[2014/08/16 20:14:34.367059, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:34.367270, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 141 (position 141) from bitmap [2014/08/16 20:14:34.367328, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CREATE] mid = 141 [2014/08/16 20:14:34.367396, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.367449, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.368451, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.368657, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:34.368721, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:456(smbd_smb2_create_send) smbd_smb2_create: name[spoolss] [2014/08/16 20:14:34.368784, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:34.368832, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:34.368882, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 15864B90 [2014/08/16 20:14:34.368957, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd8420c870 [2014/08/16 20:14:34.369050, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:695(smbXsrv_open_global_store) [2014/08/16 20:14:34.369209, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:697(smbXsrv_open_global_store) smbXsrv_open_global_store: key '15864B90' stored [2014/08/16 20:14:34.369263, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &global_blob: struct smbXsrv_open_globalB version : SMBXSRV_VERSION_0 (0) seqnum : 0x00000001 (1) info : union smbXsrv_open_globalU(case 0) info0 : * info0: struct smbXsrv_open_global0 db_rec : * server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0x15864b90 (361122704) open_persistent_id : 0x0000000015864b90 (361122704) open_volatile_id : 0x0000000080e01706 (2162169606) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:34 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 [2014/08/16 20:14:34.369779, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 15864B90 [2014/08/16 20:14:34.369831, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:34.369877, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:34.369923, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:862(smbXsrv_open_create) [2014/08/16 20:14:34.369951, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:870(smbXsrv_open_create) smbXsrv_open_create: global_id (0x15864b90) stored [2014/08/16 20:14:34.369995, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &open_blob: struct smbXsrv_openB version : SMBXSRV_VERSION_0 (0) reserved : 0x00000000 (0) info : union smbXsrv_openU(case 0) info0 : * info0: struct smbXsrv_open table : * db_rec : NULL local_id : 0x80e01706 (2162169606) global : * global: struct smbXsrv_open_global0 db_rec : NULL server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0x15864b90 (361122704) open_persistent_id : 0x0000000015864b90 (361122704) open_volatile_id : 0x0000000080e01706 (2162169606) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:34 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 status : NT_STATUS_OK idle_time : Sa Aug 16 20:14:34 2014 CEST compat : NULL [2014/08/16 20:14:34.370804, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:128(file_new) allocated file structure fnum 2162169606 (2 used) [2014/08/16 20:14:34.370860, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:716(file_name_hash) file_name_hash: /tmp/spoolss hash 0x7d4e46e5 [2014/08/16 20:14:34.370925, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \spoolss [2014/08/16 20:14:34.370981, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 17 for pipe \spoolss [2014/08/16 20:14:34.371225, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \spoolss [2014/08/16 20:14:34.371293, 8, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/dosmode.c:642(dos_mode) dos_mode: spoolss [2014/08/16 20:14:34.371356, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:1053(smbd_smb2_create_send) smbd_smb2_create_send: spoolss - fnum 2162169606 [2014/08/16 20:14:34.371418, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[88] dyn[yes:0] at ../source3/smbd/smb2_create.c:374 [2014/08/16 20:14:34.371471, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/142/31 [2014/08/16 20:14:34.372030, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:34.372108, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 142 (position 142) from bitmap [2014/08/16 20:14:34.372237, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_WRITE] mid = 142 [2014/08/16 20:14:34.372298, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.372349, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.373355, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.373550, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:34.373607, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 142, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:34.373656, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_write.c:271(smbd_smb2_write_send) smbd_smb2_write: spoolss - fnum 2162169606 [2014/08/16 20:14:34.373706, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 160 [2014/08/16 20:14:34.373752, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 160 [2014/08/16 20:14:34.373797, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 160 [2014/08/16 20:14:34.373842, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 160, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:34.373888, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:34.373932, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:34.373975, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 144 [2014/08/16 20:14:34.374031, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:34.374202, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:34.374252, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 144, incoming data = 144 [2014/08/16 20:14:34.374300, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:34.374358, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00a0 (160) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x03 (3) ctx_list: ARRAY(3) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) ctx_list: struct dcerpc_ctx_list context_id : 0x0001 (1) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 71710533-beba-4937-8319-b5dbef9ccc36 if_version : 0x00000001 (1) ctx_list: struct dcerpc_ctx_list context_id : 0x0002 (2) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 6cb71c2c-9812-4540-0300-000000000000 if_version : 0x00000001 (1) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:34.375477, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 11 [2014/08/16 20:14:34.375539, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:693(api_pipe_bind_req) api_pipe_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:34.375588, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:724(api_pipe_bind_req) api_pipe_bind_req: make response. 724 [2014/08/16 20:14:34.375632, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:342(check_bind_req) check_bind_req for \spoolss [2014/08/16 20:14:34.375680, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:349(check_bind_req) check_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:34.375726, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 18 for pipe \spoolss [2014/08/16 20:14:34.375790, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000053f0 (21488) secondary_address_size : 0x000e (14) secondary_address : '\PIPE\spoolss' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : 0x0000 (0) reason : 0x0000 (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:34.376503, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 144 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 160 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:34.376748, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:0] at ../source3/smbd/smb2_write.c:150 [2014/08/16 20:14:34.376802, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/143/31 [2014/08/16 20:14:34.377340, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:34.377436, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 143 (position 143) from bitmap [2014/08/16 20:14:34.377491, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_READ] mid = 143 [2014/08/16 20:14:34.377547, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.377598, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.378591, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.378787, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:34.378843, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 143, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:34.378891, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_read.c:439(smbd_smb2_read_send) smbd_smb2_read: spoolss - fnum 2162169606 [2014/08/16 20:14:34.378944, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:34.378993, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:326(read_from_internal_pipe) read_from_pipe: \spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2014/08/16 20:14:34.379163, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 29 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 1 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:34.379427, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 68 bytes. There is no more data outstanding [2014/08/16 20:14:34.379480, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:68] at ../source3/smbd/smb2_read.c:154 [2014/08/16 20:14:34.379531, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/144/31 [2014/08/16 20:14:34.380046, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:34.380124, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 144 (position 144) from bitmap [2014/08/16 20:14:34.380251, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_IOCTL] mid = 144 [2014/08/16 20:14:34.380309, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.380361, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.381367, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.381561, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:34.381616, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 144, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:34.381664, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:394(smbd_smb2_ioctl_send) smbd_smb2_ioctl: ctl_code[0x0011c017] spoolss, fnum 2162169606 [2014/08/16 20:14:34.381716, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:59(smb2_ioctl_named_pipe) smbd_smb2_ioctl_send: np_write_send of size 966 [2014/08/16 20:14:34.381761, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 966 [2014/08/16 20:14:34.381806, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 966 [2014/08/16 20:14:34.381850, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 966 [2014/08/16 20:14:34.381895, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 966, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:34.381940, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:34.381983, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 950 [2014/08/16 20:14:34.382026, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 950 [2014/08/16 20:14:34.382197, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:34.382248, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 950 [2014/08/16 20:14:34.382293, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 950, incoming data = 950 [2014/08/16 20:14:34.382339, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:34.382392, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x03c6 (966) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000003ae (942) context_id : 0x0000 (0) opnum : 0x0045 (69) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=942 [0000] 00 00 02 00 17 00 00 00 00 00 00 00 17 00 00 00 ........ ........ [0010] 5C 00 5C 00 4D 00 31 00 5C 00 53 00 48 00 41 00 \.\.M.1. \.S.H.A. [0020] 52 00 50 00 20 00 4D 00 58 00 2D 00 32 00 36 00 R.P. .M. X.-.2.6. [0030] 30 00 30 00 4E 00 20 00 50 00 53 00 00 00 00 00 0.0.N. . P.S..... [0040] 00 00 00 00 E4 02 00 00 04 00 02 00 E4 02 00 00 ........ ........ [0050] 5C 00 5C 00 43 00 53 00 52 00 7C 00 6D 00 31 00 \.\.C.S. R.|.m.1. [0060] 5C 00 7B 00 31 00 30 00 30 00 39 00 30 00 46 00 \.{.1.0. 0.9.0.F. [0070] 38 00 36 00 2D 00 45 00 33 00 38 00 44 00 2D 00 8.6.-.E. 3.8.D.-. [0080] 34 00 36 00 35 00 42 00 2D 00 41 00 34 00 00 00 4.6.5.B. -.A.4... [0090] 00 04 00 01 DC 00 08 02 13 DF 80 07 01 00 01 00 ........ ........ [00A0] EA 0A 6F 08 64 00 01 00 07 00 58 02 02 00 01 00 ..o.d... ..X..... [00B0] 58 02 03 00 01 00 4C 00 65 00 74 00 74 00 65 00 X.....L. e.t.t.e. [00C0] 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r....... ........ [00D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00F0] 00 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 ........ ........ [0100] 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 ........ ........ [0110] 02 00 00 00 01 01 00 00 00 01 00 00 00 00 00 00 ........ ........ [0120] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 0B ........ ........ [0130] 53 43 44 4D 08 02 81 07 24 00 00 00 F8 00 00 00 SCDM.... $....... [0140] 2C 01 00 00 EA 01 00 00 53 4E 30 48 00 00 00 00 ,....... SN0H.... [0150] 7B 00 31 00 30 00 30 00 39 00 30 00 46 00 38 00 {.1.0.0. 9.0.F.8. [0160] 36 00 2D 00 45 00 33 00 38 00 44 00 2D 00 34 00 6.-.E.3. 8.D.-.4. [0170] 36 00 35 00 42 00 2D 00 41 00 34 00 43 00 36 00 6.5.B.-. A.4.C.6. [0180] 2D 00 37 00 42 00 43 00 33 00 30 00 31 00 44 00 -.7.B.C. 3.0.1.D. [0190] 00 04 00 01 D4 00 10 01 13 DF 80 07 01 00 01 00 ........ ........ [01A0] EA 0A 6F 08 64 00 01 00 07 00 58 02 02 00 01 00 ..o.d... ..X..... [01B0] 58 02 03 00 01 00 4C 00 65 00 74 00 74 00 65 00 X.....L. e.t.t.e. [01C0] 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r....... ........ [01D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [01E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [01F0] 00 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 ........ ........ [0200] 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 ........ ........ [0210] 02 00 00 00 01 01 00 00 00 01 00 00 00 00 00 00 ........ ........ [0220] 00 00 00 00 34 00 1C 49 0D 22 00 01 64 01 01 00 ....4..I ."..d... [0230] 01 01 01 01 01 00 24 13 00 00 00 19 00 00 64 00 ......$. ......d. [0240] 64 00 2A 00 2A 00 2A 00 2A 00 64 00 00 00 01 00 d.*.*.*. *.d..... [0250] 00 00 00 00 00 00 00 00 BE 00 02 00 00 81 00 20 ........ ....... [0260] DC 91 00 00 01 01 00 00 00 00 00 01 02 00 00 00 ........ ........ [0270] 64 00 64 00 01 00 00 00 01 00 01 00 00 00 01 00 d.d..... ........ [0280] 00 00 00 00 05 01 00 00 05 01 02 01 07 00 02 01 ........ ........ [0290] 07 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [02A0] 00 00 00 00 6F 08 EA 0A 64 00 64 00 01 00 00 00 ....o... d.d..... [02B0] 12 09 00 00 AA 0D 00 00 EC 13 00 00 C8 19 00 00 ........ ........ [02C0] EC 13 00 00 C8 19 00 00 01 00 00 00 01 01 01 01 ........ ........ [02D0] 02 00 00 01 03 00 00 00 00 00 00 00 0F 0F 00 05 ........ ........ [02E0] 00 01 01 02 03 04 00 00 00 00 02 02 02 01 32 00 ........ ......2. [02F0] 32 00 32 00 32 00 32 00 32 00 1E 00 3C 00 0A 00 2.2.2.2. 2...<... [0300] E8 03 24 04 02 00 03 00 00 00 00 00 00 00 00 00 ..$..... ........ [0310] 00 00 01 00 00 00 1D 00 00 00 00 00 02 00 00 00 ........ ........ [0320] 00 00 00 00 80 00 05 01 00 00 00 00 00 00 00 00 ........ ........ [0330] 00 00 00 00 0C 00 0F 00 01 00 00 00 01 00 00 00 ........ ........ [0340] 08 00 02 00 28 00 00 00 0C 00 02 00 10 00 02 00 ....(... ........ [0350] B1 1D 00 00 03 00 00 00 00 00 00 00 09 00 00 00 ........ ........ [0360] 06 00 00 00 00 00 00 00 06 00 00 00 56 00 4D 00 ........ ....V.M. [0370] 2D 00 30 00 36 00 00 00 15 00 00 00 00 00 00 00 -.0.6... ........ [0380] 15 00 00 00 53 00 41 00 4D 00 44 00 4F 00 4D 00 ....S.A. M.D.O.M. [0390] 5C 00 61 00 64 00 6D 00 69 00 6E 00 69 00 73 00 \.a.d.m. i.n.i.s. [03A0] 74 00 72 00 61 00 74 00 6F 00 72 00 00 00 t.r.a.t. o.r... [2014/08/16 20:14:34.385435, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 0 [2014/08/16 20:14:34.385476, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request) Checking request auth. [2014/08/16 20:14:34.385515, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.385556, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.385594, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.386398, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.386559, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1324(api_pipe_request) Requested \spoolss rpc service [2014/08/16 20:14:34.386602, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1356(api_rpcTNP) api_rpcTNP: \spoolss op 0x45 - api_rpcTNP: rpc command: SPOOLSS_OPENPRINTEREX [2014/08/16 20:14:34.386641, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1390(api_rpcTNP) api_rpc_cmds[69].fn == 0x7ffd818b46c4 [2014/08/16 20:14:34.386699, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_OpenPrinterEx: struct spoolss_OpenPrinterEx in: struct spoolss_OpenPrinterEx printername : * printername : '\\M1\SHARP MX-2600N PS' datatype : NULL devmode_ctr: struct spoolss_DevmodeContainer _ndr_size : 0x000002e4 (740) devmode : * devmode: struct spoolss_DeviceMode devicename : '\\CSR|m1\{10090F86-E38D-465B-A4' specversion : DMSPEC_WIN95_98_ME (1024) driverversion : 0x0100 (256) size : 0x00dc (220) __driverextra_length : 0x0208 (520) fields : 0x0780df13 (125886227) 1: DEVMODE_ORIENTATION 1: DEVMODE_PAPERSIZE 0: DEVMODE_PAPERLENGTH 0: DEVMODE_PAPERWIDTH 1: DEVMODE_SCALE 0: DEVMODE_POSITION 0: DEVMODE_NUP 1: DEVMODE_COPIES 1: DEVMODE_DEFAULTSOURCE 1: DEVMODE_PRINTQUALITY 1: DEVMODE_COLOR 1: DEVMODE_DUPLEX 0: DEVMODE_YRESOLUTION 1: DEVMODE_TTOPTION 1: DEVMODE_COLLATE 0: DEVMODE_FORMNAME 0: DEVMODE_LOGPIXELS 0: DEVMODE_BITSPERPEL 0: DEVMODE_PELSWIDTH 0: DEVMODE_PELSHEIGHT 0: DEVMODE_DISPLAYFLAGS 0: DEVMODE_DISPLAYFREQUENCY 1: DEVMODE_ICMMETHOD 1: DEVMODE_ICMINTENT 1: DEVMODE_MEDIATYPE 1: DEVMODE_DITHERTYPE 0: DEVMODE_PANNINGWIDTH 0: DEVMODE_PANNINGHEIGHT orientation : DMORIENT_PORTRAIT (1) papersize : DMPAPER_LETTER (1) paperlength : 0x0aea (2794) paperwidth : 0x086f (2159) scale : 0x0064 (100) copies : 0x0001 (1) defaultsource : DMBIN_AUTO (7) printquality : UNKNOWN_ENUM_VALUE (600) color : DMRES_COLOR (2) duplex : DMDUP_SIMPLEX (1) yresolution : 0x0258 (600) ttoption : DMTT_SUBDEV (3) collate : DMCOLLATE_TRUE (1) formname : 'Letter' logpixels : 0x0000 (0) bitsperpel : 0x00000018 (24) pelswidth : 0x00000000 (0) pelsheight : 0x00000000 (0) displayflags : UNKNOWN_ENUM_VALUE (0) displayfrequency : 0x00000000 (0) icmmethod : DMICMMETHOD_DEVICE (4) icmintent : DMICM_CONTRAST (2) mediatype : UNKNOWN_ENUM_VALUE (257) dithertype : UNKNOWN_ENUM_VALUE (256) reserved1 : 0x00000000 (0) reserved2 : 0x00000000 (0) panningwidth : 0x00000000 (0) panningheight : 0x00000000 (0) driverextra_data : DATA_BLOB length=520 [0000] 00 00 04 0B 53 43 44 4D 08 02 81 07 24 00 00 00 ....SCDM ....$... [0010] F8 00 00 00 2C 01 00 00 EA 01 00 00 53 4E 30 48 ....,... ....SN0H [0020] 00 00 00 00 7B 00 31 00 30 00 30 00 39 00 30 00 ....{.1. 0.0.9.0. [0030] 46 00 38 00 36 00 2D 00 45 00 33 00 38 00 44 00 F.8.6.-. E.3.8.D. [0040] 2D 00 34 00 36 00 35 00 42 00 2D 00 41 00 34 00 -.4.6.5. B.-.A.4. [0050] 43 00 36 00 2D 00 37 00 42 00 43 00 33 00 30 00 C.6.-.7. B.C.3.0. [0060] 31 00 44 00 00 04 00 01 D4 00 10 01 13 DF 80 07 1.D..... ........ [0070] 01 00 01 00 EA 0A 6F 08 64 00 01 00 07 00 58 02 ......o. d.....X. [0080] 02 00 01 00 58 02 03 00 01 00 4C 00 65 00 74 00 ....X... ..L.e.t. [0090] 74 00 65 00 72 00 00 00 00 00 00 00 00 00 00 00 t.e.r... ........ [00A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00C0] 00 00 00 00 00 00 00 00 00 00 00 00 18 00 00 00 ........ ........ [00D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00E0] 04 00 00 00 02 00 00 00 01 01 00 00 00 01 00 00 ........ ........ [00F0] 00 00 00 00 00 00 00 00 34 00 1C 49 0D 22 00 01 ........ 4..I.".. [0100] 64 01 01 00 01 01 01 01 01 00 24 13 00 00 00 19 d....... ..$..... [0110] 00 00 64 00 64 00 2A 00 2A 00 2A 00 2A 00 64 00 ..d.d.*. *.*.*.d. [0120] 00 00 01 00 00 00 00 00 00 00 00 00 BE 00 02 00 ........ ........ [0130] 00 81 00 20 DC 91 00 00 01 01 00 00 00 00 00 01 ... .... ........ [0140] 02 00 00 00 64 00 64 00 01 00 00 00 01 00 01 00 ....d.d. ........ [0150] 00 00 01 00 00 00 00 00 05 01 00 00 05 01 02 01 ........ ........ [0160] 07 00 02 01 07 00 01 01 00 00 00 00 00 00 00 00 ........ ........ [0170] 00 00 00 00 00 00 00 00 6F 08 EA 0A 64 00 64 00 ........ o...d.d. [0180] 01 00 00 00 12 09 00 00 AA 0D 00 00 EC 13 00 00 ........ ........ [0190] C8 19 00 00 EC 13 00 00 C8 19 00 00 01 00 00 00 ........ ........ [01A0] 01 01 01 01 02 00 00 01 03 00 00 00 00 00 00 00 ........ ........ [01B0] 0F 0F 00 05 00 01 01 02 03 04 00 00 00 00 02 02 ........ ........ [01C0] 02 01 32 00 32 00 32 00 32 00 32 00 32 00 1E 00 ..2.2.2. 2.2.2... [01D0] 3C 00 0A 00 E8 03 24 04 02 00 03 00 00 00 00 00 <.....$. ........ [01E0] 00 00 00 00 00 00 01 00 00 00 1D 00 00 00 00 00 ........ ........ [01F0] 02 00 00 00 00 00 00 00 80 00 05 01 00 00 00 00 ........ ........ [0200] 00 00 00 00 00 00 00 00 ........ access_mask : 0x000f000c (983052) 0: SERVER_ACCESS_ADMINISTER 0: SERVER_ACCESS_ENUMERATE 1: PRINTER_ACCESS_ADMINISTER 1: PRINTER_ACCESS_USE 0: JOB_ACCESS_ADMINISTER 0: JOB_ACCESS_READ userlevel_ctr: struct spoolss_UserLevelCtr level : 0x00000001 (1) user_info : union spoolss_UserLevel(case 1) level1 : * level1: struct spoolss_UserLevel1 size : 0x00000028 (40) client : * client : 'VM-06' user : * user : 'SAMDOM\administrator' build : 0x00001db1 (7601) major : UNKNOWN_ENUM_VALUE (3) minor : SPOOLSS_MINOR_VERSION_0 (0) processor : PROCESSOR_ARCHITECTURE_AMD64 (9) checking name: \\M1\SHARP MX-2600N PS [2014/08/16 20:14:34.389485, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:737(open_printer_hnd) open_printer_hnd: name [\\M1\SHARP MX-2600N PS] [2014/08/16 20:14:34.389531, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.389604, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:506(set_printer_hnd_printertype) Setting printer type=\\M1\SHARP MX-2600N PS Printer is a printer [2014/08/16 20:14:34.389654, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:566(set_printer_hnd_name) Setting printer name=\\M1\SHARP MX-2600N PS (len=22) searching for [SHARP MX-2600N PS] [2014/08/16 20:14:34.389734, 10, pid=1080, effective(0, 10000), real(0, 0), class=tdb] ../source3/lib/gencache.c:275(gencache_set_data_blob) Did not store value for PRINTERNAME/SHARP MX-2600N PS, we already got it set_printer_hnd_name: Printer found: SHARP MX-2600N PS -> SHMX2600-6_F [2014/08/16 20:14:34.389787, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:773(open_printer_hnd) 2 printer handles active [2014/08/16 20:14:34.389824, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.389894, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.389963, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:489(get_printer_snum) short name:SHMX2600-6_F [2014/08/16 20:14:34.390016, 3, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/access.c:338(allow_access) Allowed connection from 10.99.0.70 (10.99.0.70) [2014/08/16 20:14:34.390226, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/share_access.c:237(user_ok_token) user_ok_token: share SHMX2600-6_F is ok for unix user root [2014/08/16 20:14:34.390285, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:1922(_spoolss_OpenPrinterEx) Setting printer access = PRINTER_ACCESS_ADMINISTER [2014/08/16 20:14:34.390336, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \winreg [2014/08/16 20:14:34.390379, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:221(init_pipe_handles) init_pipe_handle_list: created handle list for pipe \winreg [2014/08/16 20:14:34.390418, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe \winreg [2014/08/16 20:14:34.390491, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \winreg [2014/08/16 20:14:34.390551, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.390757, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:34.390797, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:34.390836, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:34.390873, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:34.390909, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:34.390944, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:34.391174, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.391229, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:34.391271, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:34.391307, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:34.391344, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.391379, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:34.391452, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 0C 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.391536, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010c-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.391705, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010c-0000-0000-ef53-8a9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.392224, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0C 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.392300, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:34.392339, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:34.392377, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:34.392413, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:34.392451, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.392486, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:34.392554, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:34.392595, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:34.392634, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.392680, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.392719, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.392754, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.392815, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:34.392855, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:34.392893, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.392929, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.392967, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.393001, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.393057, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:34.393217, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:34.393259, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.393295, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.393333, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.393368, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.393443, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:34.393484, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:34.393523, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.393559, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.393598, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.393633, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.393697, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:34.393737, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:34.393776, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.393812, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.393851, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.393886, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.393952, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:34.393992, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:34.394031, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.394182, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.394229, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.394265, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.394334, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:34.394376, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:34.394414, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:34.394451, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:34.394487, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:34.394524, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:34.394562, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 0D 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.394640, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010d-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.394787, 2, pid=1080, effective(0, 10000), real(0, 0)] ../source3/rpc_client/cli_winreg_spoolss.c:626(winreg_create_printer) winreg_create_printer: Skipping, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F already exists [2014/08/16 20:14:34.394841, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010d-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.394959, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0D 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.395030, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0D 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.395217, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.395259, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:34.395296, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.395447, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010c-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.395566, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0C 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.395636, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0C 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.395704, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.395747, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:34.395798, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.395945, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:416(close_policy_by_pipe) Deleted handle list for RPC connection \winreg [2014/08/16 20:14:34.395993, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_OpenPrinterEx: struct spoolss_OpenPrinterEx out: struct spoolss_OpenPrinterEx handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010b-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.396249, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1417(api_rpcTNP) api_rpcTNP: called \spoolss successfully [2014/08/16 20:14:34.396300, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.396339, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 950 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 56 req->in.vector[4].iov_len = 966 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:34.396528, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:128(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: received 966 [2014/08/16 20:14:34.396568, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:149(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: issuing np_read_send of size 1024 [2014/08/16 20:14:34.396606, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:34.396644, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:347(read_from_internal_pipe) read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 24. [2014/08/16 20:14:34.396689, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0030 (48) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000018 (24) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=24 [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 00 00 00 00 8....... [2014/08/16 20:14:34.397190, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 62 [2014/08/16 20:14:34.397240, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 48 bytes. There is no more data outstanding [2014/08/16 20:14:34.397278, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:178(smbd_smb2_ioctl_pipe_read_done) smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = 48 is_data_outstanding = 0, status = NT_STATUS_OK [2014/08/16 20:14:34.397318, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:291(smbd_smb2_request_ioctl_done) smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned 48 status NT_STATUS_OK [2014/08/16 20:14:34.397357, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[48] dyn[yes:48] at ../source3/smbd/smb2_ioctl.c:358 [2014/08/16 20:14:34.397396, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/145/31 [2014/08/16 20:14:34.398053, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:34.398122, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 145 (position 145) from bitmap [2014/08/16 20:14:34.398202, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_IOCTL] mid = 145 [2014/08/16 20:14:34.398248, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.398289, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.398991, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.399272, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:34.399320, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 145, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:34.399359, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:394(smbd_smb2_ioctl_send) smbd_smb2_ioctl: ctl_code[0x0011c017] spoolss, fnum 2162169606 [2014/08/16 20:14:34.399401, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:59(smb2_ioctl_named_pipe) smbd_smb2_ioctl_send: np_write_send of size 56 [2014/08/16 20:14:34.399437, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 56 [2014/08/16 20:14:34.399474, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 56 [2014/08/16 20:14:34.399509, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 56 [2014/08/16 20:14:34.399546, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 56, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:34.399582, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:34.399618, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 40 [2014/08/16 20:14:34.399653, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 40 [2014/08/16 20:14:34.399690, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:34.399725, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 40 [2014/08/16 20:14:34.399760, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 40, incoming data = 40 [2014/08/16 20:14:34.399798, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:34.399840, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0038 (56) auth_length : 0x0000 (0) call_id : 0x00000003 (3) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000020 (32) context_id : 0x0000 (0) opnum : 0x0008 (8) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=32 [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 8....... ........ [2014/08/16 20:14:34.400376, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 0 [2014/08/16 20:14:34.400417, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request) Checking request auth. [2014/08/16 20:14:34.400453, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.400493, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.400531, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.401341, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.401495, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1324(api_pipe_request) Requested \spoolss rpc service [2014/08/16 20:14:34.401537, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1356(api_rpcTNP) api_rpcTNP: \spoolss op 0x8 - api_rpcTNP: rpc command: SPOOLSS_GETPRINTER [2014/08/16 20:14:34.401577, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1390(api_rpcTNP) api_rpc_cmds[8].fn == 0x7ffd818a97ca [2014/08/16 20:14:34.401617, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_GetPrinter: struct spoolss_GetPrinter in: struct spoolss_GetPrinter handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010b-0000-0000-ef53-8a9f38040000 level : 0x00000004 (4) buffer : NULL offered : 0x00000000 (0) [2014/08/16 20:14:34.401779, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.401850, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.401919, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:489(get_printer_snum) short name:SHMX2600-6_F [2014/08/16 20:14:34.401968, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \winreg [2014/08/16 20:14:34.402012, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:221(init_pipe_handles) init_pipe_handle_list: created handle list for pipe \winreg [2014/08/16 20:14:34.402051, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe \winreg [2014/08/16 20:14:34.402242, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \winreg [2014/08/16 20:14:34.402305, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.402509, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:34.402556, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:34.402596, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:34.402633, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:34.402669, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:34.402703, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:34.402812, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.402854, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:34.402894, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:34.402930, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:34.402967, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.403002, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:34.403182, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 0E 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.403270, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010e-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.403435, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010e-0000-0000-ef53-8a9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.403842, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0E 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.403917, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:34.403955, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:34.403994, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:34.404030, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:34.404176, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.404223, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:34.404294, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:34.404336, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:34.404375, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.404410, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.404448, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.404483, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.404542, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:34.404582, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:34.404621, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.404656, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.404694, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.404729, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.404786, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:34.404833, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:34.404873, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.404908, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.404946, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.404981, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.405055, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:34.405215, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:34.405257, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.405294, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.405333, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.405368, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.405427, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:34.405468, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:34.405508, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.405544, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.405583, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.405618, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.405683, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:34.405724, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:34.405769, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.405808, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.405848, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.405884, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.405951, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:34.405992, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:34.406031, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:34.406176, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:34.406225, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:34.406263, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:34.406301, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.406372, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.406530, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey in: struct winreg_QueryInfoKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL [2014/08/16 20:14:34.406726, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.406801, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' (ops 0x7ffd8125b800) [2014/08/16 20:14:34.406847, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.406909, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Description] len[2] [2014/08/16 20:14:34.406952, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Datatype] len[8] [2014/08/16 20:14:34.406991, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Default Priority] len[4] [2014/08/16 20:14:34.407030, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Port] len[38] [2014/08/16 20:14:34.407178, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Print Processor] len[18] [2014/08/16 20:14:34.407229, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Priority] len[4] [2014/08/16 