refresh_sequence_number: TESTD time ok refresh_sequence_number: TESTD seq number is now 1746611569 resolve_username_to_alias: backend query returned NT_STATUS_NOT_IMPLEMENTED wb_request_done[9688:GETGRGID]: NT_STATUS_OK winbind_client_response_written[9688:GETGRGID]: delivered response to client process_request: Handling async request 9688:GETGRGID getgrgid 100001 idmap_cache_find_gid2sid found 100001 find_lookup_domain_from_sid(S-1-5-21-2048354812-1799923345-800859446-444655) calling find_our_domain wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-2048354812-1799923345-800859446-444655 Entry has wrong sequence number: 1746565329 Need to read 28 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSID (TESTD) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-2048354812-1799923345-800859446-444655 refresh_sequence_number: TESTD time ok refresh_sequence_number: TESTD seq number is now 1746611569 centry_expired: Key SN/S-1-5-21-2048354812-1799923345-800859446-444655 for domain TESTD expired wcache_fetch: entry SN/S-1-5-21-2048354812-1799923345-800859446-444655 expired for domain TESTD sid_to_name: [Cached] - doing backend query for name for domain TESTD msrpc_sid_to_name: S-1-5-21-2048354812-1799923345-800859446-444655 for domain TESTD cm_connect_lsa_tcp rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-2048354812-1799923345-800859446-444655 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0020 (32) call_id : 0x00000018 (24) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 add_schannel_auth_footer: SCHANNEL seq_num=11 &r: struct NL_AUTH_SIGNATURE SignatureAlgorithm : NL_SIGN_HMAC_MD5 (0x77) SealAlgorithm : NL_SEAL_RC4 (0x7A) Pad : 0xffff (65535) Flags : 0x0000 (0) SequenceNumber : 197b7dade1246be2 Checksum : c8d21305961d7a32 Confounder : 5da167b9aa75e6c8 rpc_api_pipe: host rbgs790a.testd.example.com rpc_write_send: data_to_write: 136 rpc_read_send: data_to_read: 208 r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00e0 (224) auth_length : 0x0020 (32) call_id : 0x00000018 (24) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a0 (160) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=200 [0000] DA 98 71 7B 5B 6E 51 AC 44 E0 C2 95 A4 A2 74 74 Ú.q{[nQ¬ DàÂ.¤¢tt [0010] 5D A7 98 0D 3B A6 B4 D8 1E 9A E6 5A 69 F0 39 FD ]§..;¦´Ø ..æZið9ý [0020] 41 63 35 44 D9 A5 A2 E0 52 B9 34 51 D0 34 F2 0A Ac5DÙ¥¢à R¹4QÐ4ò. [0030] 06 F8 6B D3 4E 34 8B 4D D4 F9 A1 D4 FB 62 90 8C .økÓN4.M Ôù¡Ôûb.. [0040] 7F 8F 4D 7E 7F 19 2D D6 02 7B 1D 46 76 25 F6 B0 ..M~..-Ö .{.Fv%ö° [0050] D2 05 BC C6 0E EC EC 1B 6C 37 F8 07 14 83 BE B0 Ò.¼Æ.ìì. l7ø...¾° [0060] C9 A2 A7 F3 2C 0D F4 56 83 82 44 BD A7 73 CF 33 É¢§ó,.ôV ..D½§sÏ3 [0070] C2 26 28 E5 2A 38 A2 23 75 46 FB 6A 29 F2 85 3B Â&(å*8¢# uFûj)ò.; [0080] A6 57 0D F5 82 2D 71 86 39 21 31 D1 E2 57 D3 47 ¦W.õ.-q. 9!1ÑâWÓG [0090] A3 C7 90 1D C0 1A 0B 5F 89 9E F2 92 D5 36 24 23 £Ç..À.._ ..ò.Õ6$# [00A0] 44 06 00 00 01 00 00 00 77 00 7A 00 FF FF 00 00 D....... w.z.ÿÿ.. [00B0] 36 A5 05 B9 96 62 67 18 93 82 28 C5 34 F1 CB 2D 6¥.¹.bg. ..(Å4ñË- [00C0] 60 92 1E A8 02 1E 78 14 `..