[2005/10/28 18:12:39, 0] libsmb/credentials.c:creds_server_check(159) creds_server_check: credentials check failed. [2005/10/28 18:12:39, 0] rpc_server/srv_netlog_nt.c:_net_auth_2(424) _net_auth2: creds_server_check failed. Rejecting auth request from client MERLIN machine account MERLIN$ [2005/10/28 18:12:39, 0] rpc_server/srv_netlog_nt.c:get_md4pw(241) get_md4pw: Workstation MIDEARTH$: no account in domain [2005/10/28 18:12:39, 0] rpc_server/srv_netlog_nt.c:_net_auth_2(409) _net_auth2: failed to get machine password for account MIDEARTH$ [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] smbd/reply.c:reply_special(494) init msg_type=0x81 msg_flags=0x0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 179 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xb3 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 1 of length 183 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=179 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=55297 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=2 smt_wct=0 smb_bcc=144 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 .PC NETW ORK PROG [010] 52 41 4D 20 31 2E 30 00 02 4D 49 43 52 4F 53 4F RAM 1.0. .MICROSO [020] 46 54 20 4E 45 54 57 4F 52 4B 53 20 31 2E 30 33 FT NETWO RKS 1.03 [030] 00 02 4D 49 43 52 4F 53 4F 46 54 20 4E 45 54 57 ..MICROS OFT NETW [040] 4F 52 4B 53 20 33 2E 30 00 02 4C 41 4E 4D 41 4E ORKS 3.0 ..LANMAN [050] 31 2E 30 00 02 4C 4D 31 2E 32 58 30 30 32 00 02 1.0..LM1 .2X002.. [060] 44 4F 53 20 4C 41 4E 4D 41 4E 32 2E 31 00 02 53 DOS LANM AN2.1..S [070] 61 6D 62 61 00 02 4E 54 20 4C 41 4E 4D 41 4E 20 amba..NT LANMAN [080] 31 2E 30 00 02 4E 54 20 4C 4D 20 30 2E 31 32 00 1.0..NT LM 0.12. [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBnegprot (pid 6131) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [PC NETWORK PROGRAM 1.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [MICROSOFT NETWORKS 1.03] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [MICROSOFT NETWORKS 3.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [LANMAN1.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [LM1.2X002] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [DOS LANMAN2.1] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [Samba] [2005/10/28 18:13:40, 10] lib/util.c:set_remote_arch(2038) set_remote_arch: Client arch is 'Samba' [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] smbd/connection.c:claim_connection(170) claiming 0 [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_nt1(345) using SPNEGO [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(567) Selected protocol NT LANMAN 1.0 [2005/10/28 18:13:40, 5] smbd/negprot.c:reply_negprot(573) negprot index=7 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=85 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=2 smt_wct=17 smb_vwv[ 0]= 7 (0x7) smb_vwv[ 1]=12803 (0x3203) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]=62208 (0xF300) smb_vwv[ 8]= 23 (0x17) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]=32995 (0x80E3) smb_vwv[11]= 128 (0x80) smb_vwv[12]=15186 (0x3B52) smb_vwv[13]= 7581 (0x1D9D) smb_vwv[14]=50652 (0xC5DC) smb_vwv[15]=26625 (0x6801) smb_vwv[16]= 1 (0x1) smb_bcc=16 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 6D 65 72 6C 69 6E 00 00 00 00 00 00 00 00 00 00 merlin.. ........ [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 88 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x58 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 2 of length 92 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=88 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=3 smt_wct=13 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=65535 (0xFFFF) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 6130 (0x17F2) smb_vwv[ 5]= 6131 (0x17F3) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]=49244 (0xC05C) smb_vwv[12]= 0 (0x0) smb_bcc=27 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 00 00 00 00 55 00 6E 00 69 00 78 00 00 00 53 .....U.n .i.x...S [010] 00 61 00 6D 00 62 00 61 00 00 00 .a.m.b.a ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBsesssetupX (pid 6131) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X(795) wct=13 flg2=0xc801 [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X(941) Domain=[] NativeOS=[Unix] NativeLanMan=[Samba] PrimaryDomain=[] [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X(956) sesssetupX:name=[]\[]@[merlin] [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 3] smbd/sesssetup.c:check_guest_password(115) Got anonymous request [2005/10/28 18:13:40, 5] auth/auth.c:make_auth_context_subsystem(482) Making default auth method list for DC, security=user, encrypt passwords = yes [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend rhosts [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'rhosts' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend hostsequiv [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'hostsequiv' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend sam [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'sam' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend sam_ignoredomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'sam_ignoredomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend unix [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'unix' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend winbind [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'winbind' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend smbserver [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'smbserver' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'trustdomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend ntdomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'ntdomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend guest [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'guest' [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match guest [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method guest has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match sam [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method sam has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match winbind:trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method trustdomain has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method winbind has a valid init [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(99) attempting to make a user_info for () [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(109) making strings for 's user_info struct [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(151) making blobs for 's user_info struct [2005/10/28 18:13:40, 10] auth/auth_util.c:make_user_info(167) made an encrypted user_info for () [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user []\[]@[] with the new password interface [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: []\[]@[] [2005/10/28 18:13:40, 10] auth/auth.c:check_ntlm_password(231) check_ntlm_password: auth_context challenge created by fixed [2005/10/28 18:13:40, 10] auth/auth.c:check_ntlm_password(233) challenge is: [2005/10/28 18:13:40, 5] lib/util.c:dump_data(2063) [000] 00 00 00 00 00 00 00 00 ........ [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:12:26 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_get(401) cache_account_policy_get: no valid cache entry (cache expired) [2005/10/28 18:13:40, 10] passdb/pdb_ldap.c:ldapsam_get_account_policy_from_ldap(3349) ldapsam_get_account_policy_from_ldap [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [sambaDomainName=MIDEARTH,dc=terpstra-world,dc=org], filter => [(objectclass=*)], scope => [0] [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_close(894) The connection to the LDAP server was closed [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_open_connection(538) smbldap_open_connection: ldap://localhost [2005/10/28 18:13:40, 2] lib/smbldap.c:smbldap_open_connection(634) smbldap_open_connection: connection opened [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_connect_system(766) ldap_connect_system: Binding to ldap server ldap://localhost as "cn=Manager,dc=terpstra-world,dc=org" [2005/10/28 18:13:40, 3] lib/smbldap.c:smbldap_connect_system(809) ldap_connect_system: succesful connection to the LDAP server ldap_connect_system: LDAP server does support paged results [2005/10/28 18:13:40, 4] lib/smbldap.c:smbldap_open(874) The LDAP server is succesfully connected [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_set(368) cache_account_policy_set: updating account pol cache [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_set(348) account_policy_set: name: password history, value: 0 [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:12:26 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(203) account policy cache lastset now: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_set(380) cache_account_policy_set: cache valid until: Fri, 28 Oct 2005 18:14:40 GMT [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username nobody, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username , was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name nobody, was [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\nobody, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\nobody, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-501 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-501 from rid 501 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-514 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-514 from rid 514 [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: guest authentication for user [] succeeded [2005/10/28 18:13:40, 5] auth/auth.c:check_ntlm_password(307) check_ntlm_password: guest authentication for user [] -> [] -> [nobody] succeeded [2005/10/28 18:13:40, 5] auth/auth_util.c:free_user_info(1454) attempting to free (and zero) a user_info structure [2005/10/28 18:13:40, 10] auth/auth_util.c:free_user_info(1457) structure was created for [2005/10/28 18:13:40, 5] auth/auth_util.c:free_user_info(1454) attempting to free (and zero) a user_info structure [2005/10/28 18:13:40, 10] smbd/password.c:register_vuid(182) register_vuid: allocated vuid = 100 [2005/10/28 18:13:40, 10] lib/util_pw.c:getpwnam_alloc(98) Got nobody from pwnam_cache [2005/10/28 18:13:40, 10] smbd/password.c:register_vuid(255) register_vuid: (65534,65533) nobody nobody MIDEARTH guest=1 [2005/10/28 18:13:40, 3] smbd/password.c:register_vuid(257) User name: nobody Real name: nobody [2005/10/28 18:13:40, 3] smbd/password.c:register_vuid(276) UNIX uid 65534 is UNIX user nobody, and will be vuid 100 [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=150 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=100 smb_mid=3 smt_wct=3 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_bcc=109 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 55 00 6E 00 69 00 78 00 00 00 53 00 61 00 6D .U.n.i.x ...S.a.m [010] 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E 00 32 .b.a. .3 ...0...2 [020] 00 31 00 70 00 72 00 65 00 31 00 2D 00 53 00 56 .1.p.r.e .1.-.S.V [030] 00 4E 00 2D 00 62 00 75 00 69 00 6C 00 64 00 2D .N.-.b.u .i.l.d.- [040] 00 55 00 4E 00 4B 00 4E 00 4F 00 57 00 4E 00 2D .U.N.K.N .O.W.N.- [050] 00 53 00 55 00 53 00 45 00 00 00 4D 00 49 00 44 .S.U.S.E ...M.I.D [060] 00 45 00 41 00 52 00 54 00 48 00 00 00 .E.A.R.T .H... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 76 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x4c [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 3 of length 80 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=76 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=100 smb_mid=4 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1 (0x1) smb_bcc=33 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 5C 00 4D 00 45 00 52 00 4C 00 49 00 4E .\.\.M.E .R.L.I.N [010] 00 5C 00 49 00 50 00 43 00 24 00 00 00 49 50 43 .\.I.P.C .$...IPC [020] 00 . [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtconX (pid 6131) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 4] smbd/reply.c:reply_tcon_and_X(617) Client requested device type [IPC] for share [IPC$] [2005/10/28 18:13:40, 5] smbd/service.c:make_connection(815) making a connection to 'normal' service ipc$ [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_alloc(313) Finding user nobody [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_internals(262) Trying _Get_Pwnam(), username as lowercase is nobody [2005/10/28 18:13:40, 10] lib/util_pw.c:getpwnam_alloc(98) Got nobody from pwnam_cache [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_internals(290) Get_Pwnam_internals did find user [nobody]! [2005/10/28 18:13:40, 3] smbd/service.c:make_connection_snum(478) Connect path is '/var/tmp' for service [IPC$] [2005/10/28 18:13:40, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(218) get_share_security: using default secdesc for IPC$ [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_map_generic(176) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x00000002, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-501. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-501 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132067 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132069 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 [2005/10/28 18:13:40, 5] lib/util_seaccess.c:se_access_check(308) se_access_check: access (2) granted. [2005/10/28 18:13:40, 3] smbd/vfs.c:vfs_init_default(215) Initialising default vfs hooks [2005/10/28 18:13:40, 5] smbd/connection.c:claim_connection(170) claiming IPC$ 0 [2005/10/28 18:13:40, 10] smbd/uid.c:is_share_read_only_for_user(122) is_share_read_only_for_user: share IPC$ is read-only for unix user nobody [2005/10/28 18:13:40, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(218) get_share_security: using default secdesc for IPC$ [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_map_generic(176) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x00000001, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-501. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-501 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132067 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132069 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 [2005/10/28 18:13:40, 5] lib/util_seaccess.c:se_access_check(308) se_access_check: access (1) granted. [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65533) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(457) NT user token of user S-1-5-21-726309263-4128913605-1168186429-501 contains 7 SIDs SID[ 0]: S-1-5-21-726309263-4128913605-1168186429-501 SID[ 1]: S-1-5-21-726309263-4128913605-1168186429-514 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-32-546 SID[ 5]: S-1-5-21-726309263-4128913605-1168186429-132067 SID[ 6]: S-1-5-21-726309263-4128913605-1168186429-132069 SE_PRIV 0x0 0x0 0x0 0x0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 65534 Primary group is 65533 and contains 2 supplementary groups Group[ 0]: 65533 Group[ 1]: 65534 [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_user(304) change_to_user uid=(65534,65534) gid=(0,65533) [2005/10/28 18:13:40, 3] smbd/service.c:make_connection_snum(666) merlin (172.16.10.4) connect to service IPC$ initially as user nobody (uid=65534, gid=65533) (pid 6131) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/reply.c:reply_tcon_and_X(665) tconX service=IPC$ [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=48 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=4 smt_wct=3 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_bcc=7 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 49 50 43 00 00 00 00 IPC.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 100 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x64 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 4 of length 104 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=5 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=17 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [010] 00 . [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBntcreateX (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65533) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(457) NT user token of user S-1-5-21-726309263-4128913605-1168186429-501 contains 7 SIDs SID[ 0]: S-1-5-21-726309263-4128913605-1168186429-501 SID[ 1]: S-1-5-21-726309263-4128913605-1168186429-514 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-32-546 SID[ 5]: S-1-5-21-726309263-4128913605-1168186429-132067 SID[ 6]: S-1-5-21-726309263-4128913605-1168186429-132069 SE_PRIV 0x0 0x0 0x0 0x0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 65534 Primary group is 65533 and contains 2 supplementary groups Group[ 0]: 65533 Group[ 1]: 65534 [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_user(304) change_to_user uid=(65534,65534) gid=(0,65533) [2005/10/28 18:13:40, 4] smbd/vfs.c:vfs_ChDir(737) vfs_ChDir to /var/tmp [2005/10/28 18:13:40, 10] smbd/nttrans.c:reply_ntcreate_and_X(506) reply_ntcreateX: flags = 0x0, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 [2005/10/28 18:13:40, 4] smbd/nttrans.c:nt_open_pipe(330) nt_open_pipe: Opening pipe \lsarpc. [2005/10/28 18:13:40, 3] smbd/nttrans.c:nt_open_pipe(351) nt_open_pipe: Known pipe lsarpc opening. [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) Open pipe requested lsarpc (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) Create pipe requested lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) init_pipe_handles: created handle list for pipe lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) init_pipe_handles: pipe_handles ref count = 1 for pipe lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) Created internal pipe lsarpc (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) Opened pipe lsarpc with handle 7147 (pipes_open=1) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) open pipes: name lsarpc pnum=7147 [2005/10/28 18:13:40, 5] smbd/nttrans.c:do_ntcreate_pipe_open(400) do_ntcreate_pipe_open: open pipe = \lsarpc [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=5 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=18176 (0x4700) smb_vwv[ 3]= 369 (0x171) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 154 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x9a [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 5 of length 158 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=6 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28999 (0x7147) smb_bcc=87 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 W4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=72 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7147 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7147 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "lsarpc" (pnum 7147) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d7d40 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7147 name: lsarpc open: Yes len: 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0048 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000001 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 11, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 11 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1423) api_pipe_bind_req: decode request. 1423 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1434) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_rb [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0008 num_contexts: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000c context_id : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 000e num_transfer_syntaxes: 01 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00000f smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 data : 12345778 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 data : 1234 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 data : abcd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0018 data : ef 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 001a data : 01 23 45 67 89 ab [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 version: 00000000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0028 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 002a data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002c data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002e data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0034 version: 00000002 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1476) api_pipe_bind_req: make response. 