20:14:34.407269, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Security] len[248] [2014/08/16 20:14:34.407308, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Share Name] len[26] [2014/08/16 20:14:34.407347, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[StartTime] len[4] [2014/08/16 20:14:34.407386, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[UntilTime] len[4] [2014/08/16 20:14:34.407424, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[Attributes] len[4] [2014/08/16 20:14:34.407463, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[Printer Driver] len[36] [2014/08/16 20:14:34.407502, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[Location] len[2] [2014/08/16 20:14:34.407541, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[13]: name[Parameters] len[2] [2014/08/16 20:14:34.407580, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[14]: name[Name] len[36] [2014/08/16 20:14:34.407619, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[15]: name[Separator File] len[2] [2014/08/16 20:14:34.407659, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[16]: name[Status] len[4] [2014/08/16 20:14:34.407698, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[17]: name[ChangeID] len[4] [2014/08/16 20:14:34.407744, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:2074(regdb_get_secdesc) regdb_get_secdesc: Getting secdesc of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.407805, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey out: struct winreg_QueryInfoKey classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL num_subkeys : * num_subkeys : 0x00000003 (3) max_subkeylen : * max_subkeylen : 0x00000022 (34) max_classlen : * max_classlen : 0x00000000 (0) num_values : * num_values : 0x00000012 (18) max_valnamelen : * max_valnamelen : 0x00000022 (34) max_valbufsize : * max_valbufsize : 0x000000f8 (248) secdescsize : * secdescsize : 0x00000078 (120) last_changed_time : * last_changed_time : NTTIME(0) result : WERR_OK [2014/08/16 20:14:34.408356, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000000 (0) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.408698, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.408772, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.408815, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0018 (24) size : 0x0024 (36) name : * name : 'Description' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:34.409285, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000001 (1) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.409630, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.409702, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.409743, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Datatype' type : * type : REG_SZ (1) value : * value: ARRAY(8) [0] : 0x52 (82) [1] : 0x00 (0) [2] : 0x41 (65) [3] : 0x00 (0) [4] : 0x57 (87) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) size : * size : 0x00000008 (8) length : * length : 0x00000008 (8) result : WERR_OK [2014/08/16 20:14:34.410282, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000002 (2) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.410624, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.410696, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.410737, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0022 (34) size : 0x0024 (36) name : * name : 'Default Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.411202, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000003 (3) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.411545, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.411626, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.411668, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Port' type : * type : REG_SZ (1) value : * value: ARRAY(38) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x61 (97) [3] : 0x00 (0) [4] : 0x6d (109) [5] : 0x00 (0) [6] : 0x62 (98) [7] : 0x00 (0) [8] : 0x61 (97) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x50 (80) [13] : 0x00 (0) [14] : 0x72 (114) [15] : 0x00 (0) [16] : 0x69 (105) [17] : 0x00 (0) [18] : 0x6e (110) [19] : 0x00 (0) [20] : 0x74 (116) [21] : 0x00 (0) [22] : 0x65 (101) [23] : 0x00 (0) [24] : 0x72 (114) [25] : 0x00 (0) [26] : 0x20 (32) [27] : 0x00 (0) [28] : 0x50 (80) [29] : 0x00 (0) [30] : 0x6f (111) [31] : 0x00 (0) [32] : 0x72 (114) [33] : 0x00 (0) [34] : 0x74 (116) [35] : 0x00 (0) [36] : 0x00 (0) [37] : 0x00 (0) size : * size : 0x00000026 (38) length : * length : 0x00000026 (38) result : WERR_OK [2014/08/16 20:14:34.412647, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000004 (4) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.412990, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.413168, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.413223, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0020 (32) size : 0x0024 (36) name : * name : 'Print Processor' type : * type : REG_SZ (1) value : * value: ARRAY(18) [0] : 0x77 (119) [1] : 0x00 (0) [2] : 0x69 (105) [3] : 0x00 (0) [4] : 0x6e (110) [5] : 0x00 (0) [6] : 0x70 (112) [7] : 0x00 (0) [8] : 0x72 (114) [9] : 0x00 (0) [10] : 0x69 (105) [11] : 0x00 (0) [12] : 0x6e (110) [13] : 0x00 (0) [14] : 0x74 (116) [15] : 0x00 (0) [16] : 0x00 (0) [17] : 0x00 (0) size : * size : 0x00000012 (18) length : * length : 0x00000012 (18) result : WERR_OK [2014/08/16 20:14:34.413790, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000005 (5) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.414249, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.414323, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.414364, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.414724, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000006 (6) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.415056, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.415258, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.415295, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Security' type : * type : REG_BINARY (3) value : * value: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) size : * size : 0x000000f8 (248) length : * length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:34.417761, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000007 (7) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.417952, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.417993, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.418016, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Share Name' type : * type : REG_SZ (1) value : * value: ARRAY(26) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x4d (77) [5] : 0x00 (0) [6] : 0x58 (88) [7] : 0x00 (0) [8] : 0x32 (50) [9] : 0x00 (0) [10] : 0x36 (54) [11] : 0x00 (0) [12] : 0x30 (48) [13] : 0x00 (0) [14] : 0x30 (48) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x36 (54) [19] : 0x00 (0) [20] : 0x5f (95) [21] : 0x00 (0) [22] : 0x46 (70) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) size : * size : 0x0000001a (26) length : * length : 0x0000001a (26) result : WERR_OK [2014/08/16 20:14:34.418521, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000008 (8) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.418710, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.418750, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.418773, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'StartTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.418971, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000009 (9) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.419285, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.419330, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.419354, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'UntilTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.419555, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000a (10) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.419741, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.419780, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.419803, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Attributes' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x48 (72) [1] : 0x18 (24) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.420006, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000b (11) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.420314, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.420355, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.420379, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x001e (30) size : 0x0024 (36) name : * name : 'Printer Driver' type : * type : REG_SZ (1) value : * value: ARRAY(36) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x41 (65) [5] : 0x00 (0) [6] : 0x52 (82) [7] : 0x00 (0) [8] : 0x50 (80) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x4d (77) [13] : 0x00 (0) [14] : 0x58 (88) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x32 (50) [19] : 0x00 (0) [20] : 0x36 (54) [21] : 0x00 (0) [22] : 0x30 (48) [23] : 0x00 (0) [24] : 0x30 (48) [25] : 0x00 (0) [26] : 0x4e (78) [27] : 0x00 (0) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x50 (80) [31] : 0x00 (0) [32] : 0x53 (83) [33] : 0x00 (0) [34] : 0x00 (0) [35] : 0x00 (0) size : * size : 0x00000024 (36) length : * length : 0x00000024 (36) result : WERR_OK [2014/08/16 20:14:34.420845, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000c (12) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.421031, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.421192, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.421217, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Location' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:34.421405, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000d (13) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.421591, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.421630, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.421653, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Parameters' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:34.421835, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000e (14) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.422025, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.422178, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.422211, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Name' type : * type : REG_SZ (1) value : * value: ARRAY(36) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x41 (65) [5] : 0x00 (0) [6] : 0x52 (82) [7] : 0x00 (0) [8] : 0x50 (80) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x4d (77) [13] : 0x00 (0) [14] : 0x58 (88) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x32 (50) [19] : 0x00 (0) [20] : 0x36 (54) [21] : 0x00 (0) [22] : 0x30 (48) [23] : 0x00 (0) [24] : 0x30 (48) [25] : 0x00 (0) [26] : 0x4e (78) [27] : 0x00 (0) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x50 (80) [31] : 0x00 (0) [32] : 0x53 (83) [33] : 0x00 (0) [34] : 0x00 (0) [35] : 0x00 (0) size : * size : 0x00000024 (36) length : * length : 0x00000024 (36) result : WERR_OK [2014/08/16 20:14:34.422669, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000f (15) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.422859, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.422899, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.422921, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x001e (30) size : 0x0024 (36) name : * name : 'Separator File' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:34.423227, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000010 (16) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.423414, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.423457, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.423480, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000e (14) size : 0x0024 (36) name : * name : 'Status' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.423677, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 enum_index : 0x00000011 (17) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.423862, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.423901, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.423923, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'ChangeID' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x8d (141) [1] : 0xcd (205) [2] : 0x1b (27) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.424270, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0020 (32) name_size : 0x0020 (32) name : * name : 'Default DevMode' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:34.424443, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.424483, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.424504, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:34.424526, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:316(_winreg_QueryValue) _winreg_QueryValue: reg_queryvalue failed with: WERR_BADFILE [2014/08/16 20:14:34.424547, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) result : WERR_BADFILE [2014/08/16 20:14:34.424657, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.424772, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:34.424797, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:34.424819, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:34.424839, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:34.424860, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.424879, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:34.424917, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[3] [0000] 00 00 00 00 10 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.424959, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000110-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.425046, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000110-0000-0000-ef53-8a9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.425403, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 10 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.425445, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:34.425467, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:34.425488, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:34.425512, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:34.425533, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.425552, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:34.425590, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:34.425613, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:34.425635, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.425654, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.425675, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.425694, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.425728, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:34.425751, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:34.425772, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.425792, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.425813, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.425832, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.425863, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:34.425885, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:34.425906, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.425926, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.425947, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.425966, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.426011, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:34.426034, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:34.426056, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.426200, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.426225, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.426244, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.426278, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:34.426301, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (8->9) [2014/08/16 20:14:34.426323, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.426343, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.426364, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.426384, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.426419, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:34.426442, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (9->10) [2014/08/16 20:14:34.426464, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.426484, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.426507, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.426526, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.426564, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (10->9) [2014/08/16 20:14:34.426591, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (9->8) [2014/08/16 20:14:34.426612, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:34.426633, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:34.426653, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:34.426673, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:34.426694, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[4] [0000] 00 00 00 00 11 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.426734, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000111-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.426822, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000111-0000-0000-ef53-8a9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:34.426993, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 11 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.427032, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.427053, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:34.427196, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' (ops 0x7ffd8125b800) [2014/08/16 20:14:34.427229, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.427263, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Description] len[2] [2014/08/16 20:14:34.427286, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Datatype] len[8] [2014/08/16 20:14:34.427308, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Default Priority] len[4] [2014/08/16 20:14:34.427329, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Port] len[38] [2014/08/16 20:14:34.427351, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Print Processor] len[18] [2014/08/16 20:14:34.427373, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Priority] len[4] [2014/08/16 20:14:34.427394, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Security] len[248] [2014/08/16 20:14:34.427416, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Share Name] len[26] [2014/08/16 20:14:34.427437, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[StartTime] len[4] [2014/08/16 20:14:34.427458, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[UntilTime] len[4] [2014/08/16 20:14:34.427479, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[Attributes] len[4] [2014/08/16 20:14:34.427501, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[Printer Driver] len[36] [2014/08/16 20:14:34.427523, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[Location] len[2] [2014/08/16 20:14:34.427545, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[13]: name[Parameters] len[2] [2014/08/16 20:14:34.427566, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[14]: name[Name] len[36] [2014/08/16 20:14:34.427588, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[15]: name[Separator File] len[2] [2014/08/16 20:14:34.427610, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[16]: name[Status] len[4] [2014/08/16 20:14:34.427632, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[17]: name[ChangeID] len[4] [2014/08/16 20:14:34.427657, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : NULL data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) result : WERR_OK [2014/08/16 20:14:34.427769, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000111-0000-0000-ef53-8a9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_BINARY (3) data : * data: ARRAY(0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:34.427947, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 11 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.427987, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.428008, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:34.428030, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : * data: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:34.430577, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000111-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.430647, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 11 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.430687, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 11 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.430726, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.430749, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:34.430770, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.430851, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000110-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.430917, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 10 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.430958, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 10 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.430997, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.431017, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:34.431038, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.431265, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010f-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.431332, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.431372, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0F 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.431410, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.431433, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:34.431454, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.431535, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010e-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.431601, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0E 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.431640, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0E 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.431683, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.431704, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:34.431734, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.431818, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:416(close_policy_by_pipe) Deleted handle list for RPC connection \winreg [2014/08/16 20:14:34.431856, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_GetPrinter: struct spoolss_GetPrinter out: struct spoolss_GetPrinter info : NULL needed : * needed : 0x00000050 (80) result : WERR_INSUFFICIENT_BUFFER [2014/08/16 20:14:34.431929, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1417(api_rpcTNP) api_rpcTNP: called \spoolss successfully [2014/08/16 20:14:34.431958, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.431980, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 40 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 56 req->in.vector[4].iov_len = 56 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:34.432190, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:128(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: received 56 [2014/08/16 20:14:34.432215, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:149(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: issuing np_read_send of size 1024 [2014/08/16 20:14:34.432237, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:34.432260, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:347(read_from_internal_pipe) read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 12. [2014/08/16 20:14:34.432286, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0024 (36) auth_length : 0x0000 (0) call_id : 0x00000003 (3) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=12 [0000] 00 00 00 00 50 00 00 00 7A 00 00 00 ....P... z... [2014/08/16 20:14:34.432487, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 57 [2014/08/16 20:14:34.432512, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 36 bytes. There is no more data outstanding [2014/08/16 20:14:34.432534, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:178(smbd_smb2_ioctl_pipe_read_done) smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = 36 is_data_outstanding = 0, status = NT_STATUS_OK [2014/08/16 20:14:34.432557, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:291(smbd_smb2_request_ioctl_done) smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned 36 status NT_STATUS_OK [2014/08/16 20:14:34.432578, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[48] dyn[yes:36] at ../source3/smbd/smb2_ioctl.c:358 [2014/08/16 20:14:34.432601, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/146/31 [2014/08/16 20:14:34.432965, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:34.433003, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 146 (position 146) from bitmap [2014/08/16 20:14:34.433027, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_IOCTL] mid = 146 [2014/08/16 20:14:34.433054, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.433078, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.433531, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.433621, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:34.433647, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 146, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:34.433669, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:394(smbd_smb2_ioctl_send) smbd_smb2_ioctl: ctl_code[0x0011c017] spoolss, fnum 2162169606 [2014/08/16 20:14:34.433693, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:59(smb2_ioctl_named_pipe) smbd_smb2_ioctl_send: np_write_send of size 212 [2014/08/16 20:14:34.433714, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 212 [2014/08/16 20:14:34.433735, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 212 [2014/08/16 20:14:34.433756, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 212 [2014/08/16 20:14:34.433776, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 212, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:34.433797, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:34.433817, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 196 [2014/08/16 20:14:34.433837, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 196 [2014/08/16 20:14:34.433858, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:34.433878, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 196 [2014/08/16 20:14:34.433898, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 196, incoming data = 196 [2014/08/16 20:14:34.433919, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:34.433947, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00d4 (212) auth_length : 0x0000 (0) call_id : 0x00000004 (4) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000000bc (188) context_id : 0x0000 (0) opnum : 0x0008 (8) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=188 [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 04 00 00 00 00 00 02 00 98 00 00 00 8....... ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0080] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0090] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00B0] 00 00 00 00 00 00 00 00 98 00 00 00 ........ .... [2014/08/16 20:14:34.434458, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 0 [2014/08/16 20:14:34.434481, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request) Checking request auth. [2014/08/16 20:14:34.434503, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.434526, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.434548, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.434954, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.435041, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1324(api_pipe_request) Requested \spoolss rpc service [2014/08/16 20:14:34.435166, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1356(api_rpcTNP) api_rpcTNP: \spoolss op 0x8 - api_rpcTNP: rpc command: SPOOLSS_GETPRINTER [2014/08/16 20:14:34.435207, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1390(api_rpcTNP) api_rpc_cmds[8].fn == 0x7ffd818a97ca [2014/08/16 20:14:34.435238, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_GetPrinter: struct spoolss_GetPrinter in: struct spoolss_GetPrinter handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010b-0000-0000-ef53-8a9f38040000 level : 0x00000004 (4) buffer : * buffer : DATA_BLOB length=152 [0000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0010] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0080] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0090] 00 00 00 00 00 00 00 00 ........ offered : 0x00000098 (152) [2014/08/16 20:14:34.435520, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.435560, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.435598, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:489(get_printer_snum) short name:SHMX2600-6_F [2014/08/16 20:14:34.435632, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \winreg [2014/08/16 20:14:34.435657, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:221(init_pipe_handles) init_pipe_handle_list: created handle list for pipe \winreg [2014/08/16 20:14:34.435679, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe \winreg [2014/08/16 20:14:34.435721, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \winreg [2014/08/16 20:14:34.435755, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.435868, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:34.435890, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:34.435912, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:34.435932, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:34.435952, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:34.435971, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:34.436045, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.436171, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:34.436197, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:34.436218, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:34.436239, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.436259, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:34.436300, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 12 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.436347, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000112-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.436443, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000112-0000-0000-ef53-8a9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.436671, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 12 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.436714, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:34.436735, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:34.436757, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:34.436778, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:34.436799, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.436819, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:34.436858, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:34.436881, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:34.436904, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.436924, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.436949, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.436970, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.437004, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:34.437027, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:34.437050, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.437172, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.437211, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.437231, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.437265, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:34.437289, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:34.437312, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.437332, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.437354, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.437374, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.437416, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:34.437440, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:34.437462, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.437483, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.437506, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.437526, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.437562, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:34.437586, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:34.437609, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.437629, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.437652, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.437672, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.437710, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:34.437734, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:34.437756, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.437777, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.437800, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.437820, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.437859, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:34.437882, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:34.437904, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:34.437925, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:34.437946, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:34.437967, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:34.437989, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.438033, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.438229, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey in: struct winreg_QueryInfoKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL [2014/08/16 20:14:34.438343, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.438387, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' (ops 0x7ffd8125b800) [2014/08/16 20:14:34.438409, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.438443, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Description] len[2] [2014/08/16 20:14:34.438468, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Datatype] len[8] [2014/08/16 20:14:34.438490, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Default Priority] len[4] [2014/08/16 20:14:34.438513, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Port] len[38] [2014/08/16 20:14:34.438535, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Print Processor] len[18] [2014/08/16 20:14:34.438557, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Priority] len[4] [2014/08/16 20:14:34.438580, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Security] len[248] [2014/08/16 20:14:34.438602, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Share Name] len[26] [2014/08/16 20:14:34.438624, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[StartTime] len[4] [2014/08/16 20:14:34.438646, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[UntilTime] len[4] [2014/08/16 20:14:34.438672, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[Attributes] len[4] [2014/08/16 20:14:34.438696, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[Printer Driver] len[36] [2014/08/16 20:14:34.438718, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[Location] len[2] [2014/08/16 20:14:34.438741, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[13]: name[Parameters] len[2] [2014/08/16 20:14:34.438763, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[14]: name[Name] len[36] [2014/08/16 20:14:34.438786, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[15]: name[Separator File] len[2] [2014/08/16 20:14:34.438808, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[16]: name[Status] len[4] [2014/08/16 20:14:34.438831, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[17]: name[ChangeID] len[4] [2014/08/16 20:14:34.438853, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:2074(regdb_get_secdesc) regdb_get_secdesc: Getting secdesc of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.438886, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey out: struct winreg_QueryInfoKey classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL num_subkeys : * num_subkeys : 0x00000003 (3) max_subkeylen : * max_subkeylen : 0x00000022 (34) max_classlen : * max_classlen : 0x00000000 (0) num_values : * num_values : 0x00000012 (18) max_valnamelen : * max_valnamelen : 0x00000022 (34) max_valbufsize : * max_valbufsize : 0x000000f8 (248) secdescsize : * secdescsize : 0x00000078 (120) last_changed_time : * last_changed_time : NTTIME(0) result : WERR_OK [2014/08/16 20:14:34.439224, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000000 (0) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.439425, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.439467, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.439490, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0018 (24) size : 0x0024 (36) name : * name : 'Description' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:34.439681, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000001 (1) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.439873, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.439914, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.439940, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Datatype' type : * type : REG_SZ (1) value : * value: ARRAY(8) [0] : 0x52 (82) [1] : 0x00 (0) [2] : 0x41 (65) [3] : 0x00 (0) [4] : 0x57 (87) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) size : * size : 0x00000008 (8) length : * length : 0x00000008 (8) result : WERR_OK [2014/08/16 20:14:34.440284, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000002 (2) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.440477, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.440519, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.440542, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0022 (34) size : 0x0024 (36) name : * name : 'Default Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.440752, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000003 (3) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.440944, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.440984, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.441007, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Port' type : * type : REG_SZ (1) value : * value: ARRAY(38) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x61 (97) [3] : 0x00 (0) [4] : 0x6d (109) [5] : 0x00 (0) [6] : 0x62 (98) [7] : 0x00 (0) [8] : 0x61 (97) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x50 (80) [13] : 0x00 (0) [14] : 0x72 (114) [15] : 0x00 (0) [16] : 0x69 (105) [17] : 0x00 (0) [18] : 0x6e (110) [19] : 0x00 (0) [20] : 0x74 (116) [21] : 0x00 (0) [22] : 0x65 (101) [23] : 0x00 (0) [24] : 0x72 (114) [25] : 0x00 (0) [26] : 0x20 (32) [27] : 0x00 (0) [28] : 0x50 (80) [29] : 0x00 (0) [30] : 0x6f (111) [31] : 0x00 (0) [32] : 0x72 (114) [33] : 0x00 (0) [34] : 0x74 (116) [35] : 0x00 (0) [36] : 0x00 (0) [37] : 0x00 (0) size : * size : 0x00000026 (38) length : * length : 0x00000026 (38) result : WERR_OK [2014/08/16 20:14:34.441610, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000004 (4) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.441798, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.441838, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.441860, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0020 (32) size : 0x0024 (36) name : * name : 'Print Processor' type : * type : REG_SZ (1) value : * value: ARRAY(18) [0] : 0x77 (119) [1] : 0x00 (0) [2] : 0x69 (105) [3] : 0x00 (0) [4] : 0x6e (110) [5] : 0x00 (0) [6] : 0x70 (112) [7] : 0x00 (0) [8] : 0x72 (114) [9] : 0x00 (0) [10] : 0x69 (105) [11] : 0x00 (0) [12] : 0x6e (110) [13] : 0x00 (0) [14] : 0x74 (116) [15] : 0x00 (0) [16] : 0x00 (0) [17] : 0x00 (0) size : * size : 0x00000012 (18) length : * length : 0x00000012 (18) result : WERR_OK [2014/08/16 20:14:34.442308, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000005 (5) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.442501, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.442541, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.442564, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.442770, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000006 (6) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.442957, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.442997, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.443019, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Security' type : * type : REG_BINARY (3) value : * value: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) size : * size : 0x000000f8 (248) length : * length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:34.445776, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000007 (7) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.445980, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.446023, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.446047, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Share Name' type : * type : REG_SZ (1) value : * value: ARRAY(26) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x4d (77) [5] : 0x00 (0) [6] : 0x58 (88) [7] : 0x00 (0) [8] : 0x32 (50) [9] : 0x00 (0) [10] : 0x36 (54) [11] : 0x00 (0) [12] : 0x30 (48) [13] : 0x00 (0) [14] : 0x30 (48) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x36 (54) [19] : 0x00 (0) [20] : 0x5f (95) [21] : 0x00 (0) [22] : 0x46 (70) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) size : * size : 0x0000001a (26) length : * length : 0x0000001a (26) result : WERR_OK [2014/08/16 20:14:34.446555, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000008 (8) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.446754, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.446796, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.446821, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'StartTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.447035, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000009 (9) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.447336, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.447381, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.447405, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'UntilTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.447616, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000a (10) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.447817, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.447859, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.447883, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Attributes' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x48 (72) [1] : 0x18 (24) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.448199, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000b (11) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.448398, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.448440, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.448464, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x001e (30) size : 0x0024 (36) name : * name : 'Printer Driver' type : * type : REG_SZ (1) value : * value: ARRAY(36) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x41 (65) [5] : 0x00 (0) [6] : 0x52 (82) [7] : 0x00 (0) [8] : 0x50 (80) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x4d (77) [13] : 0x00 (0) [14] : 0x58 (88) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x32 (50) [19] : 0x00 (0) [20] : 0x36 (54) [21] : 0x00 (0) [22] : 0x30 (48) [23] : 0x00 (0) [24] : 0x30 (48) [25] : 0x00 (0) [26] : 0x4e (78) [27] : 0x00 (0) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x50 (80) [31] : 0x00 (0) [32] : 0x53 (83) [33] : 0x00 (0) [34] : 0x00 (0) [35] : 0x00 (0) size : * size : 0x00000024 (36) length : * length : 0x00000024 (36) result : WERR_OK [2014/08/16 20:14:34.448955, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000c (12) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.449260, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.449303, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.449327, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Location' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:34.449524, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000d (13) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.449715, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.449756, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.449779, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Parameters' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:34.449971, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000e (14) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.450266, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.450309, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.450332, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Name' type : * type : REG_SZ (1) value : * value: ARRAY(36) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x41 (65) [5] : 0x00 (0) [6] : 0x52 (82) [7] : 0x00 (0) [8] : 0x50 (80) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x4d (77) [13] : 0x00 (0) [14] : 0x58 (88) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x32 (50) [19] : 0x00 (0) [20] : 0x36 (54) [21] : 0x00 (0) [22] : 0x30 (48) [23] : 0x00 (0) [24] : 0x30 (48) [25] : 0x00 (0) [26] : 0x4e (78) [27] : 0x00 (0) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x50 (80) [31] : 0x00 (0) [32] : 0x53 (83) [33] : 0x00 (0) [34] : 0x00 (0) [35] : 0x00 (0) size : * size : 0x00000024 (36) length : * length : 0x00000024 (36) result : WERR_OK [2014/08/16 20:14:34.450816, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x0000000f (15) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.451006, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.451047, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.451171, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x001e (30) size : 0x0024 (36) name : * name : 'Separator File' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:34.451367, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000010 (16) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.451560, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.451600, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.451622, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000e (14) size : 0x0024 (36) name : * name : 'Status' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.451822, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 enum_index : 0x00000011 (17) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:34.452012, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.452052, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.452197, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'ChangeID' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x8d (141) [1] : 0xcd (205) [2] : 0x1b (27) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:34.452422, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0020 (32) name_size : 0x0020 (32) name : * name : 'Default DevMode' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:34.452595, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.452635, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.452655, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:34.452681, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:316(_winreg_QueryValue) _winreg_QueryValue: reg_queryvalue failed with: WERR_BADFILE [2014/08/16 20:14:34.452702, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) result : WERR_BADFILE [2014/08/16 20:14:34.452812, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.452925, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:34.452947, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:34.452968, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:34.452988, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:34.453009, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.453028, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:34.453179, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[3] [0000] 00 00 00 00 14 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.453234, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000114-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.453323, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000114-0000-0000-ef53-8a9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:34.453546, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 14 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.453587, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:34.453609, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:34.453630, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:34.453650, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:34.453671, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.453690, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:34.453729, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:34.453752, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:34.453774, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.453793, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.453814, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.453834, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:34.453867, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:34.453889, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:34.453911, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.453934, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.453955, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.453975, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:34.454006, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:34.454028, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:34.454050, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.454199, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.454224, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.454244, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:34.454287, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:34.454310, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:34.454332, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.454352, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.454374, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.454393, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:34.454425, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:34.454447, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (8->9) [2014/08/16 20:14:34.454469, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.454489, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.454511, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.454534, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:34.454569, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:34.454592, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (9->10) [2014/08/16 20:14:34.454614, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.454634, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.454656, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:34.454675, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.454713, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (10->9) [2014/08/16 20:14:34.454736, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (9->8) [2014/08/16 20:14:34.454757, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:34.454777, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:34.454798, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:34.454818, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:34.454839, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[4] [0000] 00 00 00 00 15 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.454879, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000115-0000-0000-ef53-8a9f38040000 result : WERR_OK [2014/08/16 20:14:34.454968, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000115-0000-0000-ef53-8a9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:34.455266, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 15 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.455307, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.455328, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:34.455348, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' (ops 0x7ffd8125b800) [2014/08/16 20:14:34.455369, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.455401, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Description] len[2] [2014/08/16 20:14:34.455424, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Datatype] len[8] [2014/08/16 20:14:34.455446, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Default Priority] len[4] [2014/08/16 20:14:34.455468, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Port] len[38] [2014/08/16 20:14:34.455489, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Print Processor] len[18] [2014/08/16 20:14:34.455510, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Priority] len[4] [2014/08/16 20:14:34.455532, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Security] len[248] [2014/08/16 20:14:34.455553, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Share Name] len[26] [2014/08/16 20:14:34.455575, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[StartTime] len[4] [2014/08/16 20:14:34.455596, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[UntilTime] len[4] [2014/08/16 20:14:34.455621, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[Attributes] len[4] [2014/08/16 20:14:34.455643, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[Printer Driver] len[36] [2014/08/16 20:14:34.455665, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[Location] len[2] [2014/08/16 20:14:34.455687, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[13]: name[Parameters] len[2] [2014/08/16 20:14:34.455708, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[14]: name[Name] len[36] [2014/08/16 20:14:34.455729, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[15]: name[Separator File] len[2] [2014/08/16 20:14:34.455751, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[16]: name[Status] len[4] [2014/08/16 20:14:34.455773, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[17]: name[ChangeID] len[4] [2014/08/16 20:14:34.455796, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : NULL data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) result : WERR_OK [2014/08/16 20:14:34.455907, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000115-0000-0000-ef53-8a9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_BINARY (3) data : * data: ARRAY(0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:34.456208, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 15 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.456250, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:34.456273, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:34.456297, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : * data: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:34.458707, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000115-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.458777, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 15 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.458817, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 15 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.458859, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.458882, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:34.458903, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.458984, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000114-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.459049, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 14 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.459210, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 14 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.459258, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.459285, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:34.459314, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.459406, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000113-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.459472, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.459511, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 13 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.459549, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.459576, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:34.459597, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.459677, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000112-0000-0000-ef53-8a9f38040000 [2014/08/16 20:14:34.459743, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 12 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.459782, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 12 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.459820, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:34.459840, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:34.459873, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:34.459966, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:416(close_policy_by_pipe) Deleted handle list for RPC connection \winreg [2014/08/16 20:14:34.460004, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_GetPrinter: struct spoolss_GetPrinter out: struct spoolss_GetPrinter info : * info : union spoolss_PrinterInfo(case 4) info4: struct spoolss_PrinterInfo4 printername : * printername : '\\M1\SHARP MX-2600N PS' servername : * servername : '\\M1' attributes : 0x00001848 (6216) 0: PRINTER_ATTRIBUTE_QUEUED 0: PRINTER_ATTRIBUTE_DIRECT 0: PRINTER_ATTRIBUTE_DEFAULT 1: PRINTER_ATTRIBUTE_SHARED 0: PRINTER_ATTRIBUTE_NETWORK 0: PRINTER_ATTRIBUTE_HIDDEN 1: PRINTER_ATTRIBUTE_LOCAL 0: PRINTER_ATTRIBUTE_ENABLE_DEVQ 0: PRINTER_ATTRIBUTE_KEEPPRINTEDJOBS 0: PRINTER_ATTRIBUTE_DO_COMPLETE_FIRST 0: PRINTER_ATTRIBUTE_WORK_OFFLINE 1: PRINTER_ATTRIBUTE_ENABLE_BIDI 1: PRINTER_ATTRIBUTE_RAW_ONLY 0: PRINTER_ATTRIBUTE_PUBLISHED 0: PRINTER_ATTRIBUTE_FAX 0: PRINTER_ATTRIBUTE_TS needed : * needed : 0x00000050 (80) result : WERR_OK [2014/08/16 20:14:34.460382, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1417(api_rpcTNP) api_rpcTNP: called \spoolss successfully [2014/08/16 20:14:34.460415, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.460438, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 196 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 56 req->in.vector[4].iov_len = 212 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:34.460548, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:128(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: received 212 [2014/08/16 20:14:34.460571, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:149(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: issuing np_read_send of size 1024 [2014/08/16 20:14:34.460593, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:34.460615, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:347(read_from_internal_pipe) read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 168. [2014/08/16 20:14:34.460642, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00c0 (192) auth_length : 0x0000 (0) call_id : 0x00000004 (4) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=168 [0000] 04 00 02 00 98 00 00 00 6A 00 00 00 60 00 00 00 ........ j...`... [0010] 48 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 H....... ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 5C 00 5C 00 4D 00 31 00 ........ \.\.M.1. [0070] 00 00 5C 00 5C 00 4D 00 31 00 5C 00 53 00 48 00 ..\.\.M. 1.\.S.H. [0080] 41 00 52 00 50 00 20 00 4D 00 58 00 2D 00 32 00 A.R.P. . M.X.-.2. [0090] 36 00 30 00 30 00 4E 00 20 00 50 00 53 00 00 00 6.0.0.N. .P.S... [00A0] 50 00 00 00 00 00 00 00 P....... [2014/08/16 20:14:34.461016, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 57 [2014/08/16 20:14:34.461041, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 192 bytes. There is no more data outstanding [2014/08/16 20:14:34.461158, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:178(smbd_smb2_ioctl_pipe_read_done) smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = 192 is_data_outstanding = 0, status = NT_STATUS_OK [2014/08/16 20:14:34.461190, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:291(smbd_smb2_request_ioctl_done) smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned 192 status NT_STATUS_OK [2014/08/16 20:14:34.461213, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[48] dyn[yes:192] at ../source3/smbd/smb2_ioctl.c:358 [2014/08/16 20:14:34.461236, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/147/31 [2014/08/16 20:14:34.461667, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:34.461699, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 147 (position 147) from bitmap [2014/08/16 20:14:34.461722, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_IOCTL] mid = 147 [2014/08/16 20:14:34.461751, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.461775, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.462247, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.462337, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:34.462365, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 147, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:34.462387, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:394(smbd_smb2_ioctl_send) smbd_smb2_ioctl: ctl_code[0x0011c017] spoolss, fnum 2162169606 [2014/08/16 20:14:34.462411, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:59(smb2_ioctl_named_pipe) smbd_smb2_ioctl_send: np_write_send of size 152 [2014/08/16 20:14:34.462431, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 152 [2014/08/16 20:14:34.462452, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 152 [2014/08/16 20:14:34.462473, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 152 [2014/08/16 20:14:34.462493, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 152, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:34.462514, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:34.462534, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 136 [2014/08/16 20:14:34.462554, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 136 [2014/08/16 20:14:34.462575, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:34.462595, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 136 [2014/08/16 20:14:34.462615, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 136, incoming data = 136 [2014/08/16 20:14:34.462637, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:34.462661, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x00000005 (5) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) opnum : 0x0007 (7) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 04 00 00 00 04 00 00 00 00 00 02 00 8....... ........ [0020] 04 00 02 00 08 00 02 00 48 18 00 00 0D 00 00 00 ........ H....... [0030] 00 00 00 00 0D 00 00 00 53 00 48 00 4D 00 58 00 ........ S.H.M.X. [0040] 32 00 36 00 30 00 30 00 2D 00 36 00 5F 00 46 00 2.6.0.0. -.6._.F. [0050] 00 00 00 00 05 00 00 00 00 00 00 00 05 00 00 00 ........ ........ [0060] 5C 00 5C 00 4D 00 31 00 00 00 00 00 00 00 00 00 \.\.M.1. ........ [0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2014/08/16 20:14:34.463000, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 0 [2014/08/16 20:14:34.463022, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request) Checking request auth. [2014/08/16 20:14:34.463044, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.463163, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:34.463192, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:34.463589, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:34.463672, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1324(api_pipe_request) Requested \spoolss rpc service [2014/08/16 20:14:34.463695, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1356(api_rpcTNP) api_rpcTNP: \spoolss op 0x7 - api_rpcTNP: rpc command: SPOOLSS_SETPRINTER [2014/08/16 20:14:34.463717, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1390(api_rpcTNP) api_rpc_cmds[7].fn == 0x7ffd818a952e [2014/08/16 20:14:34.463745, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_SetPrinter: struct spoolss_SetPrinter in: struct spoolss_SetPrinter handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000010b-0000-0000-ef53-8a9f38040000 info_ctr : * info_ctr: struct spoolss_SetPrinterInfoCtr level : 0x00000004 (4) info : union spoolss_SetPrinterInfo(case 4) info4 : * info4: struct spoolss_SetPrinterInfo4 printername : * printername : 'SHMX2600-6_F' servername : * servername : '\\M1' attributes : 0x00001848 (6216) 0: PRINTER_ATTRIBUTE_QUEUED 0: PRINTER_ATTRIBUTE_DIRECT 0: PRINTER_ATTRIBUTE_DEFAULT 1: PRINTER_ATTRIBUTE_SHARED 0: PRINTER_ATTRIBUTE_NETWORK 0: PRINTER_ATTRIBUTE_HIDDEN 1: PRINTER_ATTRIBUTE_LOCAL 0: PRINTER_ATTRIBUTE_ENABLE_DEVQ 0: PRINTER_ATTRIBUTE_KEEPPRINTEDJOBS 0: PRINTER_ATTRIBUTE_DO_COMPLETE_FIRST 0: PRINTER_ATTRIBUTE_WORK_OFFLINE 1: PRINTER_ATTRIBUTE_ENABLE_BIDI 1: PRINTER_ATTRIBUTE_RAW_ONLY 0: PRINTER_ATTRIBUTE_PUBLISHED 0: PRINTER_ATTRIBUTE_FAX 0: PRINTER_ATTRIBUTE_TS devmode_ctr : * devmode_ctr: struct spoolss_DevmodeContainer _ndr_size : 0x00000000 (0) devmode : NULL secdesc_ctr : * secdesc_ctr: struct sec_desc_buf sd_size : 0x00000000 (0) sd : NULL command : SPOOLSS_PRINTER_CONTROL_UNPAUSE (0) [2014/08/16 20:14:34.464239, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 0B 01 00 00 00 00 00 00 EF 53 8A 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:34.464281, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_SetPrinter: struct spoolss_SetPrinter out: struct spoolss_SetPrinter result : WERR_UNKNOWN_LEVEL [2014/08/16 20:14:34.464321, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1417(api_rpcTNP) api_rpcTNP: called \spoolss successfully [2014/08/16 20:14:34.464348, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:34.464369, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 136 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 56 req->in.vector[4].iov_len = 152 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:34.464475, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:128(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: received 152 [2014/08/16 20:14:34.464497, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:149(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: issuing np_read_send of size 1024 [2014/08/16 20:14:34.464518, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:34.464540, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:347(read_from_internal_pipe) read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 4. [2014/08/16 20:14:34.464565, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x001c (28) auth_length : 0x0000 (0) call_id : 0x00000005 (5) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000004 (4) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=4 [0000] 7C 00 00 00 |... [2014/08/16 20:14:34.464755, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 29 [2014/08/16 20:14:34.464779, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 28 bytes. There is no more data outstanding [2014/08/16 20:14:34.464799, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:178(smbd_smb2_ioctl_pipe_read_done) smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = 28 is_data_outstanding = 0, status = NT_STATUS_OK [2014/08/16 20:14:34.464825, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:291(smbd_smb2_request_ioctl_done) smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned 28 status NT_STATUS_OK [2014/08/16 20:14:34.464847, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[48] dyn[yes:28] at ../source3/smbd/smb2_ioctl.c:358 [2014/08/16 20:14:34.464868, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/148/31 [2014/08/16 20:14:36.883489, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.883632, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 148 (position 148) from bitmap [2014/08/16 20:14:36.883687, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CREATE] mid = 148 [2014/08/16 20:14:36.883754, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.883808, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.884823, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.885049, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.885116, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:456(smbd_smb2_create_send) smbd_smb2_create: name[spoolss] [2014/08/16 20:14:36.885297, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.885360, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:36.885412, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 47E75E00 [2014/08/16 20:14:36.885472, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd84228f90 [2014/08/16 20:14:36.885565, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:695(smbXsrv_open_global_store) [2014/08/16 20:14:36.885599, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:697(smbXsrv_open_global_store) smbXsrv_open_global_store: key '47E75E00' stored [2014/08/16 20:14:36.885648, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &global_blob: struct smbXsrv_open_globalB version : SMBXSRV_VERSION_0 (0) seqnum : 0x00000001 (1) info : union smbXsrv_open_globalU(case 0) info0 : * info0: struct smbXsrv_open_global0 db_rec : * server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0x47e75e00 (1206345216) open_persistent_id : 0x0000000047e75e00 (1206345216) open_volatile_id : 0x000000001895cac0 (412469952) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:37 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 [2014/08/16 20:14:36.886288, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 47E75E00 [2014/08/16 20:14:36.886357, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.886404, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:36.886452, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:862(smbXsrv_open_create) [2014/08/16 20:14:36.886480, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:870(smbXsrv_open_create) smbXsrv_open_create: global_id (0x47e75e00) stored [2014/08/16 20:14:36.886524, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &open_blob: struct smbXsrv_openB version : SMBXSRV_VERSION_0 (0) reserved : 0x00000000 (0) info : union smbXsrv_openU(case 0) info0 : * info0: struct smbXsrv_open table : * db_rec : NULL local_id : 0x1895cac0 (412469952) global : * global: struct smbXsrv_open_global0 db_rec : NULL server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0x47e75e00 (1206345216) open_persistent_id : 0x0000000047e75e00 (1206345216) open_volatile_id : 0x000000001895cac0 (412469952) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:37 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 status : NT_STATUS_OK idle_time : Sa Aug 16 20:14:37 2014 CEST compat : NULL [2014/08/16 20:14:36.887355, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:128(file_new) allocated file structure fnum 412469952 (3 used) [2014/08/16 20:14:36.887413, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:716(file_name_hash) file_name_hash: /tmp/spoolss hash 0x7d4e46e5 [2014/08/16 20:14:36.887482, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \spoolss [2014/08/16 20:14:36.887538, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 19 for pipe \spoolss [2014/08/16 20:14:36.887675, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \spoolss [2014/08/16 20:14:36.887732, 8, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/dosmode.c:642(dos_mode) dos_mode: spoolss [2014/08/16 20:14:36.887797, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:1053(smbd_smb2_create_send) smbd_smb2_create_send: spoolss - fnum 412469952 [2014/08/16 20:14:36.887860, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[88] dyn[yes:0] at ../source3/smbd/smb2_create.c:374 [2014/08/16 20:14:36.887914, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/149/31 [2014/08/16 20:14:36.891787, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.891903, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 149 (position 149) from bitmap [2014/08/16 20:14:36.891958, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_WRITE] mid = 149 [2014/08/16 20:14:36.892021, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.892074, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.893052, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.893385, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.893449, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 149, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.893498, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_write.c:271(smbd_smb2_write_send) smbd_smb2_write: spoolss - fnum 412469952 [2014/08/16 20:14:36.893550, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 160 [2014/08/16 20:14:36.893597, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 160 [2014/08/16 20:14:36.893650, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 160 [2014/08/16 20:14:36.893698, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 160, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:36.893745, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:36.893789, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:36.893833, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 144 [2014/08/16 20:14:36.893880, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:36.893924, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:36.893967, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 144, incoming data = 144 [2014/08/16 20:14:36.894013, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:36.894073, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00a0 (160) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x03 (3) ctx_list: ARRAY(3) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) ctx_list: struct dcerpc_ctx_list context_id : 0x0001 (1) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 71710533-beba-4937-8319-b5dbef9ccc36 if_version : 0x00000001 (1) ctx_list: struct dcerpc_ctx_list context_id : 0x0002 (2) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 6cb71c2c-9812-4540-0300-000000000000 if_version : 0x00000001 (1) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:36.895334, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 11 [2014/08/16 20:14:36.895388, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:693(api_pipe_bind_req) api_pipe_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:36.895436, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:724(api_pipe_bind_req) api_pipe_bind_req: make response. 724 [2014/08/16 20:14:36.895481, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:342(check_bind_req) check_bind_req for \spoolss [2014/08/16 20:14:36.895531, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:349(check_bind_req) check_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:36.895578, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 20 for pipe \spoolss [2014/08/16 20:14:36.895645, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000053f0 (21488) secondary_address_size : 0x000e (14) secondary_address : '\PIPE\spoolss' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : 0x0000 (0) reason : 0x0000 (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:36.896356, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 144 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 160 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.896612, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:0] at ../source3/smbd/smb2_write.c:150 [2014/08/16 20:14:36.896668, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/150/31 [2014/08/16 20:14:36.897184, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.897298, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 150 (position 150) from bitmap [2014/08/16 20:14:36.897353, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_READ] mid = 150 [2014/08/16 20:14:36.897409, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.897460, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.898473, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.898681, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.898740, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 150, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.898789, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_read.c:439(smbd_smb2_read_send) smbd_smb2_read: spoolss - fnum 412469952 [2014/08/16 20:14:36.898841, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:36.898891, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:326(read_from_internal_pipe) read_from_pipe: \spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2014/08/16 20:14:36.898940, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 29 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 1 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.899307, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 68 bytes. There is no more data outstanding [2014/08/16 20:14:36.899367, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:68] at ../source3/smbd/smb2_read.c:154 [2014/08/16 20:14:36.899418, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/151/31 [2014/08/16 20:14:36.899901, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.899980, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 151 (position 151) from bitmap [2014/08/16 20:14:36.900032, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_IOCTL] mid = 151 [2014/08/16 20:14:36.900087, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.900139, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.901120, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.901444, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.901504, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 151, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.901554, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:394(smbd_smb2_ioctl_send) smbd_smb2_ioctl: ctl_code[0x0011c017] spoolss, fnum 412469952 [2014/08/16 20:14:36.901605, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:59(smb2_ioctl_named_pipe) smbd_smb2_ioctl_send: np_write_send of size 64 [2014/08/16 20:14:36.901651, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 64 [2014/08/16 20:14:36.901698, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 64 [2014/08/16 20:14:36.901743, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 64 [2014/08/16 20:14:36.901788, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 64, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:36.901834, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:36.901878, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 48 [2014/08/16 20:14:36.901924, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 48 [2014/08/16 20:14:36.901971, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:36.902015, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 48 [2014/08/16 20:14:36.902060, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 48, incoming data = 48 [2014/08/16 20:14:36.902118, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:36.902292, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0040 (64) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000028 (40) context_id : 0x0000 (0) opnum : 0x0023 (35) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=40 [0000] 00 00 02 00 05 00 00 00 00 00 00 00 05 00 00 00 ........ ........ [0010] 5C 00 5C 00 4D 00 31 00 00 00 00 00 02 00 00 00 \.\.M.1. ........ [0020] 00 00 00 00 00 00 00 00 ........ [2014/08/16 20:14:36.902859, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 0 [2014/08/16 20:14:36.902907, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request) Checking request auth. [2014/08/16 20:14:36.902955, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.903006, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.903055, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.904061, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.904380, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1324(api_pipe_request) Requested \spoolss rpc service [2014/08/16 20:14:36.904437, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1356(api_rpcTNP) api_rpcTNP: \spoolss op 0x23 - api_rpcTNP: rpc command: SPOOLSS_ENUMPORTS [2014/08/16 20:14:36.904487, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1390(api_rpcTNP) api_rpc_cmds[35].fn == 0x7ffd818ae7a4 [2014/08/16 20:14:36.904543, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_EnumPorts: struct spoolss_EnumPorts in: struct spoolss_EnumPorts servername : * servername : '\\M1' level : 0x00000002 (2) buffer : NULL offered : 0x00000000 (0) [2014/08/16 20:14:36.904703, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:8045(_spoolss_EnumPorts) _spoolss_EnumPorts [2014/08/16 20:14:36.904754, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:8006(enumports_level_2) Filling port number [0] with port [Samba Printer Port] [2014/08/16 20:14:36.904819, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_EnumPorts: struct spoolss_EnumPorts out: struct spoolss_EnumPorts count : * count : 0x00000000 (0) info : * info : NULL needed : * needed : 0x00000078 (120) result : WERR_INSUFFICIENT_BUFFER [2014/08/16 20:14:36.905021, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1417(api_rpcTNP) api_rpcTNP: called \spoolss successfully [2014/08/16 20:14:36.905080, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.905129, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 48 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 56 req->in.vector[4].iov_len = 64 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.905457, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:128(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: received 64 [2014/08/16 20:14:36.905493, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:149(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: issuing np_read_send of size 1024 [2014/08/16 20:14:36.905521, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:36.905550, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:347(read_from_internal_pipe) read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 16. [2014/08/16 20:14:36.905583, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0028 (40) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000010 (16) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=16 [0000] 00 00 00 00 78 00 00 00 00 00 00 00 7A 00 00 00 ....x... ....z... [2014/08/16 20:14:36.905833, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 1449 [2014/08/16 20:14:36.905866, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 40 bytes. There is no more data outstanding [2014/08/16 20:14:36.905893, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:178(smbd_smb2_ioctl_pipe_read_done) smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = 40 is_data_outstanding = 0, status = NT_STATUS_OK [2014/08/16 20:14:36.905922, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:291(smbd_smb2_request_ioctl_done) smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned 40 status NT_STATUS_OK [2014/08/16 20:14:36.905949, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[48] dyn[yes:40] at ../source3/smbd/smb2_ioctl.c:358 [2014/08/16 20:14:36.905977, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/152/31 [2014/08/16 20:14:36.906335, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.906381, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 152 (position 152) from bitmap [2014/08/16 20:14:36.906410, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CLOSE] mid = 152 [2014/08/16 20:14:36.906442, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.906471, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.906976, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.907087, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.907120, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_close.c:185(smbd_smb2_close) smbd_smb2_close: spoolss - fnum 412469952 [2014/08/16 20:14:36.907152, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.907293, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:36.907325, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 47E75E00 [2014/08/16 20:14:36.907360, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd8421ff50 [2014/08/16 20:14:36.907396, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 47E75E00 [2014/08/16 20:14:36.907424, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.907450, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:36.907485, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:528(file_free) freed files structure 412469952 (2 used) [2014/08/16 20:14:36.907522, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[60] dyn[no:0] at ../source3/smbd/smb2_close.c:144 [2014/08/16 20:14:36.907552, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/153/31 [2014/08/16 20:14:36.908497, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.908548, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 153 (position 153) from bitmap [2014/08/16 20:14:36.908578, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CREATE] mid = 153 [2014/08/16 20:14:36.908611, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.908641, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.909140, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.909350, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.909386, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:456(smbd_smb2_create_send) smbd_smb2_create: name[spoolss] [2014/08/16 20:14:36.909429, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.909457, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:36.909485, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 09912152 [2014/08/16 20:14:36.909516, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd84228f90 [2014/08/16 20:14:36.909568, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:695(smbXsrv_open_global_store) [2014/08/16 20:14:36.909588, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:697(smbXsrv_open_global_store) smbXsrv_open_global_store: key '09912152' stored [2014/08/16 20:14:36.909615, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &global_blob: struct smbXsrv_open_globalB version : SMBXSRV_VERSION_0 (0) seqnum : 0x00000001 (1) info : union smbXsrv_open_globalU(case 0) info0 : * info0: struct smbXsrv_open_global0 db_rec : * server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0x09912152 (160506194) open_persistent_id : 0x0000000009912152 (160506194) open_volatile_id : 0x000000008ebeed70 (2394877296) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:37 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 [2014/08/16 20:14:36.909908, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 09912152 [2014/08/16 20:14:36.909937, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.909963, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:36.909989, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:862(smbXsrv_open_create) [2014/08/16 20:14:36.910005, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:870(smbXsrv_open_create) smbXsrv_open_create: global_id (0x09912152) stored [2014/08/16 20:14:36.910030, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &open_blob: struct smbXsrv_openB version : SMBXSRV_VERSION_0 (0) reserved : 0x00000000 (0) info : union smbXsrv_openU(case 0) info0 : * info0: struct smbXsrv_open table : * db_rec : NULL local_id : 0x8ebeed70 (2394877296) global : * global: struct smbXsrv_open_global0 db_rec : NULL server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0x09912152 (160506194) open_persistent_id : 0x0000000009912152 (160506194) open_volatile_id : 0x000000008ebeed70 (2394877296) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:37 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 status : NT_STATUS_OK idle_time : Sa Aug 16 20:14:37 2014 CEST compat : NULL [2014/08/16 20:14:36.910528, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:128(file_new) allocated file structure fnum 2394877296 (3 used) [2014/08/16 20:14:36.910560, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:716(file_name_hash) file_name_hash: /tmp/spoolss hash 0x7d4e46e5 [2014/08/16 20:14:36.910597, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \spoolss [2014/08/16 20:14:36.910630, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 20 for pipe \spoolss [2014/08/16 20:14:36.910705, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \spoolss [2014/08/16 20:14:36.910737, 8, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/dosmode.c:642(dos_mode) dos_mode: spoolss [2014/08/16 20:14:36.910773, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:1053(smbd_smb2_create_send) smbd_smb2_create_send: spoolss - fnum 2394877296 [2014/08/16 20:14:36.910806, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[88] dyn[yes:0] at ../source3/smbd/smb2_create.c:374 [2014/08/16 20:14:36.910836, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/154/31 [2014/08/16 20:14:36.911201, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.911267, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 154 (position 154) from bitmap [2014/08/16 20:14:36.911299, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_WRITE] mid = 154 [2014/08/16 20:14:36.911338, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.911368, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.911867, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.911976, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.912008, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 154, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.912035, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_write.c:271(smbd_smb2_write_send) smbd_smb2_write: spoolss - fnum 2394877296 [2014/08/16 20:14:36.912064, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 160 [2014/08/16 20:14:36.912091, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 160 [2014/08/16 20:14:36.912116, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 160 [2014/08/16 20:14:36.912142, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 160, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:36.912288, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:36.912318, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:36.912343, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 144 [2014/08/16 20:14:36.912370, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:36.912395, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:36.912420, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 144, incoming data = 144 [2014/08/16 20:14:36.912446, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:36.912479, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00a0 (160) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x03 (3) ctx_list: ARRAY(3) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) ctx_list: struct dcerpc_ctx_list context_id : 0x0001 (1) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 71710533-beba-4937-8319-b5dbef9ccc36 if_version : 0x00000001 (1) ctx_list: struct dcerpc_ctx_list context_id : 0x0002 (2) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 6cb71c2c-9812-4540-0300-000000000000 if_version : 0x00000001 (1) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:36.913049, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 11 [2014/08/16 20:14:36.913077, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:693(api_pipe_bind_req) api_pipe_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:36.913104, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:724(api_pipe_bind_req) api_pipe_bind_req: make response. 724 [2014/08/16 20:14:36.913130, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:342(check_bind_req) check_bind_req for \spoolss [2014/08/16 20:14:36.913257, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:349(check_bind_req) check_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:36.913294, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 21 for pipe \spoolss [2014/08/16 20:14:36.913333, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000053f0 (21488) secondary_address_size : 0x000e (14) secondary_address : '\PIPE\spoolss' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : 0x0000 (0) reason : 0x0000 (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:36.913664, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 144 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 160 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.913801, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:0] at ../source3/smbd/smb2_write.c:150 [2014/08/16 20:14:36.913849, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/155/31 [2014/08/16 20:14:36.914189, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.914256, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 155 (position 155) from bitmap [2014/08/16 20:14:36.914288, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_READ] mid = 155 [2014/08/16 20:14:36.914321, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.914350, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.914850, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.914960, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.914991, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 155, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.915028, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_read.c:439(smbd_smb2_read_send) smbd_smb2_read: spoolss - fnum 2394877296 [2014/08/16 20:14:36.915060, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:36.915089, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:326(read_from_internal_pipe) read_from_pipe: \spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2014/08/16 20:14:36.915117, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 29 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 1 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.915369, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 68 bytes. There is no more data outstanding [2014/08/16 20:14:36.915402, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:68] at ../source3/smbd/smb2_read.c:154 [2014/08/16 20:14:36.915431, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/156/31 [2014/08/16 20:14:36.915737, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.915783, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 156 (position 156) from bitmap [2014/08/16 20:14:36.915812, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_IOCTL] mid = 156 [2014/08/16 20:14:36.915844, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.915873, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.916457, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.916569, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.916601, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 156, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.916629, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:394(smbd_smb2_ioctl_send) smbd_smb2_ioctl: ctl_code[0x0011c017] spoolss, fnum 2394877296 [2014/08/16 20:14:36.916658, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:59(smb2_ioctl_named_pipe) smbd_smb2_ioctl_send: np_write_send of size 260 [2014/08/16 20:14:36.916684, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 260 [2014/08/16 20:14:36.916710, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 260 [2014/08/16 20:14:36.916736, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 260 [2014/08/16 20:14:36.916762, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 260, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:36.916788, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:36.916814, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 244 [2014/08/16 20:14:36.916838, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 244 [2014/08/16 20:14:36.916865, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:36.916890, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 244 [2014/08/16 20:14:36.916915, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 244, incoming data = 244 [2014/08/16 20:14:36.916942, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:36.916978, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0104 (260) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000000ec (236) context_id : 0x0000 (0) opnum : 0x0023 (35) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=236 [0000] 00 00 02 00 05 00 00 00 00 00 00 00 05 00 00 00 ........ ........ [0010] 5C 00 5C 00 4D 00 31 00 00 00 00 00 02 00 00 00 \.\.M.1. ........ [0020] 04 00 02 00 C0 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0080] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0090] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00E0] 00 00 00 00 00 00 00 00 C0 00 00 00 ........ .... [2014/08/16 20:14:36.917658, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 0 [2014/08/16 20:14:36.917687, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request) Checking request auth. [2014/08/16 20:14:36.917714, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.917744, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.917771, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.918377, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.918487, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1324(api_pipe_request) Requested \spoolss rpc service [2014/08/16 20:14:36.918518, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1356(api_rpcTNP) api_rpcTNP: \spoolss op 0x23 - api_rpcTNP: rpc command: SPOOLSS_ENUMPORTS [2014/08/16 20:14:36.918546, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1390(api_rpcTNP) api_rpc_cmds[35].fn == 0x7ffd818ae7a4 [2014/08/16 20:14:36.918578, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_EnumPorts: struct spoolss_EnumPorts in: struct spoolss_EnumPorts servername : * servername : '\\M1' level : 0x00000002 (2) buffer : * buffer : DATA_BLOB length=192 [0000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0010] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0080] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0090] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ offered : 0x000000c0 (192) [2014/08/16 20:14:36.918937, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:8045(_spoolss_EnumPorts) _spoolss_EnumPorts [2014/08/16 20:14:36.918966, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:8006(enumports_level_2) Filling port number [0] with port [Samba Printer Port] [2014/08/16 20:14:36.919002, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_EnumPorts: struct spoolss_EnumPorts out: struct spoolss_EnumPorts count : * count : 0x00000001 (1) info : * info : * info: ARRAY(1) info : union spoolss_PortInfo(case 2) info2: struct spoolss_PortInfo2 port_name : * port_name : 'Samba Printer Port' monitor_name : * monitor_name : 'Local Monitor' description : * description : 'Local Port' port_type : 0x00000001 (1) 1: SPOOLSS_PORT_TYPE_WRITE 0: SPOOLSS_PORT_TYPE_READ 0: SPOOLSS_PORT_TYPE_REDIRECTED 0: SPOOLSS_PORT_TYPE_NET_ATTACHED reserved : 0x00000000 (0) needed : * needed : 0x00000078 (120) result : WERR_OK [2014/08/16 20:14:36.919400, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1417(api_rpcTNP) api_rpcTNP: called \spoolss successfully [2014/08/16 20:14:36.919439, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.919467, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 244 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 56 req->in.vector[4].iov_len = 260 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.919603, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:128(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: received 260 [2014/08/16 20:14:36.919632, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:149(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: issuing np_read_send of size 1024 [2014/08/16 20:14:36.919660, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:36.919687, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:347(read_from_internal_pipe) read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 212. [2014/08/16 20:14:36.919720, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00ec (236) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000d4 (212) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=212 [0000] 08 00 02 00 C0 00 00 00 9A 00 00 00 7E 00 00 00 ........ ....~... [0010] 68 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 h....... ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0070] 4C 00 6F 00 63 00 61 00 6C 00 20 00 50 00 6F 00 L.o.c.a. l. .P.o. [0080] 72 00 74 00 00 00 4C 00 6F 00 63 00 61 00 6C 00 r.t...L. o.c.a.l. [0090] 20 00 4D 00 6F 00 6E 00 69 00 74 00 6F 00 72 00 .M.o.n. i.t.o.r. [00A0] 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 50 00 ..S.a.m. b.a. .P. [00B0] 72 00 69 00 6E 00 74 00 65 00 72 00 20 00 50 00 r.i.n.t. e.r. .P. [00C0] 6F 00 72 00 74 00 00 00 78 00 00 00 01 00 00 00 o.r.t... x....... [00D0] 00 00 00 00 .... [2014/08/16 20:14:36.920357, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 1449 [2014/08/16 20:14:36.920394, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 236 bytes. There is no more data outstanding [2014/08/16 20:14:36.920421, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:178(smbd_smb2_ioctl_pipe_read_done) smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = 236 is_data_outstanding = 0, status = NT_STATUS_OK [2014/08/16 20:14:36.920450, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:291(smbd_smb2_request_ioctl_done) smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned 236 status NT_STATUS_OK [2014/08/16 20:14:36.920477, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[48] dyn[yes:236] at ../source3/smbd/smb2_ioctl.c:358 [2014/08/16 20:14:36.920505, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/157/31 [2014/08/16 20:14:36.920827, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.920872, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 157 (position 157) from bitmap [2014/08/16 20:14:36.920902, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CLOSE] mid = 157 [2014/08/16 20:14:36.920934, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.920964, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.921543, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.921654, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.921688, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_close.c:185(smbd_smb2_close) smbd_smb2_close: spoolss - fnum 2394877296 [2014/08/16 20:14:36.921720, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.921747, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:36.921775, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 09912152 [2014/08/16 20:14:36.921808, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd8421ff50 [2014/08/16 20:14:36.921842, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 09912152 [2014/08/16 20:14:36.921870, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.921896, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:36.921930, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:528(file_free) freed files structure 2394877296 (2 used) [2014/08/16 20:14:36.921961, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[60] dyn[no:0] at ../source3/smbd/smb2_close.c:144 [2014/08/16 20:14:36.921990, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/158/31 [2014/08/16 20:14:36.922869, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.922916, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 158 (position 158) from bitmap [2014/08/16 20:14:36.922945, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CREATE] mid = 158 [2014/08/16 20:14:36.922978, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.923007, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.923581, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.923693, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.923727, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:456(smbd_smb2_create_send) smbd_smb2_create: name[spoolss] [2014/08/16 20:14:36.923763, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.923791, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:36.923826, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key CD76BAB3 [2014/08/16 20:14:36.923858, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd84228f90 [2014/08/16 20:14:36.923908, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:695(smbXsrv_open_global_store) [2014/08/16 20:14:36.923927, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:697(smbXsrv_open_global_store) smbXsrv_open_global_store: key 'CD76BAB3' stored [2014/08/16 20:14:36.923954, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &global_blob: struct smbXsrv_open_globalB version : SMBXSRV_VERSION_0 (0) seqnum : 0x00000001 (1) info : union smbXsrv_open_globalU(case 0) info0 : * info0: struct smbXsrv_open_global0 db_rec : * server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0xcd76bab3 (3447110323) open_persistent_id : 0x00000000cd76bab3 (3447110323) open_volatile_id : 0x0000000001220572 (19006834) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:37 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 [2014/08/16 20:14:36.924356, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key CD76BAB3 [2014/08/16 20:14:36.924388, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.924414, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:36.924442, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:862(smbXsrv_open_create) [2014/08/16 20:14:36.924457, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:870(smbXsrv_open_create) smbXsrv_open_create: global_id (0xcd76bab3) stored [2014/08/16 20:14:36.924483, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &open_blob: struct smbXsrv_openB version : SMBXSRV_VERSION_0 (0) reserved : 0x00000000 (0) info : union smbXsrv_openU(case 0) info0 : * info0: struct smbXsrv_open table : * db_rec : NULL local_id : 0x01220572 (19006834) global : * global: struct smbXsrv_open_global0 db_rec : NULL server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0xcd76bab3 (3447110323) open_persistent_id : 0x00000000cd76bab3 (3447110323) open_volatile_id : 0x0000000001220572 (19006834) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:37 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 status : NT_STATUS_OK idle_time : Sa Aug 16 20:14:37 2014 CEST compat : NULL [2014/08/16 20:14:36.924869, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:128(file_new) allocated file structure fnum 19006834 (3 used) [2014/08/16 20:14:36.924900, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:716(file_name_hash) file_name_hash: /tmp/spoolss hash 0x7d4e46e5 [2014/08/16 20:14:36.924936, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \spoolss [2014/08/16 20:14:36.924968, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 21 for pipe \spoolss [2014/08/16 20:14:36.925041, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \spoolss [2014/08/16 20:14:36.925073, 8, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/dosmode.c:642(dos_mode) dos_mode: spoolss [2014/08/16 20:14:36.925109, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:1053(smbd_smb2_create_send) smbd_smb2_create_send: spoolss - fnum 19006834 [2014/08/16 20:14:36.925142, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[88] dyn[yes:0] at ../source3/smbd/smb2_create.c:374 [2014/08/16 20:14:36.925281, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/159/31 [2014/08/16 20:14:36.925622, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.925668, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 159 (position 159) from bitmap [2014/08/16 20:14:36.925697, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_WRITE] mid = 159 [2014/08/16 20:14:36.925730, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.925759, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.926352, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.926464, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.926497, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 159, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.926525, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_write.c:271(smbd_smb2_write_send) smbd_smb2_write: spoolss - fnum 19006834 [2014/08/16 20:14:36.926554, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 160 [2014/08/16 20:14:36.926580, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 160 [2014/08/16 20:14:36.926606, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 160 [2014/08/16 20:14:36.926632, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 160, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:36.926658, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:36.926683, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:36.926713, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 144 [2014/08/16 20:14:36.926740, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:36.926765, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:36.926790, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 144, incoming data = 144 [2014/08/16 20:14:36.926816, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:36.926849, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00a0 (160) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x03 (3) ctx_list: ARRAY(3) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) ctx_list: struct dcerpc_ctx_list context_id : 0x0001 (1) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 71710533-beba-4937-8319-b5dbef9ccc36 if_version : 0x00000001 (1) ctx_list: struct dcerpc_ctx_list context_id : 0x0002 (2) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 6cb71c2c-9812-4540-0300-000000000000 if_version : 0x00000001 (1) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:36.927529, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 11 [2014/08/16 20:14:36.927560, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:693(api_pipe_bind_req) api_pipe_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:36.927587, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:724(api_pipe_bind_req) api_pipe_bind_req: make response. 724 [2014/08/16 20:14:36.927613, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:342(check_bind_req) check_bind_req for \spoolss [2014/08/16 20:14:36.927641, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:349(check_bind_req) check_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:36.927667, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 22 for pipe \spoolss [2014/08/16 20:14:36.927704, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000053f0 (21488) secondary_address_size : 0x000e (14) secondary_address : '\PIPE\spoolss' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : 0x0000 (0) reason : 0x0000 (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:36.928036, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 144 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 160 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.928284, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:0] at ../source3/smbd/smb2_write.c:150 [2014/08/16 20:14:36.928318, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/160/31 [2014/08/16 20:14:36.928613, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.928659, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 160 (position 160) from bitmap [2014/08/16 20:14:36.928688, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_READ] mid = 160 [2014/08/16 20:14:36.928720, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.928749, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.929338, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.929450, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.929483, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 160, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.929511, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_read.c:439(smbd_smb2_read_send) smbd_smb2_read: spoolss - fnum 19006834 [2014/08/16 20:14:36.929541, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:36.929569, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:326(read_from_internal_pipe) read_from_pipe: \spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2014/08/16 20:14:36.929603, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 29 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 1 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.929740, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 68 bytes. There is no more data outstanding [2014/08/16 20:14:36.929770, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:68] at ../source3/smbd/smb2_read.c:154 [2014/08/16 20:14:36.929799, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/161/31 [2014/08/16 20:14:36.930139, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.930184, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 161 (position 161) from bitmap [2014/08/16 20:14:36.930213, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_IOCTL] mid = 161 [2014/08/16 20:14:36.930273, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.930304, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.930813, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.930922, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.930953, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 161, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.930981, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:394(smbd_smb2_ioctl_send) smbd_smb2_ioctl: ctl_code[0x0011c017] spoolss, fnum 19006834 [2014/08/16 20:14:36.931010, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:59(smb2_ioctl_named_pipe) smbd_smb2_ioctl_send: np_write_send of size 68 [2014/08/16 20:14:36.931036, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 68 [2014/08/16 20:14:36.931062, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 68 [2014/08/16 20:14:36.931087, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 68 [2014/08/16 20:14:36.931113, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 68, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:36.931139, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:36.931274, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 52 [2014/08/16 20:14:36.931305, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 52 [2014/08/16 20:14:36.931332, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:36.931357, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 52 [2014/08/16 20:14:36.931382, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 52, incoming data = 52 [2014/08/16 20:14:36.931408, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:36.931439, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000002c (44) context_id : 0x0000 (0) opnum : 0x0000 (0) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=44 [0000] 08 00 00 00 00 00 02 00 05 00 00 00 00 00 00 00 ........ ........ [0010] 05 00 00 00 5C 00 5C 00 4D 00 31 00 00 00 00 00 ....\.\. M.1..... [0020] 05 00 00 00 00 00 00 00 00 00 00 00 ........ .... [2014/08/16 20:14:36.931755, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 0 [2014/08/16 20:14:36.931781, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request) Checking request auth. [2014/08/16 20:14:36.931808, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.931837, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.931864, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.932466, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.932580, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1324(api_pipe_request) Requested \spoolss rpc service [2014/08/16 20:14:36.932611, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1356(api_rpcTNP) api_rpcTNP: \spoolss op 0x0 - api_rpcTNP: rpc command: SPOOLSS_ENUMPRINTERS [2014/08/16 20:14:36.932639, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1390(api_rpcTNP) api_rpc_cmds[0].fn == 0x7ffd818a7f8c [2014/08/16 20:14:36.932671, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_EnumPrinters: struct spoolss_EnumPrinters in: struct spoolss_EnumPrinters flags : 0x00000008 (8) 0: PRINTER_ENUM_DEFAULT 0: PRINTER_ENUM_LOCAL 0: PRINTER_ENUM_CONNECTIONS 0: PRINTER_ENUM_FAVORITE 1: PRINTER_ENUM_NAME 0: PRINTER_ENUM_REMOTE 0: PRINTER_ENUM_SHARED 0: PRINTER_ENUM_NETWORK 0: PRINTER_ENUM_EXPAND 0: PRINTER_ENUM_CONTAINER 0: PRINTER_ENUM_ICON1 0: PRINTER_ENUM_ICON2 0: PRINTER_ENUM_ICON3 0: PRINTER_ENUM_ICON4 0: PRINTER_ENUM_ICON5 0: PRINTER_ENUM_ICON6 0: PRINTER_ENUM_ICON7 0: PRINTER_ENUM_ICON8 0: PRINTER_ENUM_HIDE server : * server : '\\M1' level : 0x00000005 (5) buffer : NULL offered : 0x00000000 (0) [2014/08/16 20:14:36.932964, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:4679(_spoolss_EnumPrinters) _spoolss_EnumPrinters [2014/08/16 20:14:36.932991, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:4657(enumprinters_level5) enum_all_printers_info_5 [2014/08/16 20:14:36.933018, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:4337(enum_all_printers_info_level) Found a printer in smb.conf: SHMX2600-6_SW[5] [2014/08/16 20:14:36.933052, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \winreg [2014/08/16 20:14:36.933083, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:221(init_pipe_handles) init_pipe_handle_list: created handle list for pipe \winreg [2014/08/16 20:14:36.933111, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe \winreg [2014/08/16 20:14:36.933264, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \winreg [2014/08/16 20:14:36.933316, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.933466, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:36.933496, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.933524, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:36.933551, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.933577, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:36.933602, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:36.933701, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.933731, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:36.933760, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:36.933786, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:36.933813, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.933838, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:36.933892, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 16 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.933946, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000116-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.934065, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000116-0000-0000-ef53-8c9f38040000 keyname: struct winreg_String name_len : 0x0094 (148) name_size : 0x0094 (148) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.934466, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 16 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.934522, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:36.934549, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:36.934577, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:36.934603, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:36.934631, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.934655, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:36.934705, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:36.934734, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:36.934762, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.934787, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.934814, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.934839, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.934882, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:36.934911, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:36.934938, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.934964, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.934991, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.935020, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.935061, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:36.935089, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:36.935117, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.935142, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.935294, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.935323, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.935374, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:36.935397, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:36.935419, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.935439, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.935461, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.935480, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.935511, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:36.935534, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:36.935555, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.935575, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.935597, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.935616, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.935653, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_SW] [2014/08/16 20:14:36.935679, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:36.935702, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.935722, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.935744, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.935764, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.935803, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:36.935826, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:36.935847, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:36.935867, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:36.935888, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:36.935908, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:36.935929, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 17 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.935969, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000117-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.936050, 2, pid=1080, effective(0, 10000), real(0, 0)] ../source3/rpc_client/cli_winreg_spoolss.c:626(winreg_create_printer) winreg_create_printer: Skipping, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW already exists [2014/08/16 20:14:36.936080, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000117-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.936146, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 17 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.936311, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 17 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.936351, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.936372, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:36.936393, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.936477, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000116-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.936552, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 16 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.936592, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 16 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.936631, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.936652, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:36.936683, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.936776, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.936892, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:36.936919, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.936941, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:36.936962, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.936982, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:36.937002, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:36.937062, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.937086, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:36.937108, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:36.937129, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:36.937150, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.937271, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:36.937314, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 