED (requested: 0x00000801, granted: 0x00000801) [2011/03/03 16:52:47.140150, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal) Opened policy hnd[1] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 6F 4D 4F B9 ........ ....oMO. [0010] 90 4C 00 00 .L.. [2011/03/03 16:52:47.140187, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000001-0000-0000-6f4d-4fb9904c0000 result : NT_STATUS_OK [2011/03/03 16:52:47.140273, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:47.140295, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 1084 [2011/03/03 16:52:47.140310, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 72 [2011/03/03 16:52:47.140335, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.140350, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:47.140372, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.140432, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:47.140465, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:47.140480, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.140497, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=136 smb_uid=100 smb_mid=448 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:47.140562, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ [0020] 00 00 00 00 00 6F 4D 4F B9 90 4C 00 00 00 00 00 .....oMO ..L..... [0030] 00 . [2011/03/03 16:52:47.141031, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 208 [2011/03/03 16:52:47.141059, 6] smbd/process.c:1482(process_smb) [2011/03/03 16:52:47.141131, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 59 [2011/03/03 16:52:47.141157, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x3b [2011/03/03 16:52:47.141176, 3] smbd/process.c:1485(process_smb) Transaction 34 of length 63 (0 toread) [2011/03/03 16:52:47.141210, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.141219, 5] lib/util.c:627(show_msg) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2176 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17773 (0x456D) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2011/03/03 16:52:47.141295, 3] smbd/process.c:1294(switch_message) switch message SMBreadX (pid 19502) conn 0x2db92b0 [2011/03/03 16:52:47.141308, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.141324, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.141362, 10] rpc_server/srv_pipe_hnd.c:854(read_from_internal_pipe) read_from_pipe: \lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2011/03/03 16:52:47.141379, 3] smbd/pipes.c:462(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=68 got message type 0x0 of len 0xd0 [2011/03/03 16:52:47.141419, 3] smbd/process.c:1485(process_smb) Transaction 8 of length 212 (0 toread) [2011/03/03 16:52:47.141433, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.141442, 5] lib/util.c:627(show_msg) size=208 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=136 smb_uid=100 smb_mid=512 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 124 (0x7C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17887 (0x45DF) smb_bcc=141 [2011/03/03 16:52:47.141526, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 7C 00 00 00 02 00 00 ........ .|...... [0020] 00 64 00 00 00 00 00 3A 00 00 00 00 00 01 00 00 .d.....: ........ [0030] 00 00 00 00 00 6F 4D 4F B9 90 4C 00 00 01 00 00 .....oMO ..L..... [0040] 00 01 00 00 00 1A 00 1C 00 00 00 02 00 0E 00 00 ........ ........ [0050] 00 00 00 00 00 0D 00 00 00 70 00 65 00 74 00 40 ........ .p.e.t.@ [0060] 00 53 00 41 00 41 00 43 00 4B 00 45 00 2E 00 44 .D.O.M.A .I.N...Q [0070] 00 45 00 00 00 00 00 00 00 00 00 00 00 02 00 00 .A...... ........ [0080] 00 00 00 00 00 00 00 00 00 02 00 00 00 ........ ..... [2011/03/03 16:52:47.141626, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19600) conn 0x2db9e20 [2011/03/03 16:52:47.141639, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.141652, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=124 params=0 setup=2 [2011/03/03 16:52:47.141665, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.141676, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.141695, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.141707, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 45df) [2011/03/03 16:52:47.141719, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dbead0 max_trans_reply: 1024 [2011/03/03 16:52:47.141731, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 124 [2011/03/03 16:52:47.141743, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 124 [2011/03/03 16:52:47.141755, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 124 [2011/03/03 16:52:47.141766, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 124, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.141778, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.141797, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:47.141809, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 108 [2011/03/03 16:52:47.141820, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 007c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:47.141879, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.141899, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.141911, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.141923, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:47.141934, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 108, incoming data = 108 [2011/03/03 16:52:47.141946, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.141957, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000064 0004 context_id: 0000 0006 opnum : 003a [2011/03/03 16:52:47.141979, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.141999, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.142011, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x3a - api_rpcTNP: rpc command: LSA_LOOKUPNAMES2 [2011/03/03 16:52:47.142024, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[58].fn == 0x61f3a0 [2011/03/03 16:52:47.142055, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 in: struct lsa_LookupNames2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000001-0000-0000-6f4d-4fb9904c0000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001a (26) size : 0x001a (26) string : * string : 'pet@DOMAIN.QA' sids : * sids: struct lsa_TransSidArray2 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2011/03/03 16:52:47.142258, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 6F 4D 4F B9 ........ ....oMO. [0010] 90 4C 00 00 .L.. [2011/03/03 16:52:47.142296, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.142310, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.142322, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.142334, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.142345, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.142371, 5] rpc_server/srv_lsa_nt.c:188(lookup_lsa_rids) lookup_lsa_rids: looking up name pet@DOMAIN.QA [2011/03/03 16:52:47.142393, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: pet@DOMAIN.QA => (domain), pet@DOMAIN.QA (name) [2011/03/03 16:52:47.142393, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 172 [2011/03/03 16:52:47.142448, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xac [2011/03/03 16:52:47.142463, 3] smbd/process.c:1485(process_smb) Transaction 35 of length 176 (0 toread) [2011/03/03 16:52:47.142477, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.142488, 5] lib/util.c:627(show_msg) size=172 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=440 smb_uid=100 smb_mid=2240 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 88 (0x58) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17773 (0x456D) smb_bcc=105 [2011/03/03 16:52:47.142575, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 58 00 00 00 01 00 00 ........ .X...... [0020] 00 40 00 00 00 00 00 2C 00 00 00 02 00 06 00 00 .@....., ........ [0030] 00 00 00 00 00 06 00 00 00 5C 00 5C 00 50 00 44 ........ .\.\.P.D [0040] 00 43 00 00 00 30 00 00 00 00 00 00 00 00 00 00 .C...0.. ........ [0050] 00 00 00 00 00 00 00 00 00 04 00 02 00 0C 00 00 ........ ........ [0060] 00 02 00 01 00 01 08 00 00 ........ . [2011/03/03 16:52:47.142715, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19502) conn 0x2db92b0 [2011/03/03 16:52:47.142730, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.142745, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=88 params=0 setup=2 [2011/03/03 16:52:47.142761, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.142775, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.142776, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.142778, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 456d) [2011/03/03 16:52:47.142779, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db5550 max_trans_reply: 1024 [2011/03/03 16:52:47.142837, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 88 [2011/03/03 16:52:47.142852, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 88 [2011/03/03 16:52:47.142865, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 88 [2011/03/03 16:52:47.142880, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 88, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.142900, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.142913, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:47.142926, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:47.142940, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0058 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.142946, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.142952, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.142956, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.143044, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:47.143058, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 72, incoming data = 72 [2011/03/03 16:52:47.143072, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.143093, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000040 0004 context_id: 0000 0006 opnum : 002c [2011/03/03 16:52:47.143117, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 179 [2011/03/03 16:52:47.143133, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.143148, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2011/03/03 16:52:47.143169, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[44].fn == 0x621b60 [2011/03/03 16:52:47.143171, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : '\\PDC' attr : * attr: struct lsa_ObjectAttribute len : 0x00000030 (48) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x00000801 (2049) 1: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 1: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2011/03/03 16:52:47.143244, 4] rpc_server/srv_samr_nt.c:230(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x00000801, granted: 0x00000801) [2011/03/03 16:52:47.143370, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal) Opened policy hnd[1] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 6F 4D 4F B9 ........ ....oMO. [0010] 2E 4C 00 00 .L.. [2011/03/03 16:52:47.143372, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-6f4d-4fb92e4c0000 result : NT_STATUS_OK [2011/03/03 16:52:47.143462, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:47.143478, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 1084 [2011/03/03 16:52:47.143506, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 72 [2011/03/03 16:52:47.143533, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.143549, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:47.143632, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.143699, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:47.143731, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:47.143746, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.143757, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=440 smb_uid=100 smb_mid=2240 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:47.143761, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 01 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 05 00 00 ........ ........ [0020] 00 00 00 00 00 6F 4D 4F B9 2E 4C 00 00 00 00 00 .....oMO ..L..... [0030] 00 . [2011/03/03 16:52:47.142393, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x043 [2011/03/03 16:52:47.143911, 10] passdb/pdb_ldap.c:6185(ldapsam_get_trusteddom_pw) ldapsam_get_trusteddom_pw called for domain pet@DOMAIN.QA [2011/03/03 16:52:47.143937, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [sambaDomainName=pet@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa], filter => [(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=pet@DOMAIN.QA))], scope => [2] [2011/03/03 16:52:47.144370, 10] lib/smbldap.c:1424(smbldap_search_ext) Failed search for base: sambaDomainName=pet@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa, error: 32 (No such object) (unknown) [2011/03/03 16:52:47.144586, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.144606, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.144622, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.144643, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.144661, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.144736, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=pet@DOMAIN.QA)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:47.145758, 4] passdb/pdb_ldap.c:1598(ldapsam_getsampwnam) ldapsam_getsampwnam: Unable to locate user [pet@DOMAIN.QA] count=0 [2011/03/03 16:52:47.145784, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.145787, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.145787, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.145870, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.145889, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.145904, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.145940, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=pet@DOMAIN.QA)(cn=pet@DOMAIN.QA)))], scope => [2] [2011/03/03 16:52:47.145787, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 208 [2011/03/03 16:52:47.146049, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xd0 [2011/03/03 16:52:47.146386, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(|(displayName=pet@DOMAIN.QA)(cn=pet@DOMAIN.QA))) [2011/03/03 16:52:47.146390, 3] smbd/process.c:1485(process_smb) Transaction 36 of length 212 (0 toread) [2011/03/03 16:52:47.146390, 3] smbd/sec_ctx.c:418(pop_sec_ctx) [2011/03/03 16:52:47.146393, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.146395, 5] lib/util.c:627(show_msg) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 size=208 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=440 smb_uid=100 smb_mid=2304 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 124 (0x7C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17773 (0x456D) smb_bcc=141 [2011/03/03 16:52:47.146532, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 7C 00 00 00 02 00 00 ........ .|...... [0020] 00 64 00 00 00 00 00 3A 00 00 00 00 00 05 00 00 .d.....: ........ [0030] 00 00 00 00 00 6F 4D 4F B9 2E 4C 00 00 01 00 00 .....oMO ..L..... [0040] 00 01 00 00 00 1A 00 1C 00 00 00 02 00 0E 00 00 ........ ........ [0050] 00 00 00 00 00 0D 00 00 00 73 00 61 00 64 00 40 ........ .s.a.d.@ [0060] 00 53 00 41 00 41 00 43 00 4B 00 45 00 2E 00 44 .D.O.M.A .I.N...Q [0070] 00 45 00 71 71 00 00 00 00 00 00 00 00 02 00 00 .A.qq... ........ [0080] 00 00 00 00 00 00 00 00 00 02 00 00 00 ........ ..... [2011/03/03 16:52:47.146650, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19502) conn 0x2db92b0 [2011/03/03 16:52:47.146668, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.146696, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=124 params=0 setup=2 [2011/03/03 16:52:47.146716, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.146731, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.146751, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.146765, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 456d) [2011/03/03 16:52:47.146790, 10] smbd/ipc.c:462(api_fd_reply) [2011/03/03 16:52:47.146897, 5] rpc_server/srv_lsa_nt.c:207(lookup_lsa_rids) api_fd_reply: p:0x2db5550 max_trans_reply: 1024 init_lsa_rids: pet@DOMAIN.QA not found [2011/03/03 16:52:47.146942, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.146962, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) [2011/03/03 16:52:47.146916, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 124 lsa_LookupNames2: struct lsa_LookupNames2 [2011/03/03 16:52:47.147015, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 124 out: struct lsa_LookupNames2 [2011/03/03 16:52:47.147053, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) domains : * process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 124 domains : * [2011/03/03 16:52:47.147067, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 124, len_needed_to_complete_hdr = 16, receive_len = 0 domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) [2011/03/03 16:52:47.147080, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) sids : * write_to_pipe: data_used = 16 sids: struct lsa_TransSidArray2 count : 0x00000001 (1) [2011/03/03 16:52:47.147111, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) sids : * write_to_pipe: data_left = 108 sids: ARRAY(1) [2011/03/03 16:52:47.147134, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) sids: struct lsa_TranslatedSid2 process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 108 sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) [2011/03/03 16:52:47.147152, 5] rpc_parse/parse_prs.c:89(prs_debug) sid_index : 0xffffffff (4294967295) unknown : 0x00000000 (0) 000000 smb_io_rpc_hdr count : * 0000 major : 05 count : 0x00000000 (0) 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 007c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:47.147223, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC result : NT_STATUS_NONE_MAPPED [2011/03/03 16:52:47.147240, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.147276, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) [2011/03/03 16:52:47.147260, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:47.147260, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:47.147311, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) [2011/03/03 16:52:47.147313, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 108, incoming data = 108 [2011/03/03 16:52:47.147331, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.147347, 5] rpc_parse/parse_prs.c:89(prs_debug) free_pipe_context: destroying talloc pool of size 68 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000064 0004 context_id: 0000 0006 opnum : 003a [2011/03/03 16:52:47.147365, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 108 [2011/03/03 16:52:47.147376, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.147398, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.147429, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) [2011/03/03 16:52:47.147464, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) api_rpcTNP: \lsarpc op 0x3a - api_rpcTNP: rpc command: LSA_LOOKUPNAMES2 name: \lsarpc len: 1024 [2011/03/03 16:52:47.147482, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 52. [2011/03/03 16:52:47.147458, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[58].fn == 0x61f3a0 [2011/03/03 16:52:47.147503, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 [2011/03/03 16:52:47.147537, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 004c 000a auth_len : 0000 lsa_LookupNames2: struct lsa_LookupNames2 000c call_id : 00000002 in: struct lsa_LookupNames2 handle : * [2011/03/03 16:52:47.147576, 5] rpc_parse/parse_prs.c:89(prs_debug) handle: struct policy_handle 000010 smb_io_rpc_hdr_resp resp handle_type : 0x00000000 (0) 0010 alloc_hint: 00000034 0014 context_id: 0000 0016 cancel_ct : 00 uuid : 00000005-0000-0000-6f4d-4fb92e4c0000 0017 reserved : 00 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001a (26) [2011/03/03 16:52:47.147640, 5] smbd/ipc.c:59(copy_trans_params_and_data) size : 0x001a (26) copy_trans_params_and_data: params[0..0] data[0..76] (align 0) string : * string : 'sad@DOMAIN.QA' sids : * [2011/03/03 16:52:47.147662, 5] lib/util.c:617(show_msg) sids: struct lsa_TransSidArray2 [2011/03/03 16:52:47.147676, 5] lib/util.c:627(show_msg) size=132 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 count : 0x00000000 (0) smb_flg2=51203 sids : NULL smb_tid=1 smb_pid=136 smb_uid=100 smb_mid=512 smt_wct=10 level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) smb_vwv[ 0]= 0 (0x0) count : * smb_vwv[ 1]= 76 (0x4C) count : 0x00000000 (0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) smb_vwv[ 4]= 56 (0x38) client_revision : LSA_CLIENT_REVISION_2 (2) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 76 (0x4C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) [2011/03/03 16:52:47.147758, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) smb_bcc=77 Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 6F 4D 4F B9 ........ ....oMO. [2011/03/03 16:52:47.147776, 10] ../lib/util/util.c:278(_dump_data) [0010] 2E 4C 00 00 .L.. [0000] 00 05 00 02 03 10 00 00 00 4C 00 00 00 02 00 00 ........ .L...... [2011/03/03 16:52:47.147800, 3] smbd/sec_ctx.c:210(push_sec_ctx) [0010] 00 34 00 00 00 00 00 00 00 00 00 02 00 00 00 00 .4...... ........ push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [0020] 00 00 00 00 00 00 00 00 00 01 00 00 00 04 00 02 ........ ........ [2011/03/03 16:52:47.147828, 3] smbd/uid.c:429(push_conn_ctx) [0030] 00 01 00 00 00 08 00 00 00 00 00 00 00 FF FF FF ........ ........ push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [0040] FF 00 00 00 00 00 00 00 00 73 00 00 C0 ........ .s... [2011/03/03 16:52:47.147848, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.147878, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.147901, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.147938, 5] rpc_server/srv_lsa_nt.c:188(lookup_lsa_rids) lookup_lsa_rids: looking up name sad@DOMAIN.QA [2011/03/03 16:52:47.147954, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: sad@DOMAIN.QA => (domain), sad@DOMAIN.QA (name) [2011/03/03 16:52:47.147973, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x043 [2011/03/03 16:52:47.147994, 10] passdb/pdb_ldap.c:6185(ldapsam_get_trusteddom_pw) ldapsam_get_trusteddom_pw called for domain sad@DOMAIN.QA [2011/03/03 16:52:47.147994, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [sambaDomainName=sad@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa], filter => [(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=sad@DOMAIN.QA))], scope => [2] [2011/03/03 16:52:47.148469, 10] lib/smbldap.c:1424(smbldap_search_ext) Failed search for base: sambaDomainName=sad@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa, error: 32 (No such object) (unknown) [2011/03/03 16:52:47.148631, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.148646, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.148658, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.148670, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.148681, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.148731, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=sad@DOMAIN.QA)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:47.149092, 4] passdb/pdb_ldap.c:1598(ldapsam_getsampwnam) ldapsam_getsampwnam: Unable to locate user [sad@DOMAIN.QA] count=0 [2011/03/03 16:52:47.149112, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.149125, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.149137, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.149149, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.149160, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.149171, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.149200, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=sad@DOMAIN.QA)(cn=sad@DOMAIN.QA)))], scope => [2] [2011/03/03 16:52:47.149039, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 128 [2011/03/03 16:52:47.149310, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x80 [2011/03/03 16:52:47.149332, 3] smbd/process.c:1485(process_smb) Transaction 9 of length 132 (0 toread) [2011/03/03 16:52:47.149350, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.149367, 5] lib/util.c:627(show_msg) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=136 smb_uid=100 smb_mid=576 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17887 (0x45DF) smb_bcc=61 [2011/03/03 16:52:47.149470, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... [0020] 00 14 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ [0030] 00 00 00 00 00 6F 4D 4F B9 90 4C 00 00 .....oMO ..L.. [2011/03/03 16:52:47.149576, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19600) conn 0x2db9e20 [2011/03/03 16:52:47.149610, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.149671, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=44 params=0 setup=2 [2011/03/03 16:52:47.149711, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.149730, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.149748, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.149766, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 45df) [2011/03/03 16:52:47.149791, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dbead0 max_trans_reply: 1024 [2011/03/03 16:52:47.149807, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 44 [2011/03/03 16:52:47.149827, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 44 [2011/03/03 16:52:47.149841, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2011/03/03 16:52:47.149860, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) [2011/03/03 16:52:47.149822, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(|(displayName=sad@DOMAIN.QA)(cn=sad@DOMAIN.QA))) [2011/03/03 16:52:47.149883, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.149915, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:47.149918, 3] smbd/sec_ctx.c:418(pop_sec_ctx) [2011/03/03 16:52:47.149937, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2011/03/03 16:52:47.149970, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 002c 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:47.150031, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.150046, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.150057, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.150057, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:47.150096, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2011/03/03 16:52:47.150111, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.150125, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000014 0004 context_id: 0000 0006 opnum : 0000 [2011/03/03 16:52:47.150166, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.150197, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.150230, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2011/03/03 16:52:47.150254, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[0].fn == 0x629770 [2011/03/03 16:52:47.150323, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000001-0000-0000-6f4d-4fb9904c0000 [2011/03/03 16:52:47.150459, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 6F 4D 4F B9 ........ ....oMO. [0010] 90 4C 00 00 .L.. [2011/03/03 16:52:47.150491, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 01 00 00 00 00 00 00 00 6F 4D 4F B9 ........ ....oMO. [0010] 90 4C 00 00 .L.. [2011/03/03 16:52:47.150522, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd) Closed policy [2011/03/03 16:52:47.150541, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2011/03/03 16:52:47.150622, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:47.150641, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.150654, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 28 [2011/03/03 16:52:47.150454, 5] rpc_server/srv_lsa_nt.c:207(lookup_lsa_rids) init_lsa_rids: sad@DOMAIN.QA not found [2011/03/03 16:52:47.150683, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.150717, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) [2011/03/03 16:52:47.150667, 3] smbd/sec_ctx.c:418(pop_sec_ctx) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.150757, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr [2011/03/03 16:52:47.150761, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 lsa_LookupNames2: struct lsa_LookupNames2 000c call_id : 00000003 out: struct lsa_LookupNames2 domains : * domains : * [2011/03/03 16:52:47.150824, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 domains: struct lsa_RefDomainList 0014 context_id: 0000 0016 cancel_ct : 00 count : 0x00000000 (0) 0017 reserved : 00 domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray2 [2011/03/03 16:52:47.150905, 5] smbd/ipc.c:59(copy_trans_params_and_data) count : 0x00000001 (1) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) sids : * sids: ARRAY(1) [2011/03/03 16:52:47.150954, 5] lib/util.c:617(show_msg) sids: struct lsa_TranslatedSid2 [2011/03/03 16:52:47.150966, 5] lib/util.c:627(show_msg) sid_type : SID_NAME_UNKNOWN (8) size=104 rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) smb_com=0x25 smb_rcls=0 unknown : 0x00000000 (0) smb_reh=0 count : * smb_err=0 count : 0x00000000 (0) smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=136 smb_uid=100 smb_mid=576 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) result : NT_STATUS_NONE_MAPPED smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:47.151033, 10] ../lib/util/util.c:278(_dump_data) [2011/03/03 16:52:47.151064, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 . [2011/03/03 16:52:47.151149, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 68 [2011/03/03 16:52:47.151172, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 108 [2011/03/03 16:52:47.151255, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.151270, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 52. [2011/03/03 16:52:47.151290, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 004c 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:47.151396, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000034 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:47.151427, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..76] (align 0) [2011/03/03 16:52:47.151451, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.151464, 5] lib/util.c:627(show_msg) size=132 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=440 smb_uid=100 smb_mid=2304 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 76 (0x4C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=77 [2011/03/03 16:52:47.151549, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 4C 00 00 00 02 00 00 ........ .L...... [2011/03/03 16:52:47.151571, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) [0010] 00 34 00 00 00 00 00 00 00 00 00 02 00 00 00 00 .4...... ........ got smb length of 41 [0020] 00 00 00 00 00 00 00 00 00 01 00 00 00 04 00 02 ........ ........ [2011/03/03 16:52:47.151596, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x29 [0030] 00 01 00 00 00 08 00 00 00 00 00 00 00 FF FF FF ........ ........ [2011/03/03 16:52:47.151619, 3] smbd/process.c:1485(process_smb) Transaction 10 of length 45 (0 toread) [0040] FF 00 00 00 00 00 00 00 00 73 00 00 C0 ........ .s... [2011/03/03 16:52:47.151636, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.151651, 5] lib/util.c:627(show_msg) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=640 smt_wct=3 smb_vwv[ 0]=17887 (0x45DF) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2011/03/03 16:52:47.151794, 3] smbd/process.c:1294(switch_message) switch message SMBclose (pid 19600) conn 0x2db9e20 [2011/03/03 16:52:47.151808, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.151827, 3] smbd/reply.c:4634(reply_close) close fd=-1 fnum=17887 (numopen=1) [2011/03/03 16:52:47.151859, 6] smbd/close.c:501(set_close_write_time) close_write_time: Sun Feb 7 07:28:15 2106 [2011/03/03 16:52:47.152078, 10] rpc_server/srv_lsa_hnd.c:290(close_policy_by_pipe) close_policy_by_pipe: deleted handle list for pipe \lsarpc [2011/03/03 16:52:47.152180, 5] smbd/files.c:497(file_free) freed files structure 17887 (0 used) [2011/03/03 16:52:47.152205, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.152215, 5] lib/util.c:627(show_msg) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=640 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:47.152747, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 128 [2011/03/03 16:52:47.152783, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x80 [2011/03/03 16:52:47.152810, 3] smbd/process.c:1485(process_smb) Transaction 37 of length 132 (0 toread) [2011/03/03 16:52:47.152829, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.152865, 5] lib/util.c:627(show_msg) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=440 smb_uid=100 smb_mid=2368 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=17773 (0x456D) smb_bcc=61 [2011/03/03 16:52:47.152954, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 ........ .,...... [0020] 00 14 00 00 00 00 00 00 00 00 00 00 00 05 00 00 ........ ........ [0030] 00 00 00 00 00 6F 4D 4F B9 2E 4C 00 00 .....oMO ..L.. [2011/03/03 16:52:47.152961, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 19502) conn 0x2db92b0 [2011/03/03 16:52:47.152968, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.153064, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=44 params=0 setup=2 [2011/03/03 16:52:47.153086, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.153101, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.153117, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.153138, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 456d) [2011/03/03 16:52:47.153152, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2db5550 max_trans_reply: 1024 [2011/03/03 16:52:47.153167, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 44 [2011/03/03 16:52:47.153198, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 44 [2011/03/03 16:52:47.153199, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2011/03/03 16:52:47.153200, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.153255, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.153273, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:47.153287, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2011/03/03 16:52:47.153301, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 002c 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:47.153361, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.153375, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.153390, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.153403, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:47.153404, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2011/03/03 16:52:47.153404, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.153459, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000014 0004 context_id: 0000 0006 opnum : 0000 [2011/03/03 16:52:47.153489, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.153504, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.153525, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2011/03/03 16:52:47.153551, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[0].fn == 0x629770 [2011/03/03 16:52:47.153593, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000005-0000-0000-6f4d-4fb92e4c0000 [2011/03/03 16:52:47.153723, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 6F 4D 4F B9 ........ ....oMO. [0010] 2E 4C 00 00 .L.. [2011/03/03 16:52:47.153758, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 05 00 00 00 00 00 00 00 6F 4D 4F B9 ........ ....oMO. [0010] 2E 4C 00 00 .L.. [2011/03/03 16:52:47.153784, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd) Closed policy [2011/03/03 16:52:47.153795, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2011/03/03 16:52:47.153857, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:47.153876, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.153889, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 28 [2011/03/03 16:52:47.153909, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.153923, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:47.153946, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:47.153995, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:47.154023, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:47.154047, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.154056, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=440 smb_uid=100 smb_mid=2368 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:47.154118, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 . [2011/03/03 16:52:47.156275, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 41 [2011/03/03 16:52:47.156305, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x29 [2011/03/03 16:52:47.156322, 3] smbd/process.c:1485(process_smb) Transaction 38 of length 45 (0 toread) [2011/03/03 16:52:47.156343, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.156354, 5] lib/util.c:627(show_msg) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2432 smt_wct=3 smb_vwv[ 0]=17773 (0x456D) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2011/03/03 16:52:47.156501, 3] smbd/process.c:1294(switch_message) switch message SMBclose (pid 19502) conn 0x2db92b0 [2011/03/03 16:52:47.156522, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.156547, 3] smbd/reply.c:4634(reply_close) close fd=-1 fnum=17773 (numopen=1) [2011/03/03 16:52:47.157423, 6] smbd/close.c:501(set_close_write_time) close_write_time: Sun Feb 7 07:28:15 2106 [2011/03/03 16:52:47.157972, 10] rpc_server/srv_lsa_hnd.c:290(close_policy_by_pipe) close_policy_by_pipe: deleted handle list for pipe \lsarpc [2011/03/03 16:52:47.158000, 5] smbd/files.c:497(file_free) freed files structure 17773 (0 used) [2011/03/03 16:52:47.158022, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.158040, 5] lib/util.c:627(show_msg) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2432 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:47.204568, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 100 [2011/03/03 16:52:47.204755, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x64 [2011/03/03 16:52:47.204773, 3] smbd/process.c:1485(process_smb) Transaction 96059 of length 104 (0 toread) [2011/03/03 16:52:47.204787, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.204797, 5] lib/util.c:627(show_msg) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=596 smb_uid=101 smb_mid=50690 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 4096 (0x1000) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 4609 (0x1201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 1792 (0x700) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 512 (0x200) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2011/03/03 16:52:47.204919, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [0010] 00 . [2011/03/03 16:52:47.204959, 3] smbd/process.c:1294(switch_message) switch message SMBntcreateX (pid 20360) conn 0x2d870a0 [2011/03/03 16:52:47.204975, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.204996, 10] smbd/nttrans.c:498(reply_ntcreate_and_X) reply_ntcreate_and_X: flags = 0x10, access_mask = 0x12019f file_attributes = 0x0, share_access = 0x7, create_disposition = 0x1 create_options = 0x20040 root_dir_fid = 0x0, fname = lsarpc [2011/03/03 16:52:47.205031, 4] smbd/nttrans.c:283(nt_open_pipe) nt_open_pipe: Opening pipe \lsarpc. [2011/03/03 16:52:47.205055, 5] smbd/files.c:119(file_new) allocated file structure 15772, fnum = 19868 (2 used) [2011/03/03 16:52:47.205080, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p) Create pipe requested \lsarpc [2011/03/03 16:52:47.205107, 10] rpc_server/srv_lsa_hnd.c:131(init_pipe_handle_list) init_pipe_handles: pipe_handles ref count = 2 for pipe \lsarpc [2011/03/03 16:52:47.205133, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(2067, 1005) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.205359, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.205374, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.205387, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.205405, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.205473, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/maximum password age, value = 4294967295 , timeout = Thu Mar 3 16:52:51 2011 [2011/03/03 16:52:47.205519, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (2067, 1005) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.205538, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(2067, 1005) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.205559, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.205572, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.205585, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.205597, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.205630, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.205704, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (2067, 1005) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.205734, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username brg-pc$, was [2011/03/03 16:52:47.205757, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.205771, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username brg-pc$, was [2011/03/03 16:52:47.205784, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name Dell T3500, was [2011/03/03 16:52:47.205815, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\brg-pc_, was [2011/03/03 16:52:47.205830, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.205844, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.205866, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.205880, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.205894, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(2067, 1005) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.205918, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.205931, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.205943, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.205965, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.205990, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.206014, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (2067, 1005) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.206033, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-1051 [2011/03/03 16:52:47.206066, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-1051 from rid 1051 [2011/03/03 16:52:47.206088, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-11011 [2011/03/03 16:52:47.206107, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p) Created internal pipe \lsarpc (pipes_open=0) [2011/03/03 16:52:47.206126, 5] smbd/nttrans.c:372(do_ntcreate_pipe_open) do_ntcreate_pipe_open: open pipe = \lsarpc [2011/03/03 16:52:47.206590, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 224 [2011/03/03 16:52:47.206619, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xe0 [2011/03/03 16:52:47.206639, 3] smbd/process.c:1485(process_smb) Transaction 96060 of length 228 (0 toread) [2011/03/03 16:52:47.206671, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.206686, 5] lib/util.c:627(show_msg) size=224 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=50754 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=19868 (0x4D9C) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 160 (0xA0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 160 (0xA0) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=161 [2011/03/03 16:52:47.206801, 10] ../lib/util/util.c:278(_dump_data) [0000] EE 05 00 0B 03 10 00 00 00 A0 00 00 00 02 00 00 ........ ........ [0010] 00 B8 10 B8 10 00 00 00 00 03 00 00 00 00 00 01 ........ ........ [0020] 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xW4.4.. ....#Eg. [0030] AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [0040] 00 2B 10 48 60 02 00 00 00 01 00 01 00 78 57 34 .+.H`... .....xW4 [0050] 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 .4...... #Eg..... [0060] 00 33 05 71 71 BA BE 37 49 83 19 B5 DB EF 9C CC .3.qq..7 I....... [0070] 36 01 00 00 00 02 00 01 00 78 57 34 12 34 12 CD 6....... .xW4.4.. [0080] AB EF 00 01 23 45 67 89 AB 00 00 00 00 2C 1C B7 ....#Eg. .....,.. [0090] 6C 12 98 40 45 03 00 00 00 00 00 00 00 01 00 00 l..@E... ........ [00A0] 00 . [2011/03/03 16:52:47.206916, 3] smbd/process.c:1294(switch_message) switch message SMBwriteX (pid 20360) conn 0x2d870a0 [2011/03/03 16:52:47.206964, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.206979, 6] smbd/pipes.c:291(reply_pipe_write_and_X) reply_pipe_write_and_X: 4d9c name: lsarpc len: 160 [2011/03/03 16:52:47.206993, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 160 [2011/03/03 16:52:47.207010, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 160 [2011/03/03 16:52:47.207023, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 160 [2011/03/03 16:52:47.207035, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 160, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.207054, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.207067, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 144 [2011/03/03 16:52:47.207078, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 144 [2011/03/03 16:52:47.207091, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 00a0 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:47.207156, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.207170, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 11, flags = 3 [2011/03/03 16:52:47.207182, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.207194, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 144 [2011/03/03 16:52:47.207205, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 144, incoming data = 144 [2011/03/03 16:52:47.207217, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 11 [2011/03/03 16:52:47.207232, 5] rpc_server/srv_pipe.c:1641(api_pipe_bind_req) api_pipe_bind_req: decode request. 1641 [2011/03/03 16:52:47.207245, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_rb [2011/03/03 16:52:47.207265, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 00000000 0008 num_contexts: 03 000c context_id : 0000 000e num_transfer_syntaxes: 01 [2011/03/03 16:52:47.207296, 6] rpc_parse/parse_prs.c:89(prs_debug) 00000f smb_io_rpc_iface [2011/03/03 16:52:47.207326, 7] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_uuid uuid 0010 data : 12345778 0014 data : 1234 0016 data : abcd 0018 data : ef 00 001a data : 01 23 45 67 89 ab 0020 version: 00000000 [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_rpc_iface [2011/03/03 16:52:47.207346, 7] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_uuid uuid 0024 data : 8a885d04 0028 data : 1ceb 002a data : 11c9 002c data : 9f e8 002e data : 08 00 2b 10 48 60 0034 version: 00000002 0038 context_id : 0001 003a num_transfer_syntaxes: 01 [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 00003b smb_io_rpc_iface [2011/03/03 16:52:47.207346, 7] rpc_parse/parse_prs.c:89(prs_debug) 00003c smb_io_uuid uuid 003c data : 12345778 0040 data : 1234 0042 data : abcd 0044 data : ef 00 0046 data : 01 23 45 67 89 ab 004c version: 00000000 [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 000050 smb_io_rpc_iface [2011/03/03 16:52:47.207346, 7] rpc_parse/parse_prs.c:89(prs_debug) 000050 smb_io_uuid uuid 0050 data : 71710533 0054 data : beba 0056 data : 4937 0058 data : 83 19 005a data : b5 db ef 9c cc 36 0060 version: 00000001 0064 context_id : 0002 0066 num_transfer_syntaxes: 01 [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 000067 smb_io_rpc_iface [2011/03/03 16:52:47.207346, 7] rpc_parse/parse_prs.c:89(prs_debug) 000068 smb_io_uuid uuid 0068 data : 12345778 006c data : 1234 006e data : abcd 0070 data : ef 00 0072 data : 01 23 45 67 89 ab 0078 version: 00000000 [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 00007c smb_io_rpc_iface [2011/03/03 16:52:47.207346, 7] rpc_parse/parse_prs.c:89(prs_debug) 00007c smb_io_uuid uuid 007c data : 6cb71c2c 0080 data : 9812 0082 data : 4540 0084 data : 03 00 0086 data : 00 00 00 00 00 00 008c version: 00000001 [2011/03/03 16:52:47.207346, 3] rpc_server/srv_pipe.c:1667(api_pipe_bind_req) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc [2011/03/03 16:52:47.207346, 5] rpc_server/srv_pipe.c:1717(api_pipe_bind_req) api_pipe_bind_req: make response. 1717 [2011/03/03 16:52:47.207346, 3] rpc_server/srv_pipe.c:998(check_bind_req) check_bind_req for \lsarpc checking lsarpc [2011/03/03 16:52:47.207346, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_ba [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 000053f0 [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 000008 smb_io_rpc_addr_str 0008 len: 000d 000a str: \PIPE\lsarpc. [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 000017 smb_io_rpc_results 0018 num_results: 01 001c result : 0000 001e reason : 0000 [2011/03/03 16:52:47.207346, 6] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_rpc_iface [2011/03/03 16:52:47.207346, 7] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_uuid uuid 0020 data : 8a885d04 0024 data : 1ceb 0026 data : 11c9 0028 data : 9f e8 002a data : 08 00 2b 10 48 60 0030 version: 00000002 [2011/03/03 16:52:47.207346, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:47.207346, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 144 [2011/03/03 16:52:47.207346, 3] smbd/pipes.c:352(pipe_write_andx_done) writeX-IPC nwritten=160 [2011/03/03 16:52:47.208008, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 59 [2011/03/03 16:52:47.208037, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x3b [2011/03/03 16:52:47.208057, 3] smbd/process.c:1485(process_smb) Transaction 96061 of length 63 (0 toread) [2011/03/03 16:52:47.208076, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.208090, 5] lib/util.c:627(show_msg) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=50818 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=19868 (0x4D9C) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2011/03/03 16:52:47.208209, 3] smbd/process.c:1294(switch_message) switch message SMBreadX (pid 20360) conn 0x2d870a0 [2011/03/03 16:52:47.208222, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.208235, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.208248, 10] rpc_server/srv_pipe_hnd.c:854(read_from_internal_pipe) read_from_pipe: \lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2011/03/03 16:52:47.208273, 3] smbd/pipes.c:462(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=68 [2011/03/03 16:52:47.209418, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 168 [2011/03/03 16:52:47.209485, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xa8 [2011/03/03 16:52:47.209506, 3] smbd/process.c:1485(process_smb) Transaction 96062 of length 172 (0 toread) [2011/03/03 16:52:47.209525, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.209539, 5] lib/util.c:627(show_msg) size=168 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=596 smb_uid=101 smb_mid=50882 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 84 (0x54) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 84 (0x54) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=19868 (0x4D9C) smb_bcc=101 [2011/03/03 16:52:47.209665, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 54 00 00 00 02 00 00 ........ .T...... [0020] 00 3C 00 00 00 00 00 2C 00 00 00 02 00 04 00 00 .<....., ........ [0030] 00 00 00 00 00 04 00 00 00 50 00 44 00 43 00 00 ........ .P.D.C.. [0040] 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .0...... ........ [0050] 00 00 00 00 00 04 00 02 00 0C 00 00 00 02 00 01 ........ ........ [0060] 00 01 08 00 00 ..... [2011/03/03 16:52:47.209736, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 20360) conn 0x2d870a0 [2011/03/03 16:52:47.209756, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.209771, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=84 params=0 setup=2 [2011/03/03 16:52:47.209797, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.209812, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.209824, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.209835, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4d9c) [2011/03/03 16:52:47.209856, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dd8600 max_trans_reply: 1024 [2011/03/03 16:52:47.209869, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 84 [2011/03/03 16:52:47.209882, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 84 [2011/03/03 16:52:47.209893, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 84 [2011/03/03 16:52:47.209905, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 84, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.209917, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.209929, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 68 [2011/03/03 16:52:47.209940, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 68 [2011/03/03 16:52:47.209958, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0054 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:47.210003, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.210015, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.210027, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.210038, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 68 [2011/03/03 16:52:47.210056, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 68, incoming data = 68 [2011/03/03 16:52:47.210069, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.210081, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 0000003c 0004 context_id: 0000 0006 opnum : 002c [2011/03/03 16:52:47.210104, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 179 [2011/03/03 16:52:47.210122, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.210135, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x2c - api_rpcTNP: rpc command: LSA_OPENPOLICY2 [2011/03/03 16:52:47.210158, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[44].fn == 0x621b60 [2011/03/03 16:52:47.210179, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 in: struct lsa_OpenPolicy2 system_name : * system_name : 'PDC' attr : * attr: struct lsa_ObjectAttribute len : 0x00000030 (48) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : 0x0002 (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x00000801 (2049) 1: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 1: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2011/03/03 16:52:47.210358, 4] rpc_server/srv_samr_nt.c:230(access_check_object) _lsa_OpenPolicy2: access GRANTED (requested: 0x00000801, granted: 0x00000801) [2011/03/03 16:52:47.210383, 4] rpc_server/srv_lsa_hnd.c:191(create_policy_hnd_internal) Opened policy hnd[2] [0000] 00 00 00 00 88 33 00 00 00 00 00 00 6F 4D 4F B9 .....3.. ....oMO. [0010] 88 4F 00 00 .O.. [2011/03/03 16:52:47.210411, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_OpenPolicy2: struct lsa_OpenPolicy2 out: struct lsa_OpenPolicy2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00003388-0000-0000-6f4d-4fb9884f0000 result : NT_STATUS_OK [2011/03/03 16:52:47.210472, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:47.210487, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 1084 [2011/03/03 16:52:47.210500, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 68 [2011/03/03 16:52:47.210517, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.210530, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:47.210554, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000002 [2011/03/03 16:52:47.210601, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:47.210633, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:47.210653, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.210663, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=2 smb_pid=596 smb_uid=101 smb_mid=50882 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:47.210730, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 88 33 00 ........ ......3. [0020] 00 00 00 00 00 6F 4D 4F B9 88 4F 00 00 00 00 00 .....oMO ..O..... [0030] 00 . [2011/03/03 16:52:47.211206, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 208 [2011/03/03 16:52:47.211294, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xd0 [2011/03/03 16:52:47.211319, 3] smbd/process.c:1485(process_smb) Transaction 96063 of length 212 (0 toread) [2011/03/03 16:52:47.211337, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.211349, 5] lib/util.c:627(show_msg) size=208 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=596 smb_uid=101 smb_mid=50946 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 124 (0x7C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 124 (0x7C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=19868 (0x4D9C) smb_bcc=141 [2011/03/03 16:52:47.211358, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 7C 00 00 00 03 00 00 ........ .|...... [0020] 00 64 00 00 00 00 00 3A 00 00 00 00 00 88 33 00 .d.....: ......3. [0030] 00 00 00 00 00 6F 4D 4F B9 88 4F 00 00 01 00 00 .....oMO ..O..... [0040] 00 01 00 00 00 1A 00 1C 00 00 00 02 00 0E 00 00 ........ ........ [0050] 00 00 00 00 00 0D 00 00 00 62 00 72 00 67 00 40 ........ .b.r.g.@ [0060] 00 53 00 41 00 41 00 43 00 4B 00 45 00 2E 00 44 .D.O.M.A .I.N...Q [0070] 00 45 00 00 00 00 00 00 00 00 00 00 00 02 00 00 .A...... ........ [0080] 00 00 00 00 00 00 00 00 00 02 00 00 00 ........ ..... [2011/03/03 16:52:47.211546, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 20360) conn 0x2d870a0 [2011/03/03 16:52:47.211565, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.211590, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=124 params=0 setup=2 [2011/03/03 16:52:47.211616, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.211616, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.211617, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.211663, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4d9c) [2011/03/03 16:52:47.211679, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dd8600 max_trans_reply: 1024 [2011/03/03 16:52:47.211698, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 124 [2011/03/03 16:52:47.211725, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 124 [2011/03/03 16:52:47.211740, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 124 [2011/03/03 16:52:47.211755, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 124, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.211771, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.211785, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:47.211799, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 108 [2011/03/03 16:52:47.211827, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 007c 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:47.211924, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.211940, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.211955, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.211969, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 108 [2011/03/03 16:52:47.211983, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 108, incoming data = 108 [2011/03/03 16:52:47.211983, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.212022, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000064 0004 context_id: 0000 0006 opnum : 003a [2011/03/03 16:52:47.212053, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.212071, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.212090, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x3a - api_rpcTNP: rpc command: LSA_LOOKUPNAMES2 [2011/03/03 16:52:47.212113, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[58].fn == 0x61f3a0 [2011/03/03 16:52:47.212139, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 in: struct lsa_LookupNames2 handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00003388-0000-0000-6f4d-4fb9884f0000 num_names : 0x00000001 (1) names: ARRAY(1) names: struct lsa_String length : 0x001a (26) size : 0x001a (26) string : * string : 'brg@DOMAIN.QA' sids : * sids: struct lsa_TransSidArray2 count : 0x00000000 (0) sids : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2011/03/03 16:52:47.212264, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 88 33 00 00 00 00 00 00 6F 4D 4F B9 .....3.. ....oMO. [0010] 88 4F 00 00 .O.. [2011/03/03 16:52:47.212296, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(2067, 1005) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.212321, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.212337, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.212352, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.212366, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.212368, 5] rpc_server/srv_lsa_nt.c:188(lookup_lsa_rids) lookup_lsa_rids: looking up name brg@DOMAIN.QA [2011/03/03 16:52:47.212423, 10] passdb/lookup_sid.c:69(lookup_name) lookup_name: brg@DOMAIN.QA => (domain), brg@DOMAIN.QA (name) [2011/03/03 16:52:47.212439, 10] passdb/lookup_sid.c:70(lookup_name) lookup_name: flags = 0x043 [2011/03/03 16:52:47.212481, 10] passdb/pdb_ldap.c:6185(ldapsam_get_trusteddom_pw) ldapsam_get_trusteddom_pw called for domain brg@DOMAIN.QA [2011/03/03 16:52:47.212502, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [sambaDomainName=brg@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa], filter => [(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=brg@DOMAIN.QA))], scope => [2] [2011/03/03 16:52:47.213135, 10] lib/smbldap.c:1424(smbldap_search_ext) Failed search for base: sambaDomainName=brg@DOMAIN.QA,sambaDomainName=DOMAIN.QA,cn=samba,dc=domain,dc=qa, error: 32 (No such object) (unknown) [2011/03/03 16:52:47.213171, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.213291, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.215144, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.215160, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.215172, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.215365, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(&(uid=brg@DOMAIN.QA)(objectClass=person))(objectclass=sambaSamAccount))], scope => [2] [2011/03/03 16:52:47.215842, 4] passdb/pdb_ldap.c:1598(ldapsam_getsampwnam) ldapsam_getsampwnam: Unable to locate user [brg@DOMAIN.QA] count=0 [2011/03/03 16:52:47.215871, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.215888, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.215902, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(101) : conn_ctx_stack_ndx = 1 [2011/03/03 16:52:47.215965, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2011/03/03 16:52:47.215977, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.215988, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.216033, 5] lib/smbldap.c:1360(smbldap_search_ext) smbldap_search_ext: base => [dc=domain,dc=qa], filter => [(&(objectClass=sambaGroupMapping)(|(displayName=brg@DOMAIN.QA)(cn=brg@DOMAIN.QA)))], scope => [2] [2011/03/03 16:52:47.216926, 4] passdb/pdb_ldap.c:2559(ldapsam_getgroup) ldapsam_getgroup: Did not find group, filter was (&(objectClass=sambaGroupMapping)(|(displayName=brg@DOMAIN.QA)(cn=brg@DOMAIN.QA))) [2011/03/03 16:52:47.217015, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.217565, 5] rpc_server/srv_lsa_nt.c:207(lookup_lsa_rids) init_lsa_rids: brg@DOMAIN.QA not found [2011/03/03 16:52:47.217589, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (2067, 1005) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.217642, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_LookupNames2: struct lsa_LookupNames2 out: struct lsa_LookupNames2 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000000 (0) domains : NULL max_size : 0x00000000 (0) sids : * sids: struct lsa_TransSidArray2 count : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_TranslatedSid2 sid_type : SID_NAME_UNKNOWN (8) rid : 0x00000000 (0) sid_index : 0xffffffff (4294967295) unknown : 0x00000000 (0) count : * count : 0x00000000 (0) result : NT_STATUS_NONE_MAPPED [2011/03/03 16:52:47.217827, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:47.217855, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 68 [2011/03/03 16:52:47.217873, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 108 [2011/03/03 16:52:47.217900, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.217922, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 52. [2011/03/03 16:52:47.217949, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 004c 000a auth_len : 0000 000c call_id : 00000003 [2011/03/03 16:52:47.218078, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000034 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:47.218146, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..76] (align 0) [2011/03/03 16:52:47.218160, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.218169, 5] lib/util.c:627(show_msg) size=132 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=2 smb_pid=596 smb_uid=101 smb_mid=50946 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 76 (0x4C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=77 [2011/03/03 16:52:47.218252, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 4C 00 00 00 03 00 00 ........ .L...... [0010] 00 34 00 00 00 00 00 00 00 00 00 02 00 00 00 00 .4...... ........ [0020] 00 00 00 00 00 00 00 00 00 01 00 00 00 04 00 02 ........ ........ [0030] 00 01 00 00 00 08 00 00 00 00 00 00 00 FF FF FF ........ ........ [0040] FF 00 00 00 00 00 00 00 00 73 00 00 C0 ........ .s... [2011/03/03 16:52:47.218639, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 128 [2011/03/03 16:52:47.218662, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x80 [2011/03/03 16:52:47.218677, 3] smbd/process.c:1485(process_smb) Transaction 96064 of length 132 (0 toread) [2011/03/03 16:52:47.218691, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.218703, 5] lib/util.c:627(show_msg) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=596 smb_uid=101 smb_mid=51010 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 84 (0x54) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 84 (0x54) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=19868 (0x4D9C) smb_bcc=61 [2011/03/03 16:52:47.218790, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 00 .\.P.I.P .E.\.... [0010] 00 05 00 00 03 10 00 00 00 2C 00 00 00 04 00 00 ........ .,...... [0020] 00 14 00 00 00 00 00 00 00 00 00 00 00 88 33 00 ........ ......3. [0030] 00 00 00 00 00 6F 4D 4F B9 88 4F 00 00 .....oMO ..O.. [2011/03/03 16:52:47.218879, 3] smbd/process.c:1294(switch_message) switch message SMBtrans (pid 20360) conn 0x2d870a0 [2011/03/03 16:52:47.218893, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.218906, 3] smbd/ipc.c:545(handle_trans) trans <\PIPE\> data=44 params=0 setup=2 [2011/03/03 16:52:47.218928, 5] smbd/ipc.c:578(handle_trans) calling named_pipe [2011/03/03 16:52:47.218939, 3] smbd/ipc.c:496(named_pipe) named pipe command on <> name [2011/03/03 16:52:47.218951, 5] smbd/ipc.c:419(api_fd_reply) api_fd_reply [2011/03/03 16:52:47.218962, 3] smbd/ipc.c:460(api_fd_reply) Got API command 0x26 on pipe "lsarpc" (pnum 4d9c) [2011/03/03 16:52:47.218978, 10] smbd/ipc.c:462(api_fd_reply) api_fd_reply: p:0x2dd8600 max_trans_reply: 1024 [2011/03/03 16:52:47.218992, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 44 [2011/03/03 16:52:47.219004, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 44 [2011/03/03 16:52:47.219030, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2011/03/03 16:52:47.219045, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.219060, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.219073, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:47.219087, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2011/03/03 16:52:47.219101, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 002c 000a auth_len : 0000 000c call_id : 00000004 [2011/03/03 16:52:47.219154, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.219168, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 0, flags = 3 [2011/03/03 16:52:47.219183, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.219183, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 28 [2011/03/03 16:52:47.219184, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2011/03/03 16:52:47.219238, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 0 [2011/03/03 16:52:47.219252, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_req req 0000 alloc_hint: 00000014 0004 context_id: 0000 0006 opnum : 0000 [2011/03/03 16:52:47.219277, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.219292, 5] rpc_server/srv_pipe.c:2366(api_pipe_request) Requested \PIPE\\lsarpc [2011/03/03 16:52:47.219307, 4] rpc_server/srv_pipe.c:2403(api_rpcTNP) api_rpcTNP: \lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2011/03/03 16:52:47.219309, 6] rpc_server/srv_pipe.c:2433(api_rpcTNP) api_rpc_cmds[0].fn == 0x629770 [2011/03/03 16:52:47.219311, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00003388-0000-0000-6f4d-4fb9884f0000 [2011/03/03 16:52:47.219313, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 88 33 00 00 00 00 00 00 6F 4D 4F B9 .....3.. ....oMO. [0010] 88 4F 00 00 .O.. [2011/03/03 16:52:47.219315, 4] rpc_server/srv_lsa_hnd.c:219(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 88 33 00 00 00 00 00 00 6F 4D 4F B9 .....3.. ....oMO. [0010] 88 4F 00 00 .O.. [2011/03/03 16:52:47.219316, 3] rpc_server/srv_lsa_hnd.c:258(close_policy_hnd) Closed policy [2011/03/03 16:52:47.219318, 1] ../librpc/ndr/ndr.c:251(ndr_print_function_debug) lsa_Close: struct lsa_Close out: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : NT_STATUS_OK [2011/03/03 16:52:47.219319, 5] rpc_server/srv_pipe.c:2468(api_rpcTNP) api_rpcTNP: called \lsarpc successfully [2011/03/03 16:52:47.219320, 3] rpc_server/srv_pipe_hnd.c:344(free_pipe_context) free_pipe_context: destroying talloc pool of size 0 [2011/03/03 16:52:47.219321, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 28 [2011/03/03 16:52:47.219322, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.219323, 10] rpc_server/srv_pipe_hnd.c:875(read_from_internal_pipe) read_from_pipe: \lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2011/03/03 16:52:47.219323, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000004 [2011/03/03 16:52:47.219323, 5] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_rpc_hdr_resp resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 [2011/03/03 16:52:47.219324, 5] smbd/ipc.c:59(copy_trans_params_and_data) copy_trans_params_and_data: params[0..0] data[0..48] (align 0) [2011/03/03 16:52:47.219324, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.219325, 5] lib/util.c:627(show_msg) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=2 smb_pid=596 smb_uid=101 smb_mid=51010 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2011/03/03 16:52:47.219325, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0...... [0010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 . [2011/03/03 16:52:47.219865, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 41 [2011/03/03 16:52:47.219901, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x29 [2011/03/03 16:52:47.219923, 3] smbd/process.c:1485(process_smb) Transaction 96065 of length 45 (0 toread) [2011/03/03 16:52:47.220096, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.220105, 5] lib/util.c:627(show_msg) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=51074 smt_wct=3 smb_vwv[ 0]=19868 (0x4D9C) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2011/03/03 16:52:47.220294, 3] smbd/process.c:1294(switch_message) switch message SMBclose (pid 20360) conn 0x2d870a0 [2011/03/03 16:52:47.220309, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.220325, 3] smbd/reply.c:4634(reply_close) close fd=-1 fnum=19868 (numopen=2) [2011/03/03 16:52:47.220344, 6] smbd/close.c:501(set_close_write_time) close_write_time: Sun Feb 7 07:28:15 2106 [2011/03/03 16:52:47.220551, 5] smbd/files.c:497(file_free) freed files structure 19868 (1 used) [2011/03/03 16:52:47.220569, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.220578, 5] lib/util.c:627(show_msg) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51203 smb_tid=2 smb_pid=65279 smb_uid=101 smb_mid=51074 smt_wct=0 smb_bcc=0 [2011/03/03 16:52:47.221956, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 100 [2011/03/03 16:52:47.222098, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x64 [2011/03/03 16:52:47.222131, 3] smbd/process.c:1485(process_smb) Transaction 39 of length 104 (0 toread) [2011/03/03 16:52:47.222150, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.222163, 5] lib/util.c:627(show_msg) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=1172 smb_uid=100 smb_mid=2496 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 5632 (0x1600) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]=16384 (0x4000) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 768 (0x300) smb_bcc=17 [2011/03/03 16:52:47.222298, 10] ../lib/util/util.c:278(_dump_data) [0000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [0010] 00 . [2011/03/03 16:52:47.222474, 3] smbd/process.c:1294(switch_message) switch message SMBntcreateX (pid 19492) conn 0x2db92b0 [2011/03/03 16:52:47.222507, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.222600, 10] smbd/nttrans.c:498(reply_ntcreate_and_X) reply_ntcreate_and_X: flags = 0x16, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x40 root_dir_fid = 0x0, fname = lsarpc [2011/03/03 16:52:47.222640, 4] smbd/nttrans.c:283(nt_open_pipe) nt_open_pipe: Opening pipe \lsarpc. [2011/03/03 16:52:47.222666, 5] smbd/files.c:119(file_new) allocated file structure 13670, fnum = 17766 (1 used) [2011/03/03 16:52:47.222726, 4] rpc_server/srv_pipe_hnd.c:99(make_internal_rpc_pipe_p) Create pipe requested \lsarpc [2011/03/03 16:52:47.222774, 10] rpc_server/srv_lsa_hnd.c:114(init_pipe_handle_list) init_pipe_handles: created handle list for pipe \lsarpc [2011/03/03 16:52:47.222782, 10] rpc_server/srv_lsa_hnd.c:131(init_pipe_handle_list) init_pipe_handles: pipe_handles ref count = 1 