1476 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:check_bind_req(910) check_bind_req for \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_ba [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 000053f0 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 smb_io_rpc_addr_str [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 len: 000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000a str: \PIPE\lsass. [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 smb_io_rpc_results [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0018 num_results: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001c result : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001e reason : 0000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0026 data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0028 data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002a data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 version: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0044 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000001 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 56 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7147 name: lsarpc len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(979) read_from_pipe: lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..68] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=6 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 142 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x8e [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 6 of length 146 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=142 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=7 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28999 (0x7147) smb_bcc=75 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 3C 00 00 00 02 00 00 00 24 .......< .......$ [020] 00 00 00 00 00 06 00 01 00 00 00 5C 00 00 00 18 ........ ...\.... [030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [040] 00 00 00 00 00 00 00 00 00 00 02 ........ ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=60 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7147 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7147 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "lsarpc" (pnum 7147) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d7d40 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7147 name: lsarpc open: Yes len: 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 003c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000002 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000024 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0006 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 70 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: lsarpc op 0x6 - api_rpcTNP: rpc command: LSA_OPENPOLICY [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[1].fn == 0x81343f6 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_q_open_pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 ptr : 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 system_name: 005c [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 lsa_io_obj_attr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 len : 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c ptr_root_dir: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 ptr_obj_name: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 attributes : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 ptr_sec_desc: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 001c ptr_sec_qos : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 des_access: 02000000 [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x02000000, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-501. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-501 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132067 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132069 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F3 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_r_open_pol [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f3 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0014 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called lsarpc successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 800 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 44 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7147 name: lsarpc len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0030 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=7 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ [020] 00 00 00 00 00 B4 BE 62 43 F3 17 00 00 00 00 00 .......b C....... [030] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 128 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x80 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 7 of length 132 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=8 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 46 (0x2E) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 46 (0x2E) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28999 (0x7147) smb_bcc=61 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 2E 00 00 00 03 00 00 00 16 ........ ........ [020] 00 00 00 00 00 07 00 00 00 00 00 01 00 00 00 00 ........ ........ [030] 00 00 00 B4 BE 62 43 F3 17 00 00 05 00 .....bC. ..... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=46 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7147 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7147 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "lsarpc" (pnum 7147) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d7d40 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7147 name: lsarpc open: Yes len: 46 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 46 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 46 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 46, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 30 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 30 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 002e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000003 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 30 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 30, incoming data = 30 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000016 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0007 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: lsarpc op 0x7 - api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[2].fn == 0x813466b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_q_query [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f3 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 info_class: 0005 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F3 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_r_query [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 undoc_buffer: 22000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 info_class: 0005 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 lsa_io_dom_query [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 uni_dom_max_len: 0010 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a uni_dom_str_len: 0012 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c buffer_dom_name: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 buffer_dom_sid : 00000001 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000014 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 001c uni_str_len: 00000008 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0020 buffer : M.I.D.E.A.R.T.H. [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000030 smb_io_dom_sid2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 num_auths: 00000004 [2005/10/28 18:13:40, 8] rpc_parse/parse_prs.c:prs_debug(84) 000034 smb_io_dom_sid sid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0034 sid_rev_num: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0035 num_auths : 04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0036 id_auth[0] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0037 id_auth[1] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0038 id_auth[2] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0039 id_auth[3] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 003a id_auth[4] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 003b id_auth[5] : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32s(930) 003c sub_auths : 00000015 2b4a998f f61a38c5 45a11c3d [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 004c status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called lsarpc successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 18 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 30 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7147 name: lsarpc len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 80. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0068 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000003 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000050 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..104] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=160 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=8 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 104 (0x68) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 104 (0x68) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=105 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 68 00 00 00 03 00 00 ........ .h...... [010] 00 50 00 00 00 00 00 00 00 00 00 00 22 05 00 00 .P...... ...."... [020] 00 10 00 12 00 01 00 00 00 01 00 00 00 09 00 00 ........ ........ [030] 00 00 00 00 00 08 00 00 00 4D 00 49 00 44 00 45 ........ .M.I.D.E [040] 00 41 00 52 00 54 00 48 00 04 00 00 00 01 04 00 .A.R.T.H ........ [050] 00 00 00 00 05 15 00 00 00 8F 99 4A 2B C5 38 1A ........ ...J+.8. [060] F6 3D 1C A1 45 00 00 00 00 .=..E... . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 126 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x7e [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 8 of length 130 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=126 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=9 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28999 (0x7147) smb_bcc=59 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 2C 00 00 00 04 00 00 00 14 ......., ........ [020] 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ........ ........ [030] 00 00 00 B4 BE 62 43 F3 17 00 00 .....bC. ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=44 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7147 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7147 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "lsarpc" (pnum 7147) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d7d40 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7147 name: lsarpc open: Yes len: 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 002c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000004 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000014 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0000 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[4].fn == 0x8134b71 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_q_close [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f3 17 00 00 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F3 17 00 00 .... [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F3 17 00 00 .... [2005/10/28 18:13:40, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_r_close [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: 00 00 00 00 00 00 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0014 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called lsarpc successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 28 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7147 name: lsarpc len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0030 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000004 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=9 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [030] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 41 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x29 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 9 of length 45 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=10 smt_wct=3 smb_vwv[ 0]=28999 (0x7147) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBclose (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7147 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7147 (pipes_open=1) [2005/10/28 18:13:40, 5] smbd/pipes.c:reply_pipe_close(272) reply_pipe_close: pnum:7147 [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) close_policy_by_pipe: deleted handle list for pipe lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1094) closed pipe name lsarpc pnum=7147 (pipes_open=0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=10 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 104 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x68 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 10 of length 108 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=11 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 4608 (0x1200) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=21 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 4E 00 45 00 54 00 4C 00 4F 00 47 00 4F .\.N.E.T .L.O.G.O [010] 00 4E 00 00 00 .N... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBntcreateX (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 10] smbd/nttrans.c:reply_ntcreate_and_X(506) reply_ntcreateX: flags = 0x0, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 [2005/10/28 18:13:40, 4] smbd/nttrans.c:nt_open_pipe(330) nt_open_pipe: Opening pipe \NETLOGON. [2005/10/28 18:13:40, 3] smbd/nttrans.c:nt_open_pipe(351) nt_open_pipe: Known pipe NETLOGON opening. [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) Open pipe requested NETLOGON (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) Create pipe requested NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) init_pipe_handles: created handle list for pipe NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) init_pipe_handles: pipe_handles ref count = 1 for pipe NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) Created internal pipe NETLOGON (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) Opened pipe NETLOGON with handle 7148 (pipes_open=1) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) open pipes: name NETLOGON pnum=7148 [2005/10/28 18:13:40, 5] smbd/nttrans.c:do_ntcreate_pipe_open(400) do_ntcreate_pipe_open: open pipe = \NETLOGON [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=11 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=18432 (0x4800) smb_vwv[ 3]= 369 (0x171) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 154 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x9a [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 11 of length 158 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=12 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29000 (0x7148) smb_bcc=87 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 05 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=72 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7148 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7148 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7148) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d6c60 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7148 name: NETLOGON open: Yes len: 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0048 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000005 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 11, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 11 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1423) api_pipe_bind_req: decode request. 