18 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.937357, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000118-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.937449, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000118-0000-0000-ef53-8c9f38040000 keyname: struct winreg_String name_len : 0x0094 (148) name_size : 0x0094 (148) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.937679, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 18 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.937722, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:36.937743, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:36.937765, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:36.937785, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:36.937806, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.937826, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:36.937863, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:36.937887, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:36.937909, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.937930, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.937951, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.937971, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.938005, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:36.938027, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:36.938050, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.938070, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.938091, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.938111, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.938146, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:36.938272, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:36.938297, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.938318, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.938340, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.938360, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.938404, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:36.938428, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:36.938450, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.938471, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.938493, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.938513, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.938545, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:36.938568, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:36.938590, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.938611, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.938634, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.938653, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.938690, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_SW] [2014/08/16 20:14:36.938713, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:36.938739, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.938761, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.938784, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.938804, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.938844, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:36.938867, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:36.938889, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:36.938910, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:36.938932, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:36.938953, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:36.938975, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.939015, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.939106, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey in: struct winreg_QueryInfoKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL [2014/08/16 20:14:36.939323, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.939368, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' (ops 0x7ffd8125b800) [2014/08/16 20:14:36.939394, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.939428, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Attributes] len[4] [2014/08/16 20:14:36.939452, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Description] len[2] [2014/08/16 20:14:36.939475, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Datatype] len[8] [2014/08/16 20:14:36.939497, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Default Priority] len[4] [2014/08/16 20:14:36.939519, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Port] len[38] [2014/08/16 20:14:36.939541, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Name] len[28] [2014/08/16 20:14:36.939563, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Print Processor] len[18] [2014/08/16 20:14:36.939585, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Priority] len[4] [2014/08/16 20:14:36.939608, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[Security] len[248] [2014/08/16 20:14:36.939630, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[Share Name] len[28] [2014/08/16 20:14:36.939653, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[StartTime] len[4] [2014/08/16 20:14:36.939675, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[UntilTime] len[4] [2014/08/16 20:14:36.939697, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[ChangeID] len[4] [2014/08/16 20:14:36.939720, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:2074(regdb_get_secdesc) regdb_get_secdesc: Getting secdesc of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.939753, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey out: struct winreg_QueryInfoKey classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL num_subkeys : * num_subkeys : 0x00000003 (3) max_subkeylen : * max_subkeylen : 0x00000022 (34) max_classlen : * max_classlen : 0x00000000 (0) num_values : * num_values : 0x0000000d (13) max_valnamelen : * max_valnamelen : 0x00000022 (34) max_valbufsize : * max_valbufsize : 0x000000f8 (248) secdescsize : * secdescsize : 0x00000078 (120) last_changed_time : * last_changed_time : NTTIME(0) result : WERR_OK [2014/08/16 20:14:36.939996, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000000 (0) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.940307, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.940350, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.940374, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Attributes' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x48 (72) [1] : 0x10 (16) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.940585, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000001 (1) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.940781, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.940822, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.940845, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0018 (24) size : 0x0024 (36) name : * name : 'Description' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:36.941032, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000002 (2) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.941329, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.941375, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.941399, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Datatype' type : * type : REG_SZ (1) value : * value: ARRAY(8) [0] : 0x52 (82) [1] : 0x00 (0) [2] : 0x41 (65) [3] : 0x00 (0) [4] : 0x57 (87) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) size : * size : 0x00000008 (8) length : * length : 0x00000008 (8) result : WERR_OK [2014/08/16 20:14:36.941639, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000003 (3) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.941831, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.941871, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.941894, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0022 (34) size : 0x0024 (36) name : * name : 'Default Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.942105, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000004 (4) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.942415, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.942457, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.942480, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Port' type : * type : REG_SZ (1) value : * value: ARRAY(38) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x61 (97) [3] : 0x00 (0) [4] : 0x6d (109) [5] : 0x00 (0) [6] : 0x62 (98) [7] : 0x00 (0) [8] : 0x61 (97) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x50 (80) [13] : 0x00 (0) [14] : 0x72 (114) [15] : 0x00 (0) [16] : 0x69 (105) [17] : 0x00 (0) [18] : 0x6e (110) [19] : 0x00 (0) [20] : 0x74 (116) [21] : 0x00 (0) [22] : 0x65 (101) [23] : 0x00 (0) [24] : 0x72 (114) [25] : 0x00 (0) [26] : 0x20 (32) [27] : 0x00 (0) [28] : 0x50 (80) [29] : 0x00 (0) [30] : 0x6f (111) [31] : 0x00 (0) [32] : 0x72 (114) [33] : 0x00 (0) [34] : 0x74 (116) [35] : 0x00 (0) [36] : 0x00 (0) [37] : 0x00 (0) size : * size : 0x00000026 (38) length : * length : 0x00000026 (38) result : WERR_OK [2014/08/16 20:14:36.942960, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000005 (5) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.943146, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.943308, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.943333, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Name' type : * type : REG_SZ (1) value : * value: ARRAY(28) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x4d (77) [5] : 0x00 (0) [6] : 0x58 (88) [7] : 0x00 (0) [8] : 0x32 (50) [9] : 0x00 (0) [10] : 0x36 (54) [11] : 0x00 (0) [12] : 0x30 (48) [13] : 0x00 (0) [14] : 0x30 (48) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x36 (54) [19] : 0x00 (0) [20] : 0x5f (95) [21] : 0x00 (0) [22] : 0x53 (83) [23] : 0x00 (0) [24] : 0x57 (87) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x00 (0) size : * size : 0x0000001c (28) length : * length : 0x0000001c (28) result : WERR_OK [2014/08/16 20:14:36.943814, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000006 (6) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.944064, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.944103, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.944126, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0020 (32) size : 0x0024 (36) name : * name : 'Print Processor' type : * type : REG_SZ (1) value : * value: ARRAY(18) [0] : 0x77 (119) [1] : 0x00 (0) [2] : 0x69 (105) [3] : 0x00 (0) [4] : 0x6e (110) [5] : 0x00 (0) [6] : 0x70 (112) [7] : 0x00 (0) [8] : 0x72 (114) [9] : 0x00 (0) [10] : 0x69 (105) [11] : 0x00 (0) [12] : 0x6e (110) [13] : 0x00 (0) [14] : 0x74 (116) [15] : 0x00 (0) [16] : 0x00 (0) [17] : 0x00 (0) size : * size : 0x00000012 (18) length : * length : 0x00000012 (18) result : WERR_OK [2014/08/16 20:14:36.944609, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000007 (7) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.944809, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.944852, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.944876, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.945089, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000008 (8) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.945388, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.945432, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.945456, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Security' type : * type : REG_BINARY (3) value : * value: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) size : * size : 0x000000f8 (248) length : * length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:36.948072, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x00000009 (9) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.948426, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.948477, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.948506, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Share Name' type : * type : REG_SZ (1) value : * value: ARRAY(28) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x4d (77) [5] : 0x00 (0) [6] : 0x58 (88) [7] : 0x00 (0) [8] : 0x32 (50) [9] : 0x00 (0) [10] : 0x36 (54) [11] : 0x00 (0) [12] : 0x30 (48) [13] : 0x00 (0) [14] : 0x30 (48) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x36 (54) [19] : 0x00 (0) [20] : 0x5f (95) [21] : 0x00 (0) [22] : 0x53 (83) [23] : 0x00 (0) [24] : 0x57 (87) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x00 (0) size : * size : 0x0000001c (28) length : * length : 0x0000001c (28) result : WERR_OK [2014/08/16 20:14:36.948929, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000a (10) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.949126, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.949270, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.949297, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'StartTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.949516, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000b (11) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.949713, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.949755, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.949778, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'UntilTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.949988, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000c (12) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.950294, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.950338, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.950362, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'ChangeID' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0xcc (204) [1] : 0x9c (156) [2] : 0x03 (3) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.950604, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0020 (32) name_size : 0x0020 (32) name : * name : 'Default DevMode' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:36.950788, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.950834, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.950856, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:36.950880, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:316(_winreg_QueryValue) _winreg_QueryValue: reg_queryvalue failed with: WERR_BADFILE [2014/08/16 20:14:36.950902, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) result : WERR_BADFILE [2014/08/16 20:14:36.951022, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.951142, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:36.951293, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:36.951320, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:36.951342, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:36.951365, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.951385, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:36.951435, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[3] [0000] 00 00 00 00 1A 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.951480, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011a-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.951579, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011a-0000-0000-ef53-8c9f38040000 keyname: struct winreg_String name_len : 0x0094 (148) name_size : 0x0094 (148) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.951812, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1A 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.951855, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:36.951877, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:36.951899, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:36.951926, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:36.951947, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.951967, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:36.952006, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:36.952029, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:36.952051, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.952071, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.952092, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.952112, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.952150, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:36.952279, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:36.952304, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.952324, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.952346, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.952365, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.952399, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:36.952422, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:36.952444, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.952465, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.952486, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.952506, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.952549, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:36.952572, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:36.952594, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.952615, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.952637, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.952657, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.952690, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:36.952713, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (8->9) [2014/08/16 20:14:36.952739, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.952760, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.952782, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.952802, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.952837, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_SW] [2014/08/16 20:14:36.952860, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (9->10) [2014/08/16 20:14:36.952883, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.952903, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.952926, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.952946, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.952984, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (10->9) [2014/08/16 20:14:36.953007, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (9->8) [2014/08/16 20:14:36.953028, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:36.953049, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:36.953070, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:36.953091, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:36.953113, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[4] [0000] 00 00 00 00 1B 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.953153, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011b-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.953354, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011b-0000-0000-ef53-8c9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:36.953530, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1B 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.953571, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.953592, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:36.953613, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' (ops 0x7ffd8125b800) [2014/08/16 20:14:36.953634, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.953668, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Attributes] len[4] [2014/08/16 20:14:36.953692, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Description] len[2] [2014/08/16 20:14:36.953714, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Datatype] len[8] [2014/08/16 20:14:36.953736, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Default Priority] len[4] [2014/08/16 20:14:36.953758, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Port] len[38] [2014/08/16 20:14:36.953780, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Name] len[28] [2014/08/16 20:14:36.953802, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Print Processor] len[18] [2014/08/16 20:14:36.953829, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Priority] len[4] [2014/08/16 20:14:36.953852, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[Security] len[248] [2014/08/16 20:14:36.953874, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[Share Name] len[28] [2014/08/16 20:14:36.953896, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[StartTime] len[4] [2014/08/16 20:14:36.953924, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[UntilTime] len[4] [2014/08/16 20:14:36.953946, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[ChangeID] len[4] [2014/08/16 20:14:36.953968, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : NULL data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) result : WERR_OK [2014/08/16 20:14:36.954077, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011b-0000-0000-ef53-8c9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_BINARY (3) data : * data: ARRAY(0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:36.954401, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1B 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.954442, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:36.954463, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:36.954485, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : * data: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:36.956919, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011b-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.956990, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1B 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.957030, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1B 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.957068, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.957090, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:36.957115, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.957328, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011a-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.957396, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1A 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.957436, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1A 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.957474, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.957494, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:36.957515, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.957596, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000119-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.957663, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.957701, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 19 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.957739, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.957761, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:36.957782, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.957867, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000118-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.957932, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 18 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.957971, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 18 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.958009, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.958030, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:36.958062, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.958147, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:4337(enum_all_printers_info_level) Found a printer in smb.conf: SHMX2600-6_F[6] [2014/08/16 20:14:36.958313, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.958426, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:36.958456, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.958479, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:36.958500, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.958521, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:36.958545, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:36.958625, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.958649, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:36.958671, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:36.958692, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:36.958713, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.958732, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:36.958771, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 1C 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.958814, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011c-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.958905, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011c-0000-0000-ef53-8c9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.959130, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1C 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.959282, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:36.959317, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:36.959340, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:36.959360, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:36.959381, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.959401, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:36.959440, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:36.959464, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:36.959486, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.959506, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.959527, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.959547, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.959581, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:36.959605, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:36.959627, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.959647, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.959669, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.959689, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.959720, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:36.959743, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:36.959765, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.959786, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.959811, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.959831, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.959873, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:36.959896, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:36.959919, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.959940, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.959962, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.959982, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.960014, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:36.960037, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:36.960059, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.960080, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.960102, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.960122, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.960256, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:36.960287, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:36.960310, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.960331, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.960353, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.960373, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.960417, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:36.960441, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:36.960463, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:36.960484, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:36.960505, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:36.960526, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:36.960548, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 1D 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.960588, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011d-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.960671, 2, pid=1080, effective(0, 10000), real(0, 0)] ../source3/rpc_client/cli_winreg_spoolss.c:626(winreg_create_printer) winreg_create_printer: Skipping, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F already exists [2014/08/16 20:14:36.960701, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011d-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.960768, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1D 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.960808, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1D 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.960847, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.960868, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:36.960889, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.960977, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011c-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.961045, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1C 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.961085, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1C 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.961124, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.961144, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:36.961274, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.961385, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.961502, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:36.961524, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.961547, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:36.961568, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.961588, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:36.961608, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:36.961667, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.961696, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:36.961719, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:36.961739, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:36.961760, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.961780, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:36.961818, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 1E 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.961861, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011e-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.961951, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011e-0000-0000-ef53-8c9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.962294, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1E 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.962338, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:36.962360, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:36.962383, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:36.962407, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:36.962429, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.962449, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:36.962488, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:36.962511, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:36.962533, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.962554, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.962575, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.962595, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.962629, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:36.962652, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:36.962674, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.962694, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.962716, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.962736, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.962767, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:36.962790, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:36.962812, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.962832, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.962854, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.962874, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.962920, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:36.962943, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:36.962966, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.962986, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.963008, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.963028, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.963060, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:36.963083, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:36.963105, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.963126, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.963148, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.963272, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.963313, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:36.963337, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:36.963360, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.963380, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.963403, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.963423, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.963462, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:36.963489, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:36.963511, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:36.963532, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:36.963554, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:36.963574, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:36.963596, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.963637, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.963727, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey in: struct winreg_QueryInfoKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL [2014/08/16 20:14:36.963838, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.963881, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' (ops 0x7ffd8125b800) [2014/08/16 20:14:36.963903, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.963936, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Description] len[2] [2014/08/16 20:14:36.963960, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Datatype] len[8] [2014/08/16 20:14:36.963983, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Default Priority] len[4] [2014/08/16 20:14:36.964009, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Port] len[38] [2014/08/16 20:14:36.964031, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Print Processor] len[18] [2014/08/16 20:14:36.964053, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Priority] len[4] [2014/08/16 20:14:36.964075, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Security] len[248] [2014/08/16 20:14:36.964097, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Share Name] len[26] [2014/08/16 20:14:36.964119, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[StartTime] len[4] [2014/08/16 20:14:36.964141, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[UntilTime] len[4] [2014/08/16 20:14:36.964265, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[Attributes] len[4] [2014/08/16 20:14:36.964291, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[Printer Driver] len[36] [2014/08/16 20:14:36.964313, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[Location] len[2] [2014/08/16 20:14:36.964336, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[13]: name[Parameters] len[2] [2014/08/16 20:14:36.964358, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[14]: name[Name] len[36] [2014/08/16 20:14:36.964381, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[15]: name[Separator File] len[2] [2014/08/16 20:14:36.964403, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[16]: name[Status] len[4] [2014/08/16 20:14:36.964426, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[17]: name[ChangeID] len[4] [2014/08/16 20:14:36.964448, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:2074(regdb_get_secdesc) regdb_get_secdesc: Getting secdesc of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.964483, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey out: struct winreg_QueryInfoKey classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL num_subkeys : * num_subkeys : 0x00000003 (3) max_subkeylen : * max_subkeylen : 0x00000022 (34) max_classlen : * max_classlen : 0x00000000 (0) num_values : * num_values : 0x00000012 (18) max_valnamelen : * max_valnamelen : 0x00000022 (34) max_valbufsize : * max_valbufsize : 0x000000f8 (248) secdescsize : * secdescsize : 0x00000078 (120) last_changed_time : * last_changed_time : NTTIME(0) result : WERR_OK [2014/08/16 20:14:36.964720, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000000 (0) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.964914, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.964955, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.964978, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0018 (24) size : 0x0024 (36) name : * name : 'Description' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:36.965276, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000001 (1) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.965477, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.965519, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.965542, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Datatype' type : * type : REG_SZ (1) value : * value: ARRAY(8) [0] : 0x52 (82) [1] : 0x00 (0) [2] : 0x41 (65) [3] : 0x00 (0) [4] : 0x57 (87) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) size : * size : 0x00000008 (8) length : * length : 0x00000008 (8) result : WERR_OK [2014/08/16 20:14:36.965823, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000002 (2) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.966060, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.966142, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.966280, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0022 (34) size : 0x0024 (36) name : * name : 'Default Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.966500, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000003 (3) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.966698, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.966740, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.966763, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Port' type : * type : REG_SZ (1) value : * value: ARRAY(38) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x61 (97) [3] : 0x00 (0) [4] : 0x6d (109) [5] : 0x00 (0) [6] : 0x62 (98) [7] : 0x00 (0) [8] : 0x61 (97) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x50 (80) [13] : 0x00 (0) [14] : 0x72 (114) [15] : 0x00 (0) [16] : 0x69 (105) [17] : 0x00 (0) [18] : 0x6e (110) [19] : 0x00 (0) [20] : 0x74 (116) [21] : 0x00 (0) [22] : 0x65 (101) [23] : 0x00 (0) [24] : 0x72 (114) [25] : 0x00 (0) [26] : 0x20 (32) [27] : 0x00 (0) [28] : 0x50 (80) [29] : 0x00 (0) [30] : 0x6f (111) [31] : 0x00 (0) [32] : 0x72 (114) [33] : 0x00 (0) [34] : 0x74 (116) [35] : 0x00 (0) [36] : 0x00 (0) [37] : 0x00 (0) size : * size : 0x00000026 (38) length : * length : 0x00000026 (38) result : WERR_OK [2014/08/16 20:14:36.967380, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000004 (4) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.967578, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.967624, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.967649, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0020 (32) size : 0x0024 (36) name : * name : 'Print Processor' type : * type : REG_SZ (1) value : * value: ARRAY(18) [0] : 0x77 (119) [1] : 0x00 (0) [2] : 0x69 (105) [3] : 0x00 (0) [4] : 0x6e (110) [5] : 0x00 (0) [6] : 0x70 (112) [7] : 0x00 (0) [8] : 0x72 (114) [9] : 0x00 (0) [10] : 0x69 (105) [11] : 0x00 (0) [12] : 0x6e (110) [13] : 0x00 (0) [14] : 0x74 (116) [15] : 0x00 (0) [16] : 0x00 (0) [17] : 0x00 (0) size : * size : 0x00000012 (18) length : * length : 0x00000012 (18) result : WERR_OK [2014/08/16 20:14:36.967979, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000005 (5) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.968283, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.968327, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.968355, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.968568, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000006 (6) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.968764, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.968805, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.968829, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Security' type : * type : REG_BINARY (3) value : * value: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) size : * size : 0x000000f8 (248) length : * length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:36.971511, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000007 (7) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.971707, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.971748, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.971775, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Share