¨..x. Requested Privacy. ../librpc/rpc/dcerpc_util.c:140: auth_pad_length 0 SCHANNEL auth Got pdu len 224, data_len 160, ss_len 0 rpc_api_pipe: got frag len of 224 at offset 0: NT_STATUS_OK rpc_api_pipe: host rbgs790a.testd.example.com returned 160 bytes. lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0008 (8) size : 0x000a (10) string : * string : 'TESTD2' sid : * sid : S-1-5-21-2048354812-1799923345-800859446 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_DOM_GRP (2) name: struct lsa_String length : 0x001c (28) size : 0x001c (28) string : * string : 'MT-All_Users' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' Mapped sid to [TESTD2]\[MT-All_Users] refresh_sequence_number: TESTD time ok refresh_sequence_number: TESTD seq number is now 1746611569 resolve_username_to_alias: backend query returned NT_STATUS_NOT_IMPLEMENTED returning mapped name -- MT-All_Users refresh_sequence_number: TESTD time ok refresh_sequence_number: TESTD seq number is now 1746611569 wcache_save_sid_to_name: S-1-5-21-2048354812-1799923345-800859446-444655 -> TESTD2\MT-All_Users (NT_STATUS_OK) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_DOM_GRP (2) domain : * domain : * domain : 'TESTD2' name : * name : * name : 'MT-All_Users' result : NT_STATUS_OK Finished processing child request 59 Writing 3560 bytes to parent timed_events_timeout: 3580/458366 wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_DOM_GRP (2) domain : * domain : * domain : 'TESTD2' name : * name : * name : 'MT-All_Users' result : NT_STATUS_OK SID 0: S-1-5-21-2048354812-1799923345-800859446-444655 Parsing value for key [IDMAP/SID2XID/S-1-5-21-2048354812-1799923345-800859446-444655]: value=[100001:G] Parsing value for key [IDMAP/SID2XID/S-1-5-21-2048354812-1799923345-800859446-444655]: id=[100001], endptr=[:G] wbint_LookupGroupMembers: struct wbint_LookupGroupMembers in: struct wbint_LookupGroupMembers sid : * sid : S-1-5-21-2048354812-1799923345-800859446-444655 type : SID_NAME_DOM_GRP (2) wbint_LookupGroupMembers: struct wbint_LookupGroupMembers out: struct wbint_LookupGroupMembers members : * members: struct wbint_Principals num_principals : 0 principals: ARRAY(0) result : NT_STATUS_UNSUCCESSFUL Could not convert sid S-1-5-21-2048354812-1799923345-800859446-444655: NT_STATUS_UNSUCCESSFUL wb_request_done[9688:GETGRGID]: NT_STATUS_UNSUCCESSFUL winbind_client_response_written[9688:GETGRGID]: delivered response to client process_request: Handling async request 9688:GETGRGID getgrgid 100002 idmap_cache_find_gid2sid found 100002 find_lookup_domain_from_sid(S-1-5-21-1710691794-657421245-3729435916-684089) calling find_our_domain wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-1710691794-657421245-3729435916-684089 Entry has wrong sequence number: 1746565329 Need to read 28 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_LOOKUPSID (TESTD) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-1710691794-657421245-3729435916-684089 refresh_sequence_number: TESTD time ok refresh_sequence_number: TESTD seq number is now 1746611569 centry_expired: Key SN/S-1-5-21-1710691794-657421245-3729435916-684089 for domain TESTD expired wcache_fetch: entry SN/S-1-5-21-1710691794-657421245-3729435916-684089 expired for domain TESTD sid_to_name: [Cached] - doing backend query for name for domain TESTD msrpc_sid_to_name: S-1-5-21-1710691794-657421245-3729435916-684089 for domain TESTD cm_connect_lsa_tcp rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-1710691794-657421245-3729435916-684089 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_ALL (1) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0020 (32) call_id : 0x00000019 (25) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=0 &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 add_schannel_auth_footer: SCHANNEL seq_num=13 &r: struct NL_AUTH_SIGNATURE SignatureAlgorithm : NL_SIGN_HMAC_MD5 (0x77) SealAlgorithm : NL_SEAL_RC4 (0x7A) Pad : 0xffff (65535) Flags : 0x0000 (0) SequenceNumber : 54c2fa8a5952c3d8 Checksum : 9dcab33c6b65fbfc Confounder : 965940114c75c383 rpc_api_pipe: host rbgs790a.testd.example.com rpc_write_send: data_to_write: 136 rpc_read_send: data_to_read: 208 r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00e0 (224) auth_length : 0x0020 (32) call_id : 0x00000019 (25) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a0 (160) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=1 [0000] 00 . stub_and_verifier : DATA_BLOB length=200 [0000] 50 AC 92 64 DA 4F E2 EF 17 8A 87 A1 67 06 42 C2 P¬.dÚOâï ...¡g.B [0010] 97 90 D7 47 0A BE 9B 66 B3 A8 6B FE 7B 41 CA AD ..×G.¾.f ³¨kþ{AÊ­ [0020] 96 E7 F6 29 1A AE B6 63 6D EE 71 79 D2 9A 81 21 .çö).®¶c mîqyÒ..! [0030] F6 FB E0 3A B6 4D 24 98 0F AD 7B DE 64 52 8A C3 öûà:¶M$. .­{ÞdR.à [0040] B5 D8 C3 C3 9D 23 D6 AA B1 64 8C 76 63 FD AF B4 µØÃÃ.#Öª ±d.vcý¯´ [0050] CD F5 F3 D9 27 34 C7 BE B5 C8 8F EF 51 97 5D EC ÍõóÙ'4Ǿ µÈ.ïQ.]ì [0060] 0C 3E 2B 54 BF 5E A8 F6 81 92 BB 5D 14 40 93 1E .>+T¿^¨ö ..»].@.. [0070] 57 DF CC 02 27 5B A3 01 4D 35 FF 44 81 67 35 75 WßÌ.'[£. M5ÿD.g5u [0080] EF 3C 6E 2D E3 82 CD 74 6C 5E C0 52 05 66 C1 96 ï TESTD\cda_ip-User (NT_STATUS_OK) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_DOM_GRP (2) domain : * domain : * domain : 'TESTD' name : * name : * name : 'cda_ip-User' result : NT_STATUS_OK Finished processing child request 59 Writing 3560 bytes to parent timed_events_timeout: 3580/453321 wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_DOM_GRP (2) domain : * domain : * domain : 'TESTD' name : * name : * name : 'cda_ip-User' result : NT_STATUS_OK SID 0: S-1-5-21-1710691794-657421245-3729435916-684089 Parsing value for key [IDMAP/SID2XID/S-1-5-21-1710691794-657421245-3729435916-684089]: value=[100002:G] Parsing value for key [IDMAP/SID2XID/S-1-5-21-1710691794-657421245-3729435916-684089]: id=[100002], endptr=[:G] wbint_LookupGroupMembers: struct wbint_LookupGroupMembers in: struct wbint_LookupGroupMembers sid : * sid : S-1-5-21-1710691794-657421245-3729435916-684089 type : SID_NAME_DOM_GRP (2) Entry has wrong sequence number: 1746565329 Need to read 30 extra bytes child daemon request 59 child_process_request: request fn NDRCMD winbindd_dual_ndrcmd: Running command WBINT_LOOKUPGROUPMEMBERS (TESTD) wbint_LookupGroupMembers: struct wbint_LookupGroupMembers in: struct wbint_LookupGroupMembers sid : * sid : S-1-5-21-1710691794-657421245-3729435916-684089 type : SID_NAME_DOM_GRP (2) refresh_sequence_number: TESTD time ok refresh_sequence_number: TESTD seq number is now 1746611569 centry_expired: Key GM/S-1-5-21-1710691794-657421245-3729435916-684089 for domain TESTD expired wcache_fetch: entry GM/S-1-5-21-1710691794-657421245-3729435916-684089 expired for domain TESTD lookup_groupmem: [Cached] - doing backend query for info for domain TESTD ads: lookup_groupmem TESTD sid=S-1-5-21-1710691794-657421245-3729435916-684089 ads_cached_connection Current tickets expire in 36000 seconds (at 1375402397, time is now 1375366397) Searching for attrs[0] = member, attrs[1] = usnChanged Search for (objectSid=\01\05\00\00\00\00\00\05\15\00\00\00\D2\15\F7e\BDs/'\0C\ADJ\DE9p\0A\00) in gave 1 replies Searching for attrs[0] = member;range=1500-*, attrs[1] = usnChanged Search for (objectSid=\01\05\00\00\00\00\00\05\15\00\00\00\D2\15\F7e\BDs/'\0C\ADJ\DE9p\0A\00) in gave 1 replies Searching for attrs[0] = member;range=3000-*, attrs[1] = usnChanged