1423 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1434) api_pipe_bind_req: \PIPE\NETLOGON -> \PIPE\lsass [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_rb [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0008 num_contexts: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000c context_id : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 000e num_transfer_syntaxes: 01 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00000f smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 data : 12345678 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 data : 1234 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 data : abcd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0018 data : ef 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 001a data : 01 23 45 67 cf fb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 version: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0028 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 002a data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002c data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002e data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0034 version: 00000002 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1476) api_pipe_bind_req: make response. 1476 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:check_bind_req(910) check_bind_req for \PIPE\NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\samr [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\NETLOGON [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_ba [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 000053f0 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 smb_io_rpc_addr_str [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 len: 000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000a str: \PIPE\lsass. [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 smb_io_rpc_results [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0018 num_results: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001c result : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001e reason : 0000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0026 data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0028 data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002a data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 version: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0044 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000005 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 56 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7148 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(979) read_from_pipe: NETLOGON: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..68] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=12 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 05 00 00 ........ .D...... [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 176 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xb0 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 12 of length 180 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=176 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=13 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 94 (0x5E) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 94 (0x5E) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29000 (0x7148) smb_bcc=109 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 5E 00 00 00 06 00 00 00 46 .......^ .......F [020] 00 00 00 00 00 04 00 01 00 00 00 09 00 00 00 00 ........ ........ [030] 00 00 00 09 00 00 00 5C 00 5C 00 4D 00 45 00 52 .......\ .\.M.E.R [040] 00 4C 00 49 00 4E 00 00 00 00 00 07 00 00 00 00 .L.I.N.. ........ [050] 00 00 00 07 00 00 00 4D 00 45 00 52 00 4C 00 49 .......M .E.R.L.I [060] 00 4E 00 00 00 27 F5 0C 32 A8 3F 2D 26 .N...'.. 2.?-& [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=94 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7148 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7148 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7148) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d6c60 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7148 name: NETLOGON open: Yes len: 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 94, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 78 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 005e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000006 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 78, incoming data = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000046 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0004 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 72 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: NETLOGON op 0x4 - api_rpcTNP: rpc command: NET_REQCHAL [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[0].fn == 0x814890e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_q_req_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 undoc_buffer: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000004 smb_io_unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c uni_str_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0010 buffer : \.\.M.E.R.L.I.N... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000022 smb_io_unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 uni_max_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0028 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 002c uni_str_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0030 buffer : M.E.R.L.I.N... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00003e smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 003e data: 27 f5 0c 32 a8 3f 2d 26 [2005/10/28 18:13:40, 6] rpc_server/srv_netlog_nt.c:init_net_r_req_chal(41) init_net_r_req_chal: 41 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_r_req_chal [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0000 data: 79 5c 9d a2 17 79 a1 5e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0008 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called NETLOGON successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 32 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 78 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7148 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 12. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0024 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000006 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 0000000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..36] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=92 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=13 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 36 (0x24) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 36 (0x24) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=37 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 06 00 00 ........ .$...... [010] 00 0C 00 00 00 00 00 00 00 79 5C 9D A2 17 79 A1 ........ .y\...y. [020] 5E 00 00 00 00 ^.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 214 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xd6 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 13 of length 218 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=214 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=14 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 132 (0x84) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 132 (0x84) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=29000 (0x7148) smb_bcc=147 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 84 00 00 00 07 00 00 00 6C ........ .......l [020] 00 00 00 00 00 0F 00 01 00 00 00 09 00 00 00 00 ........ ........ [030] 00 00 00 09 00 00 00 5C 00 5C 00 4D 00 45 00 52 .......\ .\.M.E.R [040] 00 4C 00 49 00 4E 00 00 00 00 00 08 00 00 00 00 .L.I.N.. ........ [050] 00 00 00 08 00 00 00 4D 00 45 00 52 00 4C 00 49 .......M .E.R.L.I [060] 00 4E 00 24 00 00 00 06 00 00 00 07 00 00 00 00 .N.$.... ........ [070] 00 00 00 07 00 00 00 4D 00 45 00 52 00 4C 00 49 .......M .E.R.L.I [080] 00 4E 00 00 00 FF A3 89 32 8F A0 EE 7D 00 00 FF .N...... 2...}... [090] 01 07 00 ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=132 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7148 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7148 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7148) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d6c60 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7148 name: NETLOGON open: Yes len: 132 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 132 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 132 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 132, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 116 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 116 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0084 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000007 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 116 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 116, incoming data = 116 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 0000006c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 000f [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: NETLOGON op 0xf - api_rpcTNP: rpc command: NET_AUTH2 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[2].fn == 0x8148c3a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_q_auth_2 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_log_info [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 undoc_buffer: 00000001 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000004 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c uni_str_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0010 buffer : \.\.M.E.R.L.I.N... [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000022 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 uni_max_len: 00000008 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0028 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 002c uni_str_len: 00000008 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0030 buffer : M.E.R.L.I.N.$... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0040 sec_chan: 0006 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000042 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0044 uni_max_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0048 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 004c uni_str_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0050 buffer : M.E.R.L.I.N... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00005e smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 005e data: ff a3 89 32 8f a0 ee 7d [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000066 net_io_neg_flags [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0068 neg_flags: 000701ff [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65533) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [dc=terpstra-world,dc=org], filter => [(&(uid=MERLIN$)(objectclass=sambaSamAccount))], scope => [2] [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_sam_from_ldap(639) init_sam_from_ldap: Entry found for user: merlin$ [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557) pdb_set_user_sid_from_string: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592) pdb_set_group_sid_from_string: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogoffTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaKickoffTime] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomeDrive] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomePath] = [] [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonScript] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaProfilePath] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaUserWorkstations] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaMungedDial] = [] [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordCount] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonHours] = [] [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(83) Looking up login cache for user merlin$ [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(97) No cache entry found [2005/10/28 18:13:40, 9] passdb/pdb_ldap.c:init_sam_from_ldap(994) No cache entry, bad count = 0, bad time = 0 [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 from rid 3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 from rid 553 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65533) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] lib/util.c:dump_data(2063) [000] 60 CA A5 08 31 FF DB E4 66 50 9E C2 16 2D 11 92 `...1... fP...