Name' type : * type : REG_SZ (1) value : * value: ARRAY(26) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x4d (77) [5] : 0x00 (0) [6] : 0x58 (88) [7] : 0x00 (0) [8] : 0x32 (50) [9] : 0x00 (0) [10] : 0x36 (54) [11] : 0x00 (0) [12] : 0x30 (48) [13] : 0x00 (0) [14] : 0x30 (48) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x36 (54) [19] : 0x00 (0) [20] : 0x5f (95) [21] : 0x00 (0) [22] : 0x46 (70) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) size : * size : 0x0000001a (26) length : * length : 0x0000001a (26) result : WERR_OK [2014/08/16 20:14:36.972276, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000008 (8) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.972475, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.972518, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.972541, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'StartTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.972740, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000009 (9) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.972927, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.972967, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.972989, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'UntilTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.974323, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000a (10) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.974512, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.974552, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.974575, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Attributes' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x48 (72) [1] : 0x18 (24) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.974775, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000b (11) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.974964, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.975003, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.975026, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x001e (30) size : 0x0024 (36) name : * name : 'Printer Driver' type : * type : REG_SZ (1) value : * value: ARRAY(36) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x41 (65) [5] : 0x00 (0) [6] : 0x52 (82) [7] : 0x00 (0) [8] : 0x50 (80) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x4d (77) [13] : 0x00 (0) [14] : 0x58 (88) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x32 (50) [19] : 0x00 (0) [20] : 0x36 (54) [21] : 0x00 (0) [22] : 0x30 (48) [23] : 0x00 (0) [24] : 0x30 (48) [25] : 0x00 (0) [26] : 0x4e (78) [27] : 0x00 (0) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x50 (80) [31] : 0x00 (0) [32] : 0x53 (83) [33] : 0x00 (0) [34] : 0x00 (0) [35] : 0x00 (0) size : * size : 0x00000024 (36) length : * length : 0x00000024 (36) result : WERR_OK [2014/08/16 20:14:36.975633, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000c (12) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.975820, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.975860, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.975882, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Location' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:36.976064, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000d (13) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.976378, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.976427, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.976451, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Parameters' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:36.976642, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000e (14) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.976835, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.976875, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.976898, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Name' type : * type : REG_SZ (1) value : * value: ARRAY(36) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x41 (65) [5] : 0x00 (0) [6] : 0x52 (82) [7] : 0x00 (0) [8] : 0x50 (80) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x4d (77) [13] : 0x00 (0) [14] : 0x58 (88) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x32 (50) [19] : 0x00 (0) [20] : 0x36 (54) [21] : 0x00 (0) [22] : 0x30 (48) [23] : 0x00 (0) [24] : 0x30 (48) [25] : 0x00 (0) [26] : 0x4e (78) [27] : 0x00 (0) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x50 (80) [31] : 0x00 (0) [32] : 0x53 (83) [33] : 0x00 (0) [34] : 0x00 (0) [35] : 0x00 (0) size : * size : 0x00000024 (36) length : * length : 0x00000024 (36) result : WERR_OK [2014/08/16 20:14:36.977482, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x0000000f (15) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.977674, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.977719, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.977742, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x001e (30) size : 0x0024 (36) name : * name : 'Separator File' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:36.977931, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000010 (16) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.978121, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.978263, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.978290, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000e (14) size : 0x0024 (36) name : * name : 'Status' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.978500, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 enum_index : 0x00000011 (17) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:36.978691, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.978732, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.978755, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'ChangeID' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x8d (141) [1] : 0xcd (205) [2] : 0x1b (27) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:36.978981, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0020 (32) name_size : 0x0020 (32) name : * name : 'Default DevMode' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:36.979271, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.979321, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.979343, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:36.979366, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:316(_winreg_QueryValue) _winreg_QueryValue: reg_queryvalue failed with: WERR_BADFILE [2014/08/16 20:14:36.979388, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) result : WERR_BADFILE [2014/08/16 20:14:36.979504, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.979622, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:36.979645, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:36.979667, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:36.979688, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:36.979709, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.979729, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:36.979773, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[3] [0000] 00 00 00 00 20 01 00 00 00 00 00 00 EF 53 8C 9F .... ... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.979823, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000120-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.979910, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000120-0000-0000-ef53-8c9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.980132, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 20 01 00 00 00 00 00 00 EF 53 8C 9F .... ... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.980295, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:36.980319, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:36.980340, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:36.980360, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:36.980381, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.980400, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:36.980438, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:36.980461, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:36.980486, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.980506, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.980527, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.980546, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.980580, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:36.980602, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:36.980624, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.980643, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.980664, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.980683, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.980714, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:36.980735, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:36.980757, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.980776, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.980797, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.980816, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:36.980857, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:36.980879, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:36.980901, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.980921, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.980945, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.980965, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:36.980997, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:36.981019, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (8->9) [2014/08/16 20:14:36.981041, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.981061, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.981082, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.981101, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:36.981136, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:36.981268, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (9->10) [2014/08/16 20:14:36.981304, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.981325, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.981347, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.981366, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.981405, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (10->9) [2014/08/16 20:14:36.981429, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (9->8) [2014/08/16 20:14:36.981450, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:36.981470, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:36.981491, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:36.981511, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:36.981536, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[4] [0000] 00 00 00 00 21 01 00 00 00 00 00 00 EF 53 8C 9F ....!... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.981576, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000121-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.981665, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000121-0000-0000-ef53-8c9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:36.981836, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 21 01 00 00 00 00 00 00 EF 53 8C 9F ....!... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.981876, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.981896, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:36.981916, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' (ops 0x7ffd8125b800) [2014/08/16 20:14:36.981936, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.981968, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Description] len[2] [2014/08/16 20:14:36.981991, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Datatype] len[8] [2014/08/16 20:14:36.982013, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Default Priority] len[4] [2014/08/16 20:14:36.982034, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Port] len[38] [2014/08/16 20:14:36.982059, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Print Processor] len[18] [2014/08/16 20:14:36.982081, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Priority] len[4] [2014/08/16 20:14:36.982103, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Security] len[248] [2014/08/16 20:14:36.982124, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Share Name] len[26] [2014/08/16 20:14:36.982146, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[StartTime] len[4] [2014/08/16 20:14:36.982290, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[UntilTime] len[4] [2014/08/16 20:14:36.982314, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[Attributes] len[4] [2014/08/16 20:14:36.982336, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[Printer Driver] len[36] [2014/08/16 20:14:36.982358, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[Location] len[2] [2014/08/16 20:14:36.982380, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[13]: name[Parameters] len[2] [2014/08/16 20:14:36.982402, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[14]: name[Name] len[36] [2014/08/16 20:14:36.982424, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[15]: name[Separator File] len[2] [2014/08/16 20:14:36.982446, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[16]: name[Status] len[4] [2014/08/16 20:14:36.982468, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[17]: name[ChangeID] len[4] [2014/08/16 20:14:36.982491, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : NULL data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) result : WERR_OK [2014/08/16 20:14:36.982603, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000121-0000-0000-ef53-8c9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_BINARY (3) data : * data: ARRAY(0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:36.982786, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 21 01 00 00 00 00 00 00 EF 53 8C 9F ....!... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.982826, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:36.982846, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:36.982868, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : * data: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:36.985442, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000121-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.985514, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 21 01 00 00 00 00 00 00 EF 53 8C 9F ....!... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.985555, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 21 01 00 00 00 00 00 00 EF 53 8C 9F ....!... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.985595, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.985618, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:36.985639, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.985723, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000120-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.985791, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 20 01 00 00 00 00 00 00 EF 53 8C 9F .... ... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.985831, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 20 01 00 00 00 00 00 00 EF 53 8C 9F .... ... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.985870, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.985891, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:36.985912, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.985999, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011f-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.986067, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.986107, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1F 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.986146, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.986269, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:36.986294, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.986379, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000011e-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:36.986447, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1E 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.986487, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 1E 01 00 00 00 00 00 00 EF 53 8C 9F ........ .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.986527, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:36.986547, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:36.986579, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:36.986674, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:416(close_policy_by_pipe) Deleted handle list for RPC connection \winreg [2014/08/16 20:14:36.986715, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_EnumPrinters: struct spoolss_EnumPrinters out: struct spoolss_EnumPrinters count : * count : 0x00000000 (0) info : * info : NULL needed : * needed : 0x000000d0 (208) result : WERR_INSUFFICIENT_BUFFER [2014/08/16 20:14:36.986808, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1417(api_rpcTNP) api_rpcTNP: called \spoolss successfully [2014/08/16 20:14:36.986839, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.986862, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 52 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 56 req->in.vector[4].iov_len = 68 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.986976, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:128(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: received 68 [2014/08/16 20:14:36.986999, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:149(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: issuing np_read_send of size 1024 [2014/08/16 20:14:36.987021, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:36.987043, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:347(read_from_internal_pipe) read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 16. [2014/08/16 20:14:36.987071, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0028 (40) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000010 (16) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=16 [0000] 00 00 00 00 D0 00 00 00 00 00 00 00 7A 00 00 00 ........ ....z... [2014/08/16 20:14:36.987376, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 1821 [2014/08/16 20:14:36.987405, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 40 bytes. There is no more data outstanding [2014/08/16 20:14:36.987432, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:178(smbd_smb2_ioctl_pipe_read_done) smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = 40 is_data_outstanding = 0, status = NT_STATUS_OK [2014/08/16 20:14:36.987456, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:291(smbd_smb2_request_ioctl_done) smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned 40 status NT_STATUS_OK [2014/08/16 20:14:36.987478, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[48] dyn[yes:40] at ../source3/smbd/smb2_ioctl.c:358 [2014/08/16 20:14:36.987501, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/162/31 [2014/08/16 20:14:36.987874, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.987903, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 162 (position 162) from bitmap [2014/08/16 20:14:36.987926, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CLOSE] mid = 162 [2014/08/16 20:14:36.987956, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.987979, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.988439, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.988531, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.988559, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_close.c:185(smbd_smb2_close) smbd_smb2_close: spoolss - fnum 19006834 [2014/08/16 20:14:36.988587, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.988608, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:36.988630, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key CD76BAB3 [2014/08/16 20:14:36.988656, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd8423b930 [2014/08/16 20:14:36.988683, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key CD76BAB3 [2014/08/16 20:14:36.988705, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.988725, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:36.988753, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:528(file_free) freed files structure 19006834 (2 used) [2014/08/16 20:14:36.988778, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[60] dyn[no:0] at ../source3/smbd/smb2_close.c:144 [2014/08/16 20:14:36.988801, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/163/31 [2014/08/16 20:14:36.989587, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.989622, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 163 (position 163) from bitmap [2014/08/16 20:14:36.989645, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CREATE] mid = 163 [2014/08/16 20:14:36.989670, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.989693, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.990093, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.990177, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.990307, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:456(smbd_smb2_create_send) smbd_smb2_create: name[spoolss] [2014/08/16 20:14:36.990338, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.990360, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:36.990382, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 05F96A66 [2014/08/16 20:14:36.990406, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd84228f90 [2014/08/16 20:14:36.990448, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:695(smbXsrv_open_global_store) [2014/08/16 20:14:36.990463, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:697(smbXsrv_open_global_store) smbXsrv_open_global_store: key '05F96A66' stored [2014/08/16 20:14:36.990485, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &global_blob: struct smbXsrv_open_globalB version : SMBXSRV_VERSION_0 (0) seqnum : 0x00000001 (1) info : union smbXsrv_open_globalU(case 0) info0 : * info0: struct smbXsrv_open_global0 db_rec : * server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0x05f96a66 (100231782) open_persistent_id : 0x0000000005f96a66 (100231782) open_volatile_id : 0x0000000063c32a85 (1673734789) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:37 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 [2014/08/16 20:14:36.990722, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 05F96A66 [2014/08/16 20:14:36.990745, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:36.990765, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:36.990785, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:862(smbXsrv_open_create) [2014/08/16 20:14:36.990798, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smbXsrv_open.c:870(smbXsrv_open_create) smbXsrv_open_create: global_id (0x05f96a66) stored [2014/08/16 20:14:36.990817, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &open_blob: struct smbXsrv_openB version : SMBXSRV_VERSION_0 (0) reserved : 0x00000000 (0) info : union smbXsrv_openU(case 0) info0 : * info0: struct smbXsrv_open table : * db_rec : NULL local_id : 0x63c32a85 (1673734789) global : * global: struct smbXsrv_open_global0 db_rec : NULL server_id: struct server_id pid : 0x0000000000000438 (1080) task_id : 0x00000000 (0) vnn : 0xffffffff (4294967295) unique_id : 0x615e0906a4af4eef (7016055193627217647) open_global_id : 0x05f96a66 (100231782) open_persistent_id : 0x0000000005f96a66 (100231782) open_volatile_id : 0x0000000063c32a85 (1673734789) open_owner : S-1-5-21-3134998938-619743855-3616620706-500 open_time : Sa Aug 16 20:14:37 2014 CEST create_guid : 00000000-0000-0000-0000-000000000000 client_guid : a8b4d38b-256c-11e4-af4a-000c29b8dda7 app_instance_id : 00000000-0000-0000-0000-000000000000 disconnect_time : NTTIME(0) durable_timeout_msec : 0x00000000 (0) durable : 0x00 (0) backend_cookie : DATA_BLOB length=0 status : NT_STATUS_OK idle_time : Sa Aug 16 20:14:37 2014 CEST compat : NULL [2014/08/16 20:14:36.991111, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:128(file_new) allocated file structure fnum 1673734789 (3 used) [2014/08/16 20:14:36.991136, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:716(file_name_hash) file_name_hash: /tmp/spoolss hash 0x7d4e46e5 [2014/08/16 20:14:36.991280, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \spoolss [2014/08/16 20:14:36.991320, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 22 for pipe \spoolss [2014/08/16 20:14:36.991381, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \spoolss [2014/08/16 20:14:36.991406, 8, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/dosmode.c:642(dos_mode) dos_mode: spoolss [2014/08/16 20:14:36.991435, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_create.c:1053(smbd_smb2_create_send) smbd_smb2_create_send: spoolss - fnum 1673734789 [2014/08/16 20:14:36.991462, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[88] dyn[yes:0] at ../source3/smbd/smb2_create.c:374 [2014/08/16 20:14:36.991485, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/164/31 [2014/08/16 20:14:36.991762, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.991794, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 164 (position 164) from bitmap [2014/08/16 20:14:36.991817, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_WRITE] mid = 164 [2014/08/16 20:14:36.991841, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.991864, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.992344, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.992430, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.992455, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 164, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.992477, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_write.c:271(smbd_smb2_write_send) smbd_smb2_write: spoolss - fnum 1673734789 [2014/08/16 20:14:36.992499, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 160 [2014/08/16 20:14:36.992520, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 160 [2014/08/16 20:14:36.992539, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 160 [2014/08/16 20:14:36.992559, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 160, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:36.992580, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:36.992599, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:36.992619, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 144 [2014/08/16 20:14:36.992640, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:36.992659, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 144 [2014/08/16 20:14:36.992678, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 144, incoming data = 144 [2014/08/16 20:14:36.992699, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:36.992725, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00a0 (160) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x03 (3) ctx_list: ARRAY(3) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) ctx_list: struct dcerpc_ctx_list context_id : 0x0001 (1) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 71710533-beba-4937-8319-b5dbef9ccc36 if_version : 0x00000001 (1) ctx_list: struct dcerpc_ctx_list context_id : 0x0002 (2) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-0123456789ab if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 6cb71c2c-9812-4540-0300-000000000000 if_version : 0x00000001 (1) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:36.993289, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 11 [2014/08/16 20:14:36.993314, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:693(api_pipe_bind_req) api_pipe_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:36.993335, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:724(api_pipe_bind_req) api_pipe_bind_req: make response. 724 [2014/08/16 20:14:36.993355, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:342(check_bind_req) check_bind_req for \spoolss [2014/08/16 20:14:36.993377, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:349(check_bind_req) check_bind_req: spoolss -> spoolss rpc service [2014/08/16 20:14:36.993398, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 23 for pipe \spoolss [2014/08/16 20:14:36.993427, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0044 (68) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000053f0 (21488) secondary_address_size : 0x000e (14) secondary_address : '\PIPE\spoolss' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : 0x0000 (0) reason : 0x0000 (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2014/08/16 20:14:36.993689, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 144 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 160 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.993796, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:0] at ../source3/smbd/smb2_write.c:150 [2014/08/16 20:14:36.993820, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/165/31 [2014/08/16 20:14:36.994092, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.994123, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 165 (position 165) from bitmap [2014/08/16 20:14:36.994146, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_READ] mid = 165 [2014/08/16 20:14:36.994170, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.994193, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.994636, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.994721, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.994746, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 165, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.994767, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_read.c:439(smbd_smb2_read_send) smbd_smb2_read: spoolss - fnum 1673734789 [2014/08/16 20:14:36.994790, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:36.994812, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:326(read_from_internal_pipe) read_from_pipe: \spoolss: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2014/08/16 20:14:36.994834, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 29 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 48 req->in.vector[4].iov_len = 1 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:36.994939, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 68 bytes. There is no more data outstanding [2014/08/16 20:14:36.994963, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[16] dyn[yes:68] at ../source3/smbd/smb2_read.c:154 [2014/08/16 20:14:36.994985, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/166/31 [2014/08/16 20:14:36.995312, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:36.995343, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 166 (position 166) from bitmap [2014/08/16 20:14:36.995369, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_IOCTL] mid = 166 [2014/08/16 20:14:36.995394, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:36.995416, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.995799, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.995881, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:36.995906, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1780(smbd_smb2_request_verify_creditcharge) mid 166, CreditCharge: 1, NeededCharge: 1 [2014/08/16 20:14:36.995927, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:394(smbd_smb2_ioctl_send) smbd_smb2_ioctl: ctl_code[0x0011c017] spoolss, fnum 1673734789 [2014/08/16 20:14:36.995950, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:59(smb2_ioctl_named_pipe) smbd_smb2_ioctl_send: np_write_send of size 400 [2014/08/16 20:14:36.995969, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:520(np_write_send) np_write_send: len: 400 [2014/08/16 20:14:36.995990, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 400 [2014/08/16 20:14:36.996013, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 0, pdu_needed_len = 0, incoming data = 400 [2014/08/16 20:14:36.996033, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:51(fill_rpc_header) fill_rpc_header: data_to_copy = 400, len_needed_to_complete_hdr = 16, receive_len = 0 [2014/08/16 20:14:36.996053, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 16 [2014/08/16 20:14:36.996072, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 384 [2014/08/16 20:14:36.996092, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 0, incoming data = 384 [2014/08/16 20:14:36.996112, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 0 [2014/08/16 20:14:36.996131, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:243(write_to_internal_pipe) write_to_pipe: data_left = 384 [2014/08/16 20:14:36.996151, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:139(process_incoming_data) process_incoming_data: Start: pdu.length = 16, pdu_needed_len = 384, incoming data = 384 [2014/08/16 20:14:36.996354, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1606(process_complete_pdu) PDU is in Little Endian format! [2014/08/16 20:14:36.996381, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0190 (400) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000178 (376) context_id : 0x0000 (0) opnum : 0x0000 (0) object : union dcerpc_object(case 0) empty: struct dcerpc_empty _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=376 [0000] 08 00 00 00 00 00 02 00 05 00 00 00 00 00 00 00 ........ ........ [0010] 05 00 00 00 5C 00 5C 00 4D 00 31 00 00 00 00 00 ....\.\. M.1..... [0020] 05 00 00 00 04 00 02 00 48 01 00 00 00 00 00 00 ........ H....... [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0080] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0090] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0100] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0110] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0120] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0130] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0140] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0150] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0160] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0170] 00 00 00 00 48 01 00 00 ....H... [2014/08/16 20:14:36.996993, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1619(process_complete_pdu) Processing packet type 0 [2014/08/16 20:14:36.997015, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request) Checking request auth. [2014/08/16 20:14:36.997037, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.997060, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.997082, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:36.997572, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:36.997663, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1324(api_pipe_request) Requested \spoolss rpc service [2014/08/16 20:14:36.997688, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1356(api_rpcTNP) api_rpcTNP: \spoolss op 0x0 - api_rpcTNP: rpc command: SPOOLSS_ENUMPRINTERS [2014/08/16 20:14:36.997711, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1390(api_rpcTNP) api_rpc_cmds[0].fn == 0x7ffd818a7f8c [2014/08/16 20:14:36.997737, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_EnumPrinters: struct spoolss_EnumPrinters in: struct spoolss_EnumPrinters flags : 0x00000008 (8) 0: PRINTER_ENUM_DEFAULT 0: PRINTER_ENUM_LOCAL 0: PRINTER_ENUM_CONNECTIONS 0: PRINTER_ENUM_FAVORITE 1: PRINTER_ENUM_NAME 0: PRINTER_ENUM_REMOTE 0: PRINTER_ENUM_SHARED 0: PRINTER_ENUM_NETWORK 0: PRINTER_ENUM_EXPAND 0: PRINTER_ENUM_CONTAINER 0: PRINTER_ENUM_ICON1 0: PRINTER_ENUM_ICON2 0: PRINTER_ENUM_ICON3 0: PRINTER_ENUM_ICON4 0: PRINTER_ENUM_ICON5 0: PRINTER_ENUM_ICON6 0: PRINTER_ENUM_ICON7 0: PRINTER_ENUM_ICON8 0: PRINTER_ENUM_HIDE server : * server : '\\M1' level : 0x00000005 (5) buffer : * buffer : DATA_BLOB length=328 [0000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0010] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0080] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0090] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00B0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00D0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0100] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0110] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0120] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0130] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0140] 00 00 00 00 00 00 00 00 ........ offered : 0x00000148 (328) [2014/08/16 20:14:36.998440, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:4679(_spoolss_EnumPrinters) _spoolss_EnumPrinters [2014/08/16 20:14:36.998463, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:4657(enumprinters_level5) enum_all_printers_info_5 [2014/08/16 20:14:36.998488, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:4337(enum_all_printers_info_level) Found a printer in smb.conf: SHMX2600-6_SW[5] [2014/08/16 20:14:36.998517, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:60(make_internal_rpc_pipe_p) Create pipe requested \winreg [2014/08/16 20:14:36.998542, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:221(init_pipe_handles) init_pipe_handle_list: created handle list for pipe \winreg [2014/08/16 20:14:36.998564, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:238(init_pipe_handles) init_pipe_handle_list: pipe_handles ref count = 1 for pipe \winreg [2014/08/16 20:14:36.998604, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_ncacn_np.c:100(make_internal_rpc_pipe_p) Created internal pipe \winreg [2014/08/16 20:14:36.998637, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.998752, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:36.998776, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.998798, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:36.998819, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:36.998839, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:36.998860, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:36.998931, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:36.998955, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:36.998978, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:36.998999, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:36.999020, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.999040, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:36.999080, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 22 01 00 00 00 00 00 00 EF 53 8C 9F ...."... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.999127, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000122-0000-0000-ef53-8c9f38040000 result : WERR_OK [2014/08/16 20:14:36.999339, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000122-0000-0000-ef53-8c9f38040000 keyname: struct winreg_String name_len : 0x0094 (148) name_size : 0x0094 (148) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:36.999567, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 22 01 00 00 00 00 00 00 EF 53 8C 9F ...."... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:36.999611, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:36.999632, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:36.999655, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:36.999675, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:36.999696, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.999716, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:36.999755, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:36.999785, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:36.999810, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.999830, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.999851, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:36.999870, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:36.999904, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:36.999926, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:36.999948, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.999968, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:36.999989, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.000008, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.000039, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:37.000061, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:37.000083, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.000103, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.000124, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.000144, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.000297, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:37.000325, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:37.000348, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.000368, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.000390, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.000413, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.000446, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:37.000468, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:37.000490, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.000510, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.000531, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.000551, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.000587, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_SW] [2014/08/16 20:14:37.000609, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:37.000631, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.000652, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.000674, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.000693, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.000733, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:37.000755, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:37.000776, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:37.000797, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:37.000817, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:37.000838, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:37.000859, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 23 01 00 00 00 00 00 00 EF 53 8D 9F ....#... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.000902, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000123-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.000983, 2, pid=1080, effective(0, 10000), real(0, 0)] ../source3/rpc_client/cli_winreg_spoolss.c:626(winreg_create_printer) winreg_create_printer: Skipping, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW already exists [2014/08/16 20:14:37.001012, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000123-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.001078, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 23 01 00 00 00 00 00 00 EF 53 8D 9F ....#... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.001118, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 23 01 00 00 00 00 00 00 EF 53 8D 9F ....#... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.001156, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.001298, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:37.001328, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.001411, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000122-0000-0000-ef53-8c9f38040000 [2014/08/16 20:14:37.001478, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 22 01 00 00 00 00 00 00 EF 53 8C 9F ...."... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.001517, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 22 01 00 00 00 00 00 00 EF 53 8C 9F ...."... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.001559, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.001580, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:37.001608, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.001699, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.001813, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:37.001835, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:37.001857, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:37.001877, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:37.001897, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:37.001916, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:37.001974, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:37.001998, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:37.002020, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:37.002040, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:37.002060, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.002079, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:37.002115, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 24 01 00 00 00 00 00 00 EF 53 8D 9F ....$... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.002157, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000124-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.002380, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000124-0000-0000-ef53-8d9f38040000 keyname: struct winreg_String name_len : 0x0094 (148) name_size : 0x0094 (148) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.002725, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 24 01 00 00 00 00 00 00 EF 53 8D 9F ....$... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.002787, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:37.002815, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:37.002851, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:37.002878, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:37.002912, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.002931, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:37.002983, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:37.003019, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:37.003040, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.003074, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.003105, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.003232, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.003317, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:37.003347, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:37.003368, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.003388, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.003410, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.003429, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.003460, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:37.003482, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:37.003504, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.003523, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.003545, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.003564, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.003604, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:37.003627, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:37.003648, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.003668, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.003689, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.003709, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.003744, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:37.003766, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:37.003788, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.003808, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.003830, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.003849, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.003884, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_SW] [2014/08/16 20:14:37.003907, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:37.003929, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.003949, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.003971, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.003991, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.004029, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:37.004052, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:37.004073, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:37.004093, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:37.004114, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:37.004134, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:37.004155, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.004331, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.004428, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey in: struct winreg_QueryInfoKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL [2014/08/16 20:14:37.004544, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.004589, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' (ops 0x7ffd8125b800) [2014/08/16 20:14:37.004612, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.004646, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Attributes] len[4] [2014/08/16 20:14:37.004671, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Description] len[2] [2014/08/16 20:14:37.004694, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Datatype] len[8] [2014/08/16 20:14:37.004717, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Default Priority] len[4] [2014/08/16 20:14:37.004740, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Port] len[38] [2014/08/16 20:14:37.004763, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Name] len[28] [2014/08/16 20:14:37.004785, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Print Processor] len[18] [2014/08/16 20:14:37.004808, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Priority] len[4] [2014/08/16 20:14:37.004831, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[Security] len[248] [2014/08/16 20:14:37.004854, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[Share Name] len[28] [2014/08/16 20:14:37.004881, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[StartTime] len[4] [2014/08/16 20:14:37.004905, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[UntilTime] len[4] [2014/08/16 20:14:37.004928, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[ChangeID] len[4] [2014/08/16 20:14:37.004951, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:2074(regdb_get_secdesc) regdb_get_secdesc: Getting secdesc of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.004985, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey out: struct winreg_QueryInfoKey classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL num_subkeys : * num_subkeys : 0x00000003 (3) max_subkeylen : * max_subkeylen : 0x00000022 (34) max_classlen : * max_classlen : 0x00000000 (0) num_values : * num_values : 0x0000000d (13) max_valnamelen : * max_valnamelen : 0x00000022 (34) max_valbufsize : * max_valbufsize : 0x000000f8 (248) secdescsize : * secdescsize : 0x00000078 (120) last_changed_time : * last_changed_time : NTTIME(0) result : WERR_OK [2014/08/16 20:14:37.005329, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000000 (0) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.005531, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.005573, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.005602, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Attributes' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x48 (72) [1] : 0x10 (16) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.005819, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000001 (1) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.006019, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.006061, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.006084, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0018 (24) size : 0x0024 (36) name : * name : 'Description' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:37.006410, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000002 (2) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.006609, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.006651, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.006675, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Datatype' type : * type : REG_SZ (1) value : * value: ARRAY(8) [0] : 0x52 (82) [1] : 0x00 (0) [2] : 0x41 (65) [3] : 0x00 (0) [4] : 0x57 (87) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) size : * size : 0x00000008 (8) length : * length : 0x00000008 (8) result : WERR_OK [2014/08/16 20:14:37.006921, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000003 (3) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.007120, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.007266, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.007294, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0022 (34) size : 0x0024 (36) name : * name : 'Default Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.007508, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000004 (4) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.007706, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.007748, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.007776, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Port' type : * type : REG_SZ (1) value : * value: ARRAY(38) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x61 (97) [3] : 0x00 (0) [4] : 0x6d (109) [5] : 0x00 (0) [6] : 0x62 (98) [7] : 0x00 (0) [8] : 0x61 (97) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x50 (80) [13] : 0x00 (0) [14] : 0x72 (114) [15] : 0x00 (0) [16] : 0x69 (105) [17] : 0x00 (0) [18] : 0x6e (110) [19] : 0x00 (0) [20] : 0x74 (116) [21] : 0x00 (0) [22] : 0x65 (101) [23] : 0x00 (0) [24] : 0x72 (114) [25] : 0x00 (0) [26] : 0x20 (32) [27] : 0x00 (0) [28] : 0x50 (80) [29] : 0x00 (0) [30] : 0x6f (111) [31] : 0x00 (0) [32] : 0x72 (114) [33] : 0x00 (0) [34] : 0x74 (116) [35] : 0x00 (0) [36] : 0x00 (0) [37] : 0x00 (0) size : * size : 0x00000026 (38) length : * length : 0x00000026 (38) result : WERR_OK [2014/08/16 20:14:37.008386, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000005 (5) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.008589, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.008631, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.008655, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Name' type : * type : REG_SZ (1) value : * value: ARRAY(28) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x4d (77) [5] : 0x00 (0) [6] : 0x58 (88) [7] : 0x00 (0) [8] : 0x32 (50) [9] : 0x00 (0) [10] : 0x36 (54) [11] : 0x00 (0) [12] : 0x30 (48) [13] : 0x00 (0) [14] : 0x30 (48) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x36 (54) [19] : 0x00 (0) [20] : 0x5f (95) [21] : 0x00 (0) [22] : 0x53 (83) [23] : 0x00 (0) [24] : 0x57 (87) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x00 (0) size : * size : 0x0000001c (28) length : * length : 0x0000001c (28) result : WERR_OK [2014/08/16 20:14:37.009077, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000006 (6) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.009388, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.009433, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.009460, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0020 (32) size : 0x0024 (36) name : * name : 'Print Processor' type : * type : REG_SZ (1) value : * value: ARRAY(18) [0] : 0x77 (119) [1] : 0x00 (0) [2] : 0x69 (105) [3] : 0x00 (0) [4] : 0x6e (110) [5] : 0x00 (0) [6] : 0x70 (112) [7] : 0x00 (0) [8] : 0x72 (114) [9] : 0x00 (0) [10] : 0x69 (105) [11] : 0x00 (0) [12] : 0x6e (110) [13] : 0x00 (0) [14] : 0x74 (116) [15] : 0x00 (0) [16] : 0x00 (0) [17] : 0x00 (0) size : * size : 0x00000012 (18) length : * length : 0x00000012 (18) result : WERR_OK [2014/08/16 20:14:37.009806, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000007 (7) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.010001, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.010041, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.010064, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.010411, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000008 (8) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.010602, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.010643, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.010675, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Security' type : * type : REG_BINARY (3) value : * value: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) size : * size : 0x000000f8 (248) length : * length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:37.013266, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x00000009 (9) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.013496, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.013538, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.013561, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Share Name' type : * type : REG_SZ (1) value : * value: ARRAY(28) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x4d (77) [5] : 0x00 (0) [6] : 0x58 (88) [7] : 0x00 (0) [8] : 0x32 (50) [9] : 0x00 (0) [10] : 0x36 (54) [11] : 0x00 (0) [12] : 0x30 (48) [13] : 0x00 (0) [14] : 0x30 (48) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x36 (54) [19] : 0x00 (0) [20] : 0x5f (95) [21] : 0x00 (0) [22] : 0x53 (83) [23] : 0x00 (0) [24] : 0x57 (87) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x00 (0) size : * size : 0x0000001c (28) length : * length : 0x0000001c (28) result : WERR_OK [2014/08/16 20:14:37.013969, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000a (10) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.014268, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.014311, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.014334, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'StartTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.014542, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000b (11) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.014733, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.014777, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.014801, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'UntilTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.015005, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000c (12) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.015311, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.015353, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.015377, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'ChangeID' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0xcc (204) [1] : 0x9c (156) [2] : 0x03 (3) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.015611, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0020 (32) name_size : 0x0020 (32) name : * name : 'Default DevMode' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:37.015789, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.015830, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.015851, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:37.015875, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:316(_winreg_QueryValue) _winreg_QueryValue: reg_queryvalue failed with: WERR_BADFILE [2014/08/16 20:14:37.015896, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) result : WERR_BADFILE [2014/08/16 20:14:37.016012, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.016130, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:37.016254, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:37.016306, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:37.016335, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:37.016357, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.016377, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:37.016426, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[3] [0000] 00 00 00 00 26 01 00 00 00 00 00 00 EF 53 8D 9F ....&... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.016469, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000126-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.016561, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000126-0000-0000-ef53-8d9f38040000 keyname: struct winreg_String name_len : 0x0094 (148) name_size : 0x0094 (148) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.016789, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 26 01 00 00 00 00 00 00 EF 53 8D 9F ....&... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.016831, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:37.016852, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:37.016874, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:37.016899, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:37.016920, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.016940, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:37.016978, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:37.017002, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:37.017024, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.017044, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.017065, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.017084, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.017119, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:37.017142, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:37.017289, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.017313, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.017336, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.017356, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.017390, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:37.017413, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:37.017436, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.017456, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.017478, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.017498, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.017545, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:37.017569, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:37.017591, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.017613, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.017636, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.017656, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.017689, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:37.017712, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (8->9) [2014/08/16 20:14:37.017734, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.017755, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.017777, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.017797, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.017833, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_SW] [2014/08/16 20:14:37.017856, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (9->10) [2014/08/16 20:14:37.017879, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.017899, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.017922, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.017942, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.017980, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (10->9) [2014/08/16 20:14:37.018007, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (9->8) [2014/08/16 20:14:37.018030, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:37.018051, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:37.018072, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:37.018093, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:37.018115, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[4] [0000] 00 00 00 00 27 01 00 00 00 00 00 00 EF 53 8D 9F ....'... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.018253, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000127-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.018355, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000127-0000-0000-ef53-8d9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:37.018532, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 27 01 00 00 00 00 00 00 EF 53 8D 9F ....'... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.018573, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.018594, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:37.018615, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW' (ops 0x7ffd8125b800) [2014/08/16 20:14:37.018640, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.018675, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Attributes] len[4] [2014/08/16 20:14:37.018699, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Description] len[2] [2014/08/16 20:14:37.018721, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Datatype] len[8] [2014/08/16 20:14:37.018744, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Default Priority] len[4] [2014/08/16 20:14:37.018766, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Port] len[38] [2014/08/16 20:14:37.018788, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Name] len[28] [2014/08/16 20:14:37.018810, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Print Processor] len[18] [2014/08/16 20:14:37.018833, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Priority] len[4] [2014/08/16 20:14:37.018855, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[Security] len[248] [2014/08/16 20:14:37.018878, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[Share Name] len[28] [2014/08/16 20:14:37.018900, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[StartTime] len[4] [2014/08/16 20:14:37.018923, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[UntilTime] len[4] [2014/08/16 20:14:37.018945, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[ChangeID] len[4] [2014/08/16 20:14:37.018968, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : NULL data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) result : WERR_OK [2014/08/16 20:14:37.019080, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000127-0000-0000-ef53-8d9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_BINARY (3) data : * data: ARRAY(0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:37.019376, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 27 01 00 00 00 00 00 00 EF 53 8D 9F ....'... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.019419, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_SW] [2014/08/16 20:14:37.019440, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:37.019464, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : * data: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:37.021936, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000127-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.022005, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 27 01 00 00 00 00 00 00 EF 53 8D 9F ....'... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.022045, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 27 01 00 00 00 00 00 00 EF 53 8D 9F ....'... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.022083, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.022105, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:37.022126, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.022327, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000126-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.022396, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 26 01 00 00 00 00 00 00 EF 53 8D 9F ....&... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.022437, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 26 01 00 00 00 00 00 00 EF 53 8D 9F ....&... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.022476, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.022498, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:37.022519, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.022607, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000125-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.022674, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.022714, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 25 01 00 00 00 00 00 00 EF 53 8D 9F ....%... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.022753, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.022776, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:37.022797, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.022879, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000124-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.022947, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 24 01 00 00 00 00 00 00 EF 53 8D 9F ....$... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.022987, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 24 01 00 00 00 00 00 00 EF 53 8D 9F ....$... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.023026, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.023046, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:37.023079, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.023263, 4, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/spoolss/srv_spoolss_nt.c:4337(enum_all_printers_info_level) Found a printer in smb.conf: SHMX2600-6_F[6] [2014/08/16 20:14:37.023304, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.023419, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:37.023443, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:37.023466, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:37.023488, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:37.023508, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:37.023529, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:37.023608, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:37.023632, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:37.023655, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:37.023676, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:37.023696, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.023716, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:37.023755, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 28 01 00 00 00 00 00 00 EF 53 8D 9F ....(... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.023797, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000128-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.023888, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000128-0000-0000-ef53-8d9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.024117, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 28 01 00 00 00 00 00 00 EF 53 8D 9F ....(... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.024264, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:37.024299, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:37.024322, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:37.024342, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:37.024364, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.024384, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:37.024422, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:37.024446, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:37.024468, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.024489, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.024510, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.024530, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.024564, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:37.024587, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:37.024613, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.024634, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.024655, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.024675, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.024707, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:37.024730, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:37.024752, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.024773, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.024794, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.024814, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.024856, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:37.024880, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:37.024902, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.024923, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.024945, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.024965, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.024997, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:37.025020, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:37.025042, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.025062, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.025088, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.025109, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.025146, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:37.025281, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:37.025307, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.025328, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.025351, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.025371, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.025411, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:37.025435, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:37.025456, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:37.025478, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:37.025499, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:37.025520, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:37.025542, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 29 01 00 00 00 00 00 00 EF 53 8D 9F ....)... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.025582, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000129-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.025666, 2, pid=1080, effective(0, 10000), real(0, 0)] ../source3/rpc_client/cli_winreg_spoolss.c:626(winreg_create_printer) winreg_create_printer: Skipping, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F already exists [2014/08/16 20:14:37.025699, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000129-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.025767, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 29 01 00 00 00 00 00 00 EF 53 8D 9F ....)... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.025807, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 29 01 00 00 00 00 00 00 EF 53 8D 9F ....)... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.025846, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.025867, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:37.025888, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.025971, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000128-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.026037, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 28 01 00 00 00 00 00 00 EF 53 8D 9F ....(... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.026077, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 28 01 00 00 00 00 00 00 EF 53 8D 9F ....(... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.026116, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.026136, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:37.026260, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.026361, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.026481, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:37.026504, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx) push_sec_ctx(0, 10000) : sec_ctx_stack_ndx = 2 [2014/08/16 20:14:37.026526, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:485(push_conn_ctx) push_conn_ctx(2976201587) : conn_ctx_stack_ndx = 0 [2014/08/16 20:14:37.026547, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2014/08/16 20:14:37.026567, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug) Security token: (NULL) [2014/08/16 20:14:37.026587, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2014/08/16 20:14:37.026646, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 1 [2014/08/16 20:14:37.026670, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:866(regdb_open) regdb_open: registry db opened. refcount reset (1) [2014/08/16 20:14:37.026692, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:37.026713, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:37.026734, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.026753, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:37.026791, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[1] [0000] 00 00 00 00 2A 01 00 00 00 00 00 00 EF 53 8D 9F ....*... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.026834, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012a-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.026924, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012a-0000-0000-ef53-8d9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.027255, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2A 01 00 00 00 00 00 00 EF 53 8D 9F ....*... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.027318, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:37.027340, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (1->2) [2014/08/16 20:14:37.027362, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:37.027383, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:37.027404, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.027424, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:37.027463, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:37.027486, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:37.027508, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.027528, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.027550, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.027570, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.027604, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:37.027627, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:37.027649, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.027673, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.027695, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.027721, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.027752, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:37.027774, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:37.027796, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.027815, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.027836, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.027856, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.027895, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:37.027918, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:37.027940, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.027960, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.027981, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.028001, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.028032, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:37.028054, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:37.028076, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.028095, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.028117, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.028139, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.028313, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:37.028343, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:37.028367, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.028388, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.028411, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.028431, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.028469, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:37.028493, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:37.028515, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:37.028536, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:37.028557, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:37.028578, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:37.028600, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[2] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.028640, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.028732, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey in: struct winreg_QueryInfoKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL [2014/08/16 20:14:37.028848, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.028891, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' (ops 0x7ffd8125b800) [2014/08/16 20:14:37.028913, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.028947, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Description] len[2] [2014/08/16 20:14:37.028971, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Datatype] len[8] [2014/08/16 20:14:37.028993, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Default Priority] len[4] [2014/08/16 20:14:37.029016, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Port] len[38] [2014/08/16 20:14:37.029038, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Print Processor] len[18] [2014/08/16 20:14:37.029060, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Priority] len[4] [2014/08/16 20:14:37.029082, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Security] len[248] [2014/08/16 20:14:37.029105, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Share Name] len[26] [2014/08/16 20:14:37.029127, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[StartTime] len[4] [2014/08/16 20:14:37.029149, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[UntilTime] len[4] [2014/08/16 20:14:37.029275, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[Attributes] len[4] [2014/08/16 20:14:37.029300, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[Printer Driver] len[36] [2014/08/16 20:14:37.029323, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[Location] len[2] [2014/08/16 20:14:37.029346, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[13]: name[Parameters] len[2] [2014/08/16 20:14:37.029368, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[14]: name[Name] len[36] [2014/08/16 20:14:37.029394, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[15]: name[Separator File] len[2] [2014/08/16 20:14:37.029417, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[16]: name[Status] len[4] [2014/08/16 20:14:37.029439, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[17]: name[ChangeID] len[4] [2014/08/16 20:14:37.029462, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:2074(regdb_get_secdesc) regdb_get_secdesc: Getting secdesc of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.029496, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryInfoKey: struct winreg_QueryInfoKey out: struct winreg_QueryInfoKey classname : * classname: struct winreg_String name_len : 0x0000 (0) name_size : 0x0000 (0) name : NULL num_subkeys : * num_subkeys : 0x00000003 (3) max_subkeylen : * max_subkeylen : 0x00000022 (34) max_classlen : * max_classlen : 0x00000000 (0) num_values : * num_values : 0x00000012 (18) max_valnamelen : * max_valnamelen : 0x00000022 (34) max_valbufsize : * max_valbufsize : 0x000000f8 (248) secdescsize : * secdescsize : 0x00000078 (120) last_changed_time : * last_changed_time : NTTIME(0) result : WERR_OK [2014/08/16 20:14:37.029728, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000000 (0) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.029922, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.029963, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.029990, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0018 (24) size : 0x0024 (36) name : * name : 'Description' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:37.030277, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000001 (1) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.030474, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.030516, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.030539, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Datatype' type : * type : REG_SZ (1) value : * value: ARRAY(8) [0] : 0x52 (82) [1] : 0x00 (0) [2] : 0x41 (65) [3] : 0x00 (0) [4] : 0x57 (87) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) size : * size : 0x00000008 (8) length : * length : 0x00000008 (8) result : WERR_OK [2014/08/16 20:14:37.030782, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000002 (2) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.030973, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.031014, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.031037, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0022 (34) size : 0x0024 (36) name : * name : 'Default Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.031360, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000003 (3) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.031557, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.031598, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.031622, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Port' type : * type : REG_SZ (1) value : * value: ARRAY(38) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x61 (97) [3] : 0x00 (0) [4] : 0x6d (109) [5] : 0x00 (0) [6] : 0x62 (98) [7] : 0x00 (0) [8] : 0x61 (97) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x50 (80) [13] : 0x00 (0) [14] : 0x72 (114) [15] : 0x00 (0) [16] : 0x69 (105) [17] : 0x00 (0) [18] : 0x6e (110) [19] : 0x00 (0) [20] : 0x74 (116) [21] : 0x00 (0) [22] : 0x65 (101) [23] : 0x00 (0) [24] : 0x72 (114) [25] : 0x00 (0) [26] : 0x20 (32) [27] : 0x00 (0) [28] : 0x50 (80) [29] : 0x00 (0) [30] : 0x6f (111) [31] : 0x00 (0) [32] : 0x72 (114) [33] : 0x00 (0) [34] : 0x74 (116) [35] : 0x00 (0) [36] : 0x00 (0) [37] : 0x00 (0) size : * size : 0x00000026 (38) length : * length : 0x00000026 (38) result : WERR_OK [2014/08/16 20:14:37.032110, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000004 (4) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.032421, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.032462, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.032485, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0020 (32) size : 0x0024 (36) name : * name : 'Print Processor' type : * type : REG_SZ (1) value : * value: ARRAY(18) [0] : 0x77 (119) [1] : 0x00 (0) [2] : 0x69 (105) [3] : 0x00 (0) [4] : 0x6e (110) [5] : 0x00 (0) [6] : 0x70 (112) [7] : 0x00 (0) [8] : 0x72 (114) [9] : 0x00 (0) [10] : 0x69 (105) [11] : 0x00 (0) [12] : 0x6e (110) [13] : 0x00 (0) [14] : 0x74 (116) [15] : 0x00 (0) [16] : 0x00 (0) [17] : 0x00 (0) size : * size : 0x00000012 (18) length : * length : 0x00000012 (18) result : WERR_OK [2014/08/16 20:14:37.032806, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000005 (5) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.032993, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.033032, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.033055, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Priority' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.033378, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000006 (6) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.033569, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.033608, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.033631, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Security' type : * type : REG_BINARY (3) value : * value: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) size : * size : 0x000000f8 (248) length : * length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:37.036330, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000007 (7) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.036531, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.036573, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.036596, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Share Name' type : * type : REG_SZ (1) value : * value: ARRAY(26) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x4d (77) [5] : 0x00 (0) [6] : 0x58 (88) [7] : 0x00 (0) [8] : 0x32 (50) [9] : 0x00 (0) [10] : 0x36 (54) [11] : 0x00 (0) [12] : 0x30 (48) [13] : 0x00 (0) [14] : 0x30 (48) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x36 (54) [19] : 0x00 (0) [20] : 0x5f (95) [21] : 0x00 (0) [22] : 0x46 (70) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) size : * size : 0x0000001a (26) length : * length : 0x0000001a (26) result : WERR_OK [2014/08/16 20:14:37.036984, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000008 (8) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.037279, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.037321, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.037345, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'StartTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.037549, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000009 (9) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.037749, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.037790, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.037813, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0014 (20) size : 0x0024 (36) name : * name : 'UntilTime' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.038016, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000a (10) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.038309, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.038351, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.038374, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Attributes' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x48 (72) [1] : 0x18 (24) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.038583, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000b (11) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.038774, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.038814, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.038837, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x001e (30) size : 0x0024 (36) name : * name : 'Printer Driver' type : * type : REG_SZ (1) value : * value: ARRAY(36) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x41 (65) [5] : 0x00 (0) [6] : 0x52 (82) [7] : 0x00 (0) [8] : 0x50 (80) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x4d (77) [13] : 0x00 (0) [14] : 0x58 (88) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x32 (50) [19] : 0x00 (0) [20] : 0x36 (54) [21] : 0x00 (0) [22] : 0x30 (48) [23] : 0x00 (0) [24] : 0x30 (48) [25] : 0x00 (0) [26] : 0x4e (78) [27] : 0x00 (0) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x50 (80) [31] : 0x00 (0) [32] : 0x53 (83) [33] : 0x00 (0) [34] : 0x00 (0) [35] : 0x00 (0) size : * size : 0x00000024 (36) length : * length : 0x00000024 (36) result : WERR_OK [2014/08/16 20:14:37.039433, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000c (12) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.039625, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.039672, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.039695, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'Location' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:37.039880, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000d (13) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.040065, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.040104, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.040127, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0016 (22) size : 0x0024 (36) name : * name : 'Parameters' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:37.040441, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000e (14) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.040634, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.040674, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.040697, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000a (10) size : 0x0024 (36) name : * name : 'Name' type : * type : REG_SZ (1) value : * value: ARRAY(36) [0] : 0x53 (83) [1] : 0x00 (0) [2] : 0x48 (72) [3] : 0x00 (0) [4] : 0x41 (65) [5] : 0x00 (0) [6] : 0x52 (82) [7] : 0x00 (0) [8] : 0x50 (80) [9] : 0x00 (0) [10] : 0x20 (32) [11] : 0x00 (0) [12] : 0x4d (77) [13] : 0x00 (0) [14] : 0x58 (88) [15] : 0x00 (0) [16] : 0x2d (45) [17] : 0x00 (0) [18] : 0x32 (50) [19] : 0x00 (0) [20] : 0x36 (54) [21] : 0x00 (0) [22] : 0x30 (48) [23] : 0x00 (0) [24] : 0x30 (48) [25] : 0x00 (0) [26] : 0x4e (78) [27] : 0x00 (0) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x50 (80) [31] : 0x00 (0) [32] : 0x53 (83) [33] : 0x00 (0) [34] : 0x00 (0) [35] : 0x00 (0) size : * size : 0x00000024 (36) length : * length : 0x00000024 (36) result : WERR_OK [2014/08/16 20:14:37.041268, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x0000000f (15) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.041473, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.041513, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.041535, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x001e (30) size : 0x0024 (36) name : * name : 'Separator File' type : * type : REG_SZ (1) value : * value: ARRAY(2) [0] : 0x00 (0) [1] : 0x00 (0) size : * size : 0x00000002 (2) length : * length : 0x00000002 (2) result : WERR_OK [2014/08/16 20:14:37.041718, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000010 (16) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.041907, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.041947, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.041969, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x000e (14) size : 0x0024 (36) name : * name : 'Status' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x00 (0) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.042276, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue in: struct winreg_EnumValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 enum_index : 0x00000011 (17) name : * name: struct winreg_ValNameBuf length : 0x0002 (2) size : 0x0024 (36) name : * name : '' type : * type : REG_NONE (0) value : * value: ARRAY(0) size : * size : 0x000000f8 (248) length : * length : 0x00000000 (0) [2014/08/16 20:14:37.042474, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.042514, 8, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:453(_winreg_EnumValue) _winreg_EnumValue: enumerating values for key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.042536, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_EnumValue: struct winreg_EnumValue out: struct winreg_EnumValue name : * name: struct winreg_ValNameBuf length : 0x0012 (18) size : 0x0024 (36) name : * name : 'ChangeID' type : * type : REG_DWORD (4) value : * value: ARRAY(4) [0] : 0x8d (141) [1] : 0xcd (205) [2] : 0x1b (27) [3] : 0x00 (0) size : * size : 0x00000004 (4) length : * length : 0x00000004 (4) result : WERR_OK [2014/08/16 20:14:37.042765, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0020 (32) name_size : 0x0020 (32) name : * name : 'Default DevMode' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:37.042937, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.042977, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.042998, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:37.043020, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:316(_winreg_QueryValue) _winreg_QueryValue: reg_queryvalue failed with: WERR_BADFILE [2014/08/16 20:14:37.043040, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) result : WERR_BADFILE [2014/08/16 20:14:37.043149, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM in: struct winreg_OpenHKLM system_name : NULL access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.043388, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [HKLM] [2014/08/16 20:14:37.043412, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (2->3) [2014/08/16 20:14:37.043434, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM] [2014/08/16 20:14:37.043454, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM] [2014/08/16 20:14:37.043474, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.043494, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM] [2014/08/16 20:14:37.043531, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[3] [0000] 00 00 00 00 2C 01 00 00 00 00 00 00 EF 53 8D 9F ....,... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.043574, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenHKLM: struct winreg_OpenHKLM out: struct winreg_OpenHKLM handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012c-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.043667, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey in: struct winreg_OpenKey parent_handle : * parent_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012c-0000-0000-ef53-8d9f38040000 keyname: struct winreg_String name_len : 0x0092 (146) name_size : 0x0092 (146) name : * name : 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' options : 0x00000000 (0) 0: REG_OPTION_VOLATILE 0: REG_OPTION_CREATE_LINK 0: REG_OPTION_BACKUP_RESTORE 0: REG_OPTION_OPEN_LINK access_mask : 0x02000000 (33554432) 0: KEY_QUERY_VALUE 0: KEY_SET_VALUE 0: KEY_CREATE_SUB_KEY 0: KEY_ENUMERATE_SUB_KEYS 0: KEY_NOTIFY 0: KEY_CREATE_LINK 0: KEY_WOW64_64KEY 0: KEY_WOW64_32KEY [2014/08/16 20:14:37.043882, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2C 01 00 00 00 00 00 00 EF 53 8D 9F ....,... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.043925, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SOFTWARE] [2014/08/16 20:14:37.043946, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (3->4) [2014/08/16 20:14:37.043967, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE] [2014/08/16 20:14:37.043986, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE] [2014/08/16 20:14:37.044006, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.044025, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE] [2014/08/16 20:14:37.044061, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Microsoft] [2014/08/16 20:14:37.044083, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (4->5) [2014/08/16 20:14:37.044104, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.044129, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.044150, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.044284, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft] [2014/08/16 20:14:37.044330, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Windows NT] [2014/08/16 20:14:37.044353, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (5->6) [2014/08/16 20:14:37.044375, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.044411, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.044440, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.044479, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT] [2014/08/16 20:14:37.044524, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [CurrentVersion] [2014/08/16 20:14:37.044560, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (6->7) [2014/08/16 20:14:37.044585, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.044606, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.044641, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.044660, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion] [2014/08/16 20:14:37.044701, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Print] [2014/08/16 20:14:37.044723, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (7->8) [2014/08/16 20:14:37.044745, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.044765, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.044787, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.044807, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd81c0fd60 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print] [2014/08/16 20:14:37.044838, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [Printers] [2014/08/16 20:14:37.044860, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (8->9) [2014/08/16 20:14:37.044882, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.044902, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.044924, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.044944, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers] [2014/08/16 20:14:37.044985, 7, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_api.c:143(regkey_open_onelevel) regkey_open_onelevel: name = [SHMX2600-6_F] [2014/08/16 20:14:37.045008, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:846(regdb_open) regdb_open: incrementing refcount (9->10) [2014/08/16 20:14:37.045031, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:125(reghook_cache_find) reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.045058, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:367(pathtree_find) pathtree_find: Enter [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.045099, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/lib/adt_tree.c:440(pathtree_find) pathtree_find: Exit [2014/08/16 20:14:37.045119, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_cachehook.c:130(reghook_cache_find) reghook_cache_find: found ops 0x7ffd8125b800 for key [\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.045156, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (10->9) [2014/08/16 20:14:37.045301, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (9->8) [2014/08/16 20:14:37.045325, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (8->7) [2014/08/16 20:14:37.045346, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (7->6) [2014/08/16 20:14:37.045366, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (6->5) [2014/08/16 20:14:37.045387, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (5->4) [2014/08/16 20:14:37.045408, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:302(create_rpc_handle_internal) Opened policy hnd[4] [0000] 00 00 00 00 2D 01 00 00 00 00 00 00 EF 53 8D 9F ....-... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.045448, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_OpenKey: struct winreg_OpenKey out: struct winreg_OpenKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012d-0000-0000-ef53-8d9f38040000 result : WERR_OK [2014/08/16 20:14:37.045539, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012d-0000-0000-ef53-8d9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_NONE (0) data : NULL data_size : * data_size : 0x00000000 (0) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:37.045710, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2D 01 00 00 00 00 00 00 EF 53 8D 9F ....-... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.045750, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.045775, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:37.045795, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_dispatcher.c:151(fetch_reg_values) fetch_reg_values called for key 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F' (ops 0x7ffd8125b800) [2014/08/16 20:14:37.045816, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1891(regdb_fetch_values_internal) regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.045848, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[0]: name[Description] len[2] [2014/08/16 20:14:37.045872, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[1]: name[Datatype] len[8] [2014/08/16 20:14:37.045893, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[2]: name[Default Priority] len[4] [2014/08/16 20:14:37.045915, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[3]: name[Port] len[38] [2014/08/16 20:14:37.045936, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[4]: name[Print Processor] len[18] [2014/08/16 20:14:37.045958, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[5]: name[Priority] len[4] [2014/08/16 20:14:37.045979, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[6]: name[Security] len[248] [2014/08/16 20:14:37.046001, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[7]: name[Share Name] len[26] [2014/08/16 20:14:37.046022, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[8]: name[StartTime] len[4] [2014/08/16 20:14:37.046043, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[9]: name[UntilTime] len[4] [2014/08/16 20:14:37.046065, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[10]: name[Attributes] len[4] [2014/08/16 20:14:37.046086, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[11]: name[Printer Driver] len[36] [2014/08/16 20:14:37.046115, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[12]: name[Location] len[2] [2014/08/16 20:14:37.046137, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[13]: name[Parameters] len[2] [2014/08/16 20:14:37.046159, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[14]: name[Name] len[36] [2014/08/16 20:14:37.046288, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[15]: name[Separator File] len[2] [2014/08/16 20:14:37.046313, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[16]: name[Status] len[4] [2014/08/16 20:14:37.046336, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:1836(regdb_unpack_values) regdb_unpack_values: value[17]: name[ChangeID] len[4] [2014/08/16 20:14:37.046359, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : NULL data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) result : WERR_OK [2014/08/16 20:14:37.046473, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue in: struct winreg_QueryValue handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012d-0000-0000-ef53-8d9f38040000 value_name : * value_name: struct winreg_String name_len : 0x0012 (18) name_size : 0x0012 (18) name : * name : 'Security' type : * type : REG_BINARY (3) data : * data: ARRAY(0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x00000000 (0) [2014/08/16 20:14:37.046657, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2D 01 00 00 00 00 00 00 EF 53 8D 9F ....-... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.046697, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:263(_winreg_QueryValue) _winreg_QueryValue: policy key name = [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\SHMX2600-6_F] [2014/08/16 20:14:37.046719, 7, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/winreg/srv_winreg_nt.c:264(_winreg_QueryValue) _winreg_QueryValue: policy key type = [00000000] [2014/08/16 20:14:37.046742, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_QueryValue: struct winreg_QueryValue out: struct winreg_QueryValue type : * type : REG_BINARY (3) data : * data: ARRAY(248) [0] : 0x01 (1) [1] : 0x00 (0) [2] : 0x04 (4) [3] : 0x80 (128) [4] : 0x14 (20) [5] : 0x00 (0) [6] : 0x00 (0) [7] : 0x00 (0) [8] : 0x24 (36) [9] : 0x00 (0) [10] : 0x00 (0) [11] : 0x00 (0) [12] : 0x00 (0) [13] : 0x00 (0) [14] : 0x00 (0) [15] : 0x00 (0) [16] : 0x34 (52) [17] : 0x00 (0) [18] : 0x00 (0) [19] : 0x00 (0) [20] : 0x01 (1) [21] : 0x02 (2) [22] : 0x00 (0) [23] : 0x00 (0) [24] : 0x00 (0) [25] : 0x00 (0) [26] : 0x00 (0) [27] : 0x05 (5) [28] : 0x20 (32) [29] : 0x00 (0) [30] : 0x00 (0) [31] : 0x00 (0) [32] : 0x20 (32) [33] : 0x02 (2) [34] : 0x00 (0) [35] : 0x00 (0) [36] : 0x01 (1) [37] : 0x02 (2) [38] : 0x00 (0) [39] : 0x00 (0) [40] : 0x00 (0) [41] : 0x00 (0) [42] : 0x00 (0) [43] : 0x05 (5) [44] : 0x20 (32) [45] : 0x00 (0) [46] : 0x00 (0) [47] : 0x00 (0) [48] : 0x20 (32) [49] : 0x02 (2) [50] : 0x00 (0) [51] : 0x00 (0) [52] : 0x02 (2) [53] : 0x00 (0) [54] : 0xc4 (196) [55] : 0x00 (0) [56] : 0x07 (7) [57] : 0x00 (0) [58] : 0x00 (0) [59] : 0x00 (0) [60] : 0x00 (0) [61] : 0x02 (2) [62] : 0x14 (20) [63] : 0x00 (0) [64] : 0x08 (8) [65] : 0x00 (0) [66] : 0x02 (2) [67] : 0x20 (32) [68] : 0x01 (1) [69] : 0x01 (1) [70] : 0x00 (0) [71] : 0x00 (0) [72] : 0x00 (0) [73] : 0x00 (0) [74] : 0x00 (0) [75] : 0x01 (1) [76] : 0x00 (0) [77] : 0x00 (0) [78] : 0x00 (0) [79] : 0x00 (0) [80] : 0x00 (0) [81] : 0x09 (9) [82] : 0x24 (36) [83] : 0x00 (0) [84] : 0x0c (12) [85] : 0x00 (0) [86] : 0x0f (15) [87] : 0x10 (16) [88] : 0x01 (1) [89] : 0x05 (5) [90] : 0x00 (0) [91] : 0x00 (0) [92] : 0x00 (0) [93] : 0x00 (0) [94] : 0x00 (0) [95] : 0x05 (5) [96] : 0x15 (21) [97] : 0x00 (0) [98] : 0x00 (0) [99] : 0x00 (0) [100] : 0x9a (154) [101] : 0x49 (73) [102] : 0xdc (220) [103] : 0xba (186) [104] : 0x6f (111) [105] : 0x8a (138) [106] : 0xf0 (240) [107] : 0x24 (36) [108] : 0xa2 (162) [109] : 0x40 (64) [110] : 0x91 (145) [111] : 0xd7 (215) [112] : 0xf4 (244) [113] : 0x01 (1) [114] : 0x00 (0) [115] : 0x00 (0) [116] : 0x00 (0) [117] : 0x02 (2) [118] : 0x24 (36) [119] : 0x00 (0) [120] : 0x0c (12) [121] : 0x00 (0) [122] : 0x0f (15) [123] : 0x10 (16) [124] : 0x01 (1) [125] : 0x05 (5) [126] : 0x00 (0) [127] : 0x00 (0) [128] : 0x00 (0) [129] : 0x00 (0) [130] : 0x00 (0) [131] : 0x05 (5) [132] : 0x15 (21) [133] : 0x00 (0) [134] : 0x00 (0) [135] : 0x00 (0) [136] : 0x9a (154) [137] : 0x49 (73) [138] : 0xdc (220) [139] : 0xba (186) [140] : 0x6f (111) [141] : 0x8a (138) [142] : 0xf0 (240) [143] : 0x24 (36) [144] : 0xa2 (162) [145] : 0x40 (64) [146] : 0x91 (145) [147] : 0xd7 (215) [148] : 0xf4 (244) [149] : 0x01 (1) [150] : 0x00 (0) [151] : 0x00 (0) [152] : 0x00 (0) [153] : 0x09 (9) [154] : 0x18 (24) [155] : 0x00 (0) [156] : 0x0c (12) [157] : 0x00 (0) [158] : 0x0f (15) [159] : 0x10 (16) [160] : 0x01 (1) [161] : 0x02 (2) [162] : 0x00 (0) [163] : 0x00 (0) [164] : 0x00 (0) [165] : 0x00 (0) [166] : 0x00 (0) [167] : 0x05 (5) [168] : 0x20 (32) [169] : 0x00 (0) [170] : 0x00 (0) [171] : 0x00 (0) [172] : 0x20 (32) [173] : 0x02 (2) [174] : 0x00 (0) [175] : 0x00 (0) [176] : 0x00 (0) [177] : 0x02 (2) [178] : 0x18 (24) [179] : 0x00 (0) [180] : 0x0c (12) [181] : 0x00 (0) [182] : 0x0f (15) [183] : 0x10 (16) [184] : 0x01 (1) [185] : 0x02 (2) [186] : 0x00 (0) [187] : 0x00 (0) [188] : 0x00 (0) [189] : 0x00 (0) [190] : 0x00 (0) [191] : 0x05 (5) [192] : 0x20 (32) [193] : 0x00 (0) [194] : 0x00 (0) [195] : 0x00 (0) [196] : 0x20 (32) [197] : 0x02 (2) [198] : 0x00 (0) [199] : 0x00 (0) [200] : 0x00 (0) [201] : 0x09 (9) [202] : 0x18 (24) [203] : 0x00 (0) [204] : 0x0c (12) [205] : 0x00 (0) [206] : 0x0f (15) [207] : 0x10 (16) [208] : 0x01 (1) [209] : 0x02 (2) [210] : 0x00 (0) [211] : 0x00 (0) [212] : 0x00 (0) [213] : 0x00 (0) [214] : 0x00 (0) [215] : 0x05 (5) [216] : 0x20 (32) [217] : 0x00 (0) [218] : 0x00 (0) [219] : 0x00 (0) [220] : 0x26 (38) [221] : 0x02 (2) [222] : 0x00 (0) [223] : 0x00 (0) [224] : 0x00 (0) [225] : 0x02 (2) [226] : 0x18 (24) [227] : 0x00 (0) [228] : 0x0c (12) [229] : 0x00 (0) [230] : 0x0f (15) [231] : 0x10 (16) [232] : 0x01 (1) [233] : 0x02 (2) [234] : 0x00 (0) [235] : 0x00 (0) [236] : 0x00 (0) [237] : 0x00 (0) [238] : 0x00 (0) [239] : 0x05 (5) [240] : 0x20 (32) [241] : 0x00 (0) [242] : 0x00 (0) [243] : 0x00 (0) [244] : 0x26 (38) [245] : 0x02 (2) [246] : 0x00 (0) [247] : 0x00 (0) data_size : * data_size : 0x000000f8 (248) data_length : * data_length : 0x000000f8 (248) result : WERR_OK [2014/08/16 20:14:37.049282, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012d-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.049357, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2D 01 00 00 00 00 00 00 EF 53 8D 9F ....-... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.049398, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2D 01 00 00 00 00 00 00 EF 53 8D 9F ....-... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.049437, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.049460, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (4->3) [2014/08/16 20:14:37.049481, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.049565, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012c-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.049637, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2C 01 00 00 00 00 00 00 EF 53 8D 9F ....,... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.049684, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2C 01 00 00 00 00 00 00 EF 53 8D 9F ....,... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.049722, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.049742, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (3->2) [2014/08/16 20:14:37.049762, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.049843, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012b-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.049908, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.049947, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2B 01 00 00 00 00 00 00 EF 53 8D 9F ....+... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.049985, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.050007, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (2->1) [2014/08/16 20:14:37.050028, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.050109, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey in: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 0000012a-0000-0000-ef53-8d9f38040000 [2014/08/16 20:14:37.050323, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2A 01 00 00 00 00 00 00 EF 53 8D 9F ....*... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.050365, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:337(find_policy_by_hnd_internal) Found policy hnd[0] [0000] 00 00 00 00 2A 01 00 00 00 00 00 00 EF 53 8D 9F ....*... .....S.. [0010] 38 04 00 00 8... [2014/08/16 20:14:37.050403, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:386(close_policy_hnd) Closed policy [2014/08/16 20:14:37.050423, 10, pid=1080, effective(0, 10000), real(0, 0), class=registry] ../source3/registry/reg_backend_db.c:883(regdb_close) regdb_close: decrementing refcount (1->0) [2014/08/16 20:14:37.050454, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) winreg_CloseKey: struct winreg_CloseKey out: struct winreg_CloseKey handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 result : WERR_OK [2014/08/16 20:14:37.050544, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/rpc_handles.c:416(close_policy_by_pipe) Deleted handle list for RPC connection \winreg [2014/08/16 20:14:37.050584, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:333(ndr_print_function_debug) spoolss_EnumPrinters: struct spoolss_EnumPrinters out: struct spoolss_EnumPrinters count : * count : 0x00000002 (2) info : * info : * info: ARRAY(2) info : union spoolss_PrinterInfo(case 5) info5: struct spoolss_PrinterInfo5 printername : * printername : '\\M1\SHMX2600-6_SW' portname : * portname : 'Samba Printer Port' attributes : 0x00001048 (4168) 0: PRINTER_ATTRIBUTE_QUEUED 0: PRINTER_ATTRIBUTE_DIRECT 0: PRINTER_ATTRIBUTE_DEFAULT 1: PRINTER_ATTRIBUTE_SHARED 0: PRINTER_ATTRIBUTE_NETWORK 0: PRINTER_ATTRIBUTE_HIDDEN 1: PRINTER_ATTRIBUTE_LOCAL 0: PRINTER_ATTRIBUTE_ENABLE_DEVQ 0: PRINTER_ATTRIBUTE_KEEPPRINTEDJOBS 0: PRINTER_ATTRIBUTE_DO_COMPLETE_FIRST 0: PRINTER_ATTRIBUTE_WORK_OFFLINE 0: PRINTER_ATTRIBUTE_ENABLE_BIDI 1: PRINTER_ATTRIBUTE_RAW_ONLY 0: PRINTER_ATTRIBUTE_PUBLISHED 0: PRINTER_ATTRIBUTE_FAX 0: PRINTER_ATTRIBUTE_TS device_not_selected_timeout: 0x00000000 (0) transmission_retry_timeout: 0x00000000 (0) info : union spoolss_PrinterInfo(case 5) info5: struct spoolss_PrinterInfo5 printername : * printername : '\\M1\SHARP MX-2600N PS' portname : * portname : 'Samba Printer Port' attributes : 0x00001848 (6216) 0: PRINTER_ATTRIBUTE_QUEUED 0: PRINTER_ATTRIBUTE_DIRECT 0: PRINTER_ATTRIBUTE_DEFAULT 1: PRINTER_ATTRIBUTE_SHARED 0: PRINTER_ATTRIBUTE_NETWORK 0: PRINTER_ATTRIBUTE_HIDDEN 1: PRINTER_ATTRIBUTE_LOCAL 0: PRINTER_ATTRIBUTE_ENABLE_DEVQ 0: PRINTER_ATTRIBUTE_KEEPPRINTEDJOBS 0: PRINTER_ATTRIBUTE_DO_COMPLETE_FIRST 0: PRINTER_ATTRIBUTE_WORK_OFFLINE 1: PRINTER_ATTRIBUTE_ENABLE_BIDI 1: PRINTER_ATTRIBUTE_RAW_ONLY 0: PRINTER_ATTRIBUTE_PUBLISHED 0: PRINTER_ATTRIBUTE_FAX 0: PRINTER_ATTRIBUTE_TS device_not_selected_timeout: 0x00000000 (0) transmission_retry_timeout: 0x00000000 (0) needed : * needed : 0x000000d0 (208) result : WERR_OK [2014/08/16 20:14:37.051114, 5, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1417(api_rpcTNP) api_rpcTNP: called \spoolss successfully [2014/08/16 20:14:37.051145, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx) pop_sec_ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:37.051278, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:248(write_to_internal_pipe) write_to_pipe: data_used = 384 smbd_smb2_request_pending_queue: req->current_idx = 1 req->in.vector[0].iov_len = 0 req->in.vector[1].iov_len = 0 req->in.vector[2].iov_len = 64 req->in.vector[3].iov_len = 56 req->in.vector[4].iov_len = 400 req->out.vector[0].iov_len = 4 req->out.vector[1].iov_len = 0 req->out.vector[2].iov_len = 64 req->out.vector[3].iov_len = 8 req->out.vector[4].iov_len = 0 [2014/08/16 20:14:37.051403, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:128(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: received 400 [2014/08/16 20:14:37.051427, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:149(smbd_smb2_ioctl_pipe_write_done) smbd_smb2_ioctl_pipe_write_done: issuing np_read_send of size 1024 [2014/08/16 20:14:37.051448, 6, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:285(read_from_internal_pipe) name: \spoolss len: 1024 [2014/08/16 20:14:37.051470, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:347(read_from_internal_pipe) read_from_pipe: \spoolss: fault_state = 0 : data_sent_length = 0, p->out_data.rdata.length = 348. [2014/08/16 20:14:37.051498, 1, pid=1080, effective(0, 10000), real(0, 0)] ../librpc/ndr/ndr.c:296(ndr_print_debug) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0174 (372) auth_length : 0x0000 (0) call_id : 0x00000002 (2) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000015c (348) context_id : 0x0000 (0) cancel_count : 0x00 (0) _pad : DATA_BLOB length=0 stub_and_verifier : DATA_BLOB length=348 [0000] 08 00 02 00 48 01 00 00 22 01 00 00 FC 00 00 00 ....H... "....... [0010] 48 10 00 00 00 00 00 00 00 00 00 00 BA 00 00 00 H....... ........ [0020] 94 00 00 00 48 18 00 00 00 00 00 00 00 00 00 00 ....H... ........ [0030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0050] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0060] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0070] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0080] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [0090] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00A0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [00B0] 53 00 61 00 6D 00 62 00 61 00 20 00 50 00 72 00 S.a.m.b. a. .P.r. [00C0] 69 00 6E 00 74 00 65 00 72 00 20 00 50 00 6F 00 i.n.t.e. r. .P.o. [00D0] 72 00 74 00 00 00 5C 00 5C 00 4D 00 31 00 5C 00 r.t...\. \.M.1.\. [00E0] 53 00 48 00 41 00 52 00 50 00 20 00 4D 00 58 00 S.H.A.R. P. .M.X. [00F0] 2D 00 32 00 36 00 30 00 30 00 4E 00 20 00 50 00 -.2.6.0. 0.N. .P. [0100] 53 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 S...S.a. m.b.a. . [0110] 50 00 72 00 69 00 6E 00 74 00 65 00 72 00 20 00 P.r.i.n. t.e.r. . [0120] 50 00 6F 00 72 00 74 00 00 00 5C 00 5C 00 4D 00 P.o.r.t. ..\.\.M. [0130] 31 00 5C 00 53 00 48 00 4D 00 58 00 32 00 36 00 1.\.S.H. M.X.2.6. [0140] 30 00 30 00 2D 00 36 00 5F 00 53 00 57 00 00 00 0.0.-.6. _.S.W... [0150] D0 00 00 00 02 00 00 00 00 00 00 00 ........ .... [2014/08/16 20:14:37.052050, 3, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:122(free_pipe_context) free_pipe_context: destroying talloc pool of size 1821 [2014/08/16 20:14:37.052077, 10, pid=1080, effective(0, 10000), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe_hnd.c:788(np_read_recv) Received 372 bytes. There is no more data outstanding [2014/08/16 20:14:37.052105, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl_named_pipe.c:178(smbd_smb2_ioctl_pipe_read_done) smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = 372 is_data_outstanding = 0, status = NT_STATUS_OK [2014/08/16 20:14:37.052128, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_ioctl.c:291(smbd_smb2_request_ioctl_done) smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned 372 status NT_STATUS_OK [2014/08/16 20:14:37.052151, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[48] dyn[yes:372] at ../source3/smbd/smb2_ioctl.c:358 [2014/08/16 20:14:37.052282, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/167/31 [2014/08/16 20:14:37.052762, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:3257(smbd_smb2_io_handler) smbd_smb2_request idx[1] of 5 vectors [2014/08/16 20:14:37.052793, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:621(smb2_validate_sequence_number) smb2_validate_sequence_number: clearing id 167 (position 167) from bitmap [2014/08/16 20:14:37.052821, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:1878(smbd_smb2_request_dispatch) smbd_smb2_request_dispatch: opcode[SMB2_OP_CLOSE] mid = 167 [2014/08/16 20:14:37.052851, 4, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx) setting sec ctx (0, 10000) - sec_ctx_stack_ndx = 0 [2014/08/16 20:14:37.052875, 5, pid=1080, effective(0, 10000), real(0, 0)] ../libcli/security/security_token.c:63(security_token_debug) Security token SIDs (21): SID[ 0]: S-1-5-21-3134998938-619743855-3616620706-500 SID[ 1]: S-1-5-21-3134998938-619743855-3616620706-513 SID[ 2]: S-1-5-21-3134998938-619743855-3616620706-520 SID[ 3]: S-1-5-21-3134998938-619743855-3616620706-572 SID[ 4]: S-1-5-21-3134998938-619743855-3616620706-519 SID[ 5]: S-1-5-21-3134998938-619743855-3616620706-518 SID[ 6]: S-1-5-21-3134998938-619743855-3616620706-512 SID[ 7]: S-1-5-21-3134998938-619743855-3616620706-1108 SID[ 8]: S-1-1-0 SID[ 9]: S-1-5-2 SID[ 10]: S-1-5-11 SID[ 11]: S-1-5-32-545 SID[ 12]: S-1-5-32-544 SID[ 13]: S-1-22-1-10000 SID[ 14]: S-1-22-2-10000 SID[ 15]: S-1-22-2-10002 SID[ 16]: S-1-22-2-70004 SID[ 17]: S-1-22-2-70005 SID[ 18]: S-1-22-2-70003 SID[ 19]: S-1-22-2-70002 SID[ 20]: S-1-22-2-70001 Privileges (0x 1FFFFFF0): Privilege[ 0]: SeMachineAccountPrivilege Privilege[ 1]: SeTakeOwnershipPrivilege Privilege[ 2]: SeBackupPrivilege Privilege[ 3]: SeRestorePrivilege Privilege[ 4]: SeRemoteShutdownPrivilege Privilege[ 5]: SePrintOperatorPrivilege Privilege[ 6]: SeAddUsersPrivilege Privilege[ 7]: SeDiskOperatorPrivilege Privilege[ 8]: SeSecurityPrivilege Privilege[ 9]: SeSystemtimePrivilege Privilege[ 10]: SeShutdownPrivilege Privilege[ 11]: SeDebugPrivilege Privilege[ 12]: SeSystemEnvironmentPrivilege Privilege[ 13]: SeSystemProfilePrivilege Privilege[ 14]: SeProfileSingleProcessPrivilege Privilege[ 15]: SeIncreaseBasePriorityPrivilege Privilege[ 16]: SeLoadDriverPrivilege Privilege[ 17]: SeCreatePagefilePrivilege Privilege[ 18]: SeIncreaseQuotaPrivilege Privilege[ 19]: SeChangeNotifyPrivilege Privilege[ 20]: SeUndockPrivilege Privilege[ 21]: SeManageVolumePrivilege Privilege[ 22]: SeImpersonatePrivilege Privilege[ 23]: SeCreateGlobalPrivilege Privilege[ 24]: SeEnableDelegationPrivilege Rights (0x 0): [2014/08/16 20:14:37.053352, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/auth/token_util.c:629(debug_unix_user_token) UNIX token of user 0 Primary group is 10000 and contains 7 supplementary groups Group[ 0]: 10000 Group[ 1]: 10002 Group[ 2]: 70004 Group[ 3]: 70005 Group[ 4]: 70003 Group[ 5]: 70002 Group[ 6]: 70001 [2014/08/16 20:14:37.053442, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/uid.c:363(change_to_user_internal) Impersonated user: uid=(0,0), gid=(0,10000) [2014/08/16 20:14:37.053472, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_close.c:185(smbd_smb2_close) smbd_smb2_close: spoolss - fnum 1673734789 [2014/08/16 20:14:37.053499, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:187(dbwrap_check_lock_order) check lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:37.053521, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1:/usr/var/samba/lock/smbXsrv_open_global.tdb 2: 3: [2014/08/16 20:14:37.053544, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Locking key 05F96A66 [2014/08/16 20:14:37.053571, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:143(db_tdb_fetch_locked_internal) Allocated locked data 0x0x7ffd8423a710 [2014/08/16 20:14:37.053602, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap_tdb.c:59(db_tdb_log_key) Unlocking key 05F96A66 [2014/08/16 20:14:37.053626, 5, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:146(dbwrap_lock_order_state_destructor) release lock order 1 for /usr/var/samba/lock/smbXsrv_open_global.tdb [2014/08/16 20:14:37.053647, 10, pid=1080, effective(0, 10000), real(0, 0)] ../lib/dbwrap/dbwrap.c:133(debug_lock_order) lock order: 1: 2: 3: [2014/08/16 20:14:37.053675, 5, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/files.c:528(file_free) freed files structure 1673734789 (2 used) [2014/08/16 20:14:37.053701, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:2499(smbd_smb2_request_done_ex) smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[60] dyn[no:0] at ../source3/smbd/smb2_close.c:144 [2014/08/16 20:14:37.053725, 10, pid=1080, effective(0, 10000), real(0, 0)] ../source3/smbd/smb2_server.c:874(smb2_set_operation_credit) smb2_set_operation_credit: requested 1, charge 1, granted 1, current possible/max 482/512, total granted/max/low/range 31/8192/168/31