for pipe \lsarpc [2011/03/03 16:52:47.222855, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.222880, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.222895, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.222912, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.223028, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.223262, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.223390, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.223433, 10] passdb/pdb_get_set.c:608(pdb_set_username) pdb_set_username: setting username nobody, was [2011/03/03 16:52:47.223452, 10] passdb/pdb_get_set.c:631(pdb_set_domain) pdb_set_domain: setting domain DOMAIN.QA, was [2011/03/03 16:52:47.223465, 10] passdb/pdb_get_set.c:654(pdb_set_nt_username) pdb_set_nt_username: setting nt username , was [2011/03/03 16:52:47.223477, 10] passdb/pdb_get_set.c:677(pdb_set_fullname) pdb_set_full_name: setting full name nobody, was [2011/03/03 16:52:47.223548, 10] passdb/pdb_get_set.c:770(pdb_set_homedir) pdb_set_homedir: setting home dir \\homes\nobody, was [2011/03/03 16:52:47.223563, 10] passdb/pdb_get_set.c:746(pdb_set_dir_drive) pdb_set_dir_drive: setting dir drive H:, was NULL [2011/03/03 16:52:47.223596, 10] passdb/pdb_get_set.c:700(pdb_set_logon_script) pdb_set_logon_script: setting logon script scripts\logon.cmd, was [2011/03/03 16:52:47.223611, 10] passdb/pdb_get_set.c:723(pdb_set_profile_path) pdb_set_profile_path: setting profile path , was [2011/03/03 16:52:47.223628, 10] passdb/pdb_get_set.c:813(pdb_set_workstations) pdb_set_workstations: setting workstations , was [2011/03/03 16:52:47.223641, 3] smbd/sec_ctx.c:210(push_sec_ctx) push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.223655, 3] smbd/uid.c:429(push_conn_ctx) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2011/03/03 16:52:47.223668, 3] smbd/sec_ctx.c:310(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2011/03/03 16:52:47.223680, 5] auth/token_util.c:525(debug_nt_user_token) NT user token: (NULL) [2011/03/03 16:52:47.223739, 5] auth/token_util.c:551(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2011/03/03 16:52:47.223765, 10] lib/gencache.c:345(gencache_get_data_blob) Returning valid cache entry: key = ACCT_POL/password history, value = 0 , timeout = Thu Mar 3 16:53:14 2011 [2011/03/03 16:52:47.223812, 3] smbd/sec_ctx.c:418(pop_sec_ctx) pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0 [2011/03/03 16:52:47.223828, 10] passdb/pdb_get_set.c:537(pdb_set_user_sid) pdb_set_user_sid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 [2011/03/03 16:52:47.223848, 10] passdb/pdb_compat.c:72(pdb_set_user_sid_from_rid) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-3337506086-3871218678-1542260769-501 from rid 501 [2011/03/03 16:52:47.223880, 10] passdb/pdb_get_set.c:595(pdb_set_group_sid) pdb_set_group_sid: setting group sid S-1-5-21-3337506086-3871218678-1542260769-513 [2011/03/03 16:52:47.223901, 4] rpc_server/srv_pipe_hnd.c:162(make_internal_rpc_pipe_p) Created internal pipe \lsarpc (pipes_open=0) [2011/03/03 16:52:47.223935, 5] smbd/nttrans.c:372(do_ntcreate_pipe_open) do_ntcreate_pipe_open: open pipe = \lsarpc [2011/03/03 16:52:47.224798, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 136 [2011/03/03 16:52:47.224823, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x88 [2011/03/03 16:52:47.224836, 3] smbd/process.c:1485(process_smb) Transaction 40 of length 140 (0 toread) [2011/03/03 16:52:47.224848, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.224857, 5] lib/util.c:627(show_msg) size=136 smb_com=0x2f smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2560 smt_wct=14 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17766 (0x4566) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]=65535 (0xFFFF) smb_vwv[ 6]=65535 (0xFFFF) smb_vwv[ 7]= 8 (0x8) smb_vwv[ 8]= 72 (0x48) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 72 (0x48) smb_vwv[11]= 64 (0x40) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_bcc=73 [2011/03/03 16:52:47.225469, 10] ../lib/util/util.c:278(_dump_data) [0000] EE 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 ........ .H...... [0010] 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 ........ ........ [0020] 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 .xW4.4.. ....#Eg. [0030] AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 ......]. ........ [0040] 00 2B 10 48 60 02 00 00 00 .+.H`... . [2011/03/03 16:52:47.225545, 3] smbd/process.c:1294(switch_message) switch message SMBwriteX (pid 19492) conn 0x2db92b0 [2011/03/03 16:52:47.225559, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.225576, 6] smbd/pipes.c:291(reply_pipe_write_and_X) reply_pipe_write_and_X: 4566 name: lsarpc len: 72 [2011/03/03 16:52:47.225576, 6] rpc_server/srv_pipe_hnd.c:1208(np_write_send) np_write_send: len: 72 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 72 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:193(fill_rpc_header) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 16 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2011/03/03 16:52:47.225576, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0048 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.225576, 5] rpc_server/srv_pipe_hnd.c:289(unmarshall_rpc_header) unmarshall_rpc_header: using little-endian RPC [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:318(unmarshall_rpc_header) unmarshall_rpc_header: type = 11, flags = 3 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 0 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:772(write_to_internal_pipe) write_to_pipe: data_left = 56 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:682(process_incoming_data) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2011/03/03 16:52:47.225576, 10] rpc_server/srv_pipe_hnd.c:537(process_complete_pdu) process_complete_pdu: processing packet type 11 [2011/03/03 16:52:47.225576, 5] rpc_server/srv_pipe.c:1641(api_pipe_bind_req) api_pipe_bind_req: decode request. 1641 [2011/03/03 16:52:47.225576, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_rb [2011/03/03 16:52:47.225576, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 00000000 0008 num_contexts: 01 000c context_id : 0000 000e num_transfer_syntaxes: 01 [2011/03/03 16:52:47.225576, 6] rpc_parse/parse_prs.c:89(prs_debug) 00000f smb_io_rpc_iface [2011/03/03 16:52:47.225576, 7] rpc_parse/parse_prs.c:89(prs_debug) 000010 smb_io_uuid uuid 0010 data : 12345778 0014 data : 1234 0016 data : abcd 0018 data : ef 00 001a data : 01 23 45 67 89 ab 0020 version: 00000000 [2011/03/03 16:52:47.225576, 6] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_rpc_iface [2011/03/03 16:52:47.225576, 7] rpc_parse/parse_prs.c:89(prs_debug) 000024 smb_io_uuid uuid 0024 data : 8a885d04 0028 data : 1ceb 002a data : 11c9 002c data : 9f e8 002e data : 08 00 2b 10 48 60 0034 version: 00000002 [2011/03/03 16:52:47.225576, 3] rpc_server/srv_pipe.c:1667(api_pipe_bind_req) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc [2011/03/03 16:52:47.225576, 5] rpc_server/srv_pipe.c:1717(api_pipe_bind_req) api_pipe_bind_req: make response. 1717 [2011/03/03 16:52:47.225576, 3] rpc_server/srv_pipe.c:998(check_bind_req) check_bind_req for \lsarpc checking lsarpc [2011/03/03 16:52:47.225576, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_ba [2011/03/03 16:52:47.225576, 6] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr_bba 0000 max_tsize: 10b8 0002 max_rsize: 10b8 0004 assoc_gid: 000053f0 [2011/03/03 16:52:47.225576, 6] rpc_parse/parse_prs.c:89(prs_debug) 000008 smb_io_rpc_addr_str 0008 len: 000d 000a str: \PIPE\lsarpc. [2011/03/03 16:52:47.225576, 6] rpc_parse/parse_prs.c:89(prs_debug) 000017 smb_io_rpc_results 0018 num_results: 01 001c result : 0000 001e reason : 0000 [2011/03/03 16:52:47.225576, 6] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_rpc_iface [2011/03/03 16:52:47.225576, 7] rpc_parse/parse_prs.c:89(prs_debug) 000020 smb_io_uuid uuid 0020 data : 8a885d04 0024 data : 1ceb 0026 data : 11c9 0028 data : 9f e8 002a data : 08 00 2b 10 48 60 0030 version: 00000002 [2011/03/03 16:52:47.225576, 5] rpc_parse/parse_prs.c:89(prs_debug) 000000 smb_io_rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000001 [2011/03/03 16:52:47.226459, 10] rpc_server/srv_pipe_hnd.c:776(write_to_internal_pipe) write_to_pipe: data_used = 56 [2011/03/03 16:52:47.226491, 3] smbd/pipes.c:352(pipe_write_andx_done) writeX-IPC nwritten=72 [2011/03/03 16:52:47.227456, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 59 [2011/03/03 16:52:47.227653, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0x3b [2011/03/03 16:52:47.227674, 3] smbd/process.c:1485(process_smb) Transaction 41 of length 63 (0 toread) [2011/03/03 16:52:47.227692, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.227704, 5] lib/util.c:627(show_msg) size=59 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=65279 smb_uid=100 smb_mid=2624 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]=57054 (0xDEDE) smb_vwv[ 2]=17766 (0x4566) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 1024 (0x400) smb_vwv[ 6]= 1024 (0x400) smb_vwv[ 7]=65535 (0xFFFF) smb_vwv[ 8]=65535 (0xFFFF) smb_vwv[ 9]= 1024 (0x400) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_bcc=0 [2011/03/03 16:52:47.227787, 3] smbd/process.c:1294(switch_message) switch message SMBreadX (pid 19492) conn 0x2db92b0 [2011/03/03 16:52:47.227807, 4] smbd/uid.c:257(change_to_user) change_to_user: Skipping user change - already user [2011/03/03 16:52:47.227876, 6] rpc_server/srv_pipe_hnd.c:813(read_from_internal_pipe) name: \lsarpc len: 1024 [2011/03/03 16:52:47.227907, 10] rpc_server/srv_pipe_hnd.c:854(read_from_internal_pipe) read_from_pipe: \lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2011/03/03 16:52:47.227940, 3] smbd/pipes.c:462(pipe_read_andx_done) readX-IPC min=1024 max=1024 nread=68 [2011/03/03 16:52:47.228866, 10] lib/util_sock.c:726(read_smb_length_return_keepalive) got smb length of 172 [2011/03/03 16:52:47.228903, 6] smbd/process.c:1482(process_smb) got message type 0x0 of len 0xac [2011/03/03 16:52:47.228917, 3] smbd/process.c:1485(process_smb) Transaction 42 of length 176 (0 toread) [2011/03/03 16:52:47.228929, 5] lib/util.c:617(show_msg) [2011/03/03 16:52:47.228938, 5] lib/util.c:627(show_msg) size=172 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=24 smb_flg2=51207 smb_tid=1 smb_pid=1172 smb_uid=100 smb_mid=2688 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1024 (0x400) [2011/03/03 16:52:47.228806, 10] lib/util_sock.c:726(read_smb_length_return_keepalive)