-.. [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(116) creds_server_init: client chal : 27F50C32A83F2D26 [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(117) creds_server_init: server chal : 795C9DA21779A15E [2005/10/28 18:13:40, 4] libsmb/credentials.c:cred_create_session_key(65) cred_create_session_key [2005/10/28 18:13:40, 5] libsmb/credentials.c:cred_create_session_key(67) clnt_chal_in: 27F50C32A83F2D26 [2005/10/28 18:13:40, 5] libsmb/credentials.c:cred_create_session_key(68) srv_chal_in : 795C9DA21779A15E [2005/10/28 18:13:40, 5] libsmb/credentials.c:cred_create_session_key(69) clnt+srv : A051AAD4BFB8CE84 [2005/10/28 18:13:40, 5] libsmb/credentials.c:cred_create_session_key(70) sess_key_out : EE0BE8D993BA20DD [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(143) creds_server_init: clnt : EA76F5BDD4FF9116 [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(144) creds_server_init: server : BA83A1B39ECA28EA [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(145) creds_server_init: seed : EA76F5BDD4FF9116 [2005/10/28 18:13:40, 5] libsmb/credentials.c:creds_server_check(157) creds_server_check: challenge : FFA389328FA0EE7D [2005/10/28 18:13:40, 5] libsmb/credentials.c:creds_server_check(158) calculated: EA76F5BDD4FF9116 [2005/10/28 18:13:40, 0] libsmb/credentials.c:creds_server_check(159) creds_server_check: credentials check failed. [2005/10/28 18:13:40, 0] rpc_server/srv_netlog_nt.c:_net_auth_2(424) _net_auth2: creds_server_check failed. Rejecting auth request from client MERLIN machine account MERLIN$ [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_r_auth_2 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0000 data: 00 00 00 00 00 00 00 00 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 net_io_neg_flags [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 neg_flags: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 000c status: NT_STATUS_ACCESS_DENIED [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called NETLOGON successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 48 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 116 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7148 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 16. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0028 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000010 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..40] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=96 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=14 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=41 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 07 00 00 ........ .(...... [010] 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [020] 00 00 00 00 00 22 00 00 C0 .....".. . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 41 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x29 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 14 of length 45 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=15 smt_wct=3 smb_vwv[ 0]=29000 (0x7148) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBclose (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7148 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7148 (pipes_open=1) [2005/10/28 18:13:40, 5] smbd/pipes.c:reply_pipe_close(272) reply_pipe_close: pnum:7148 [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) close_policy_by_pipe: deleted handle list for pipe NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1094) closed pipe name NETLOGON pnum=7148 (pipes_open=0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=15 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 35 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x23 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 15 of length 39 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=16 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtdis (pid 6131) conn 0x836db50 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/service.c:close_cnum(839) merlin (172.16.10.4) closed connection to service IPC$ [2005/10/28 18:13:40, 3] smbd/connection.c:yield_connection(69) Yielding connection to IPC$ [2005/10/28 18:13:40, 4] smbd/vfs.c:vfs_ChDir(737) vfs_ChDir to / [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=16 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_data(517) read_data: read of 4 returned 0. Error = Success [2005/10/28 18:13:40, 10] lib/util_sock.c:receive_smb_raw(666) receive_smb_raw: length < 0! [2005/10/28 18:13:40, 3] smbd/process.c:timeout_processing(1447) timeout_processing: End of file from client (client has disconnected). [2005/10/28 18:13:40, 5] lib/gencache.c:gencache_shutdown(88) Closing cache file [2005/10/28 18:13:40, 5] libsmb/namecache.c:namecache_shutdown(79) namecache_shutdown: netbios namecache closed successfully. [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 2] smbd/server.c:exit_server(614) Closing connections [2005/10/28 18:13:40, 5] auth/auth_util.c:free_server_info(1480) attempting to free (and zero) a server_info structure [2005/10/28 18:13:40, 3] smbd/connection.c:yield_connection(69) Yielding connection to [2005/10/28 18:13:40, 3] smbd/server.c:exit_server(655) Server exit (normal exit) [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] smbd/reply.c:reply_special(494) init msg_type=0x81 msg_flags=0x0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 179 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xb3 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 1 of length 183 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=179 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=55297 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=2 smt_wct=0 smb_bcc=144 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 .PC NETW ORK PROG [010] 52 41 4D 20 31 2E 30 00 02 4D 49 43 52 4F 53 4F RAM 1.0. .MICROSO [020] 46 54 20 4E 45 54 57 4F 52 4B 53 20 31 2E 30 33 FT NETWO RKS 1.03 [030] 00 02 4D 49 43 52 4F 53 4F 46 54 20 4E 45 54 57 ..MICROS OFT NETW [040] 4F 52 4B 53 20 33 2E 30 00 02 4C 41 4E 4D 41 4E ORKS 3.0 ..LANMAN [050] 31 2E 30 00 02 4C 4D 31 2E 32 58 30 30 32 00 02 1.0..LM1 .2X002.. [060] 44 4F 53 20 4C 41 4E 4D 41 4E 32 2E 31 00 02 53 DOS LANM AN2.1..S [070] 61 6D 62 61 00 02 4E 54 20 4C 41 4E 4D 41 4E 20 amba..NT LANMAN [080] 31 2E 30 00 02 4E 54 20 4C 4D 20 30 2E 31 32 00 1.0..NT LM 0.12. [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBnegprot (pid 6132) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [PC NETWORK PROGRAM 1.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [MICROSOFT NETWORKS 1.03] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [MICROSOFT NETWORKS 3.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [LANMAN1.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [LM1.2X002] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [DOS LANMAN2.1] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [Samba] [2005/10/28 18:13:40, 10] lib/util.c:set_remote_arch(2038) set_remote_arch: Client arch is 'Samba' [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] smbd/connection.c:claim_connection(170) claiming 0 [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_nt1(345) using SPNEGO [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(567) Selected protocol NT LANMAN 1.0 [2005/10/28 18:13:40, 5] smbd/negprot.c:reply_negprot(573) negprot index=7 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=85 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=2 smt_wct=17 smb_vwv[ 0]= 7 (0x7) smb_vwv[ 1]=12803 (0x3203) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]=62464 (0xF400) smb_vwv[ 8]= 23 (0x17) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]=32995 (0x80E3) smb_vwv[11]= 128 (0x80) smb_vwv[12]=15186 (0x3B52) smb_vwv[13]= 7581 (0x1D9D) smb_vwv[14]=50652 (0xC5DC) smb_vwv[15]=26625 (0x6801) smb_vwv[16]= 1 (0x1) smb_bcc=16 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 6D 65 72 6C 69 6E 00 00 00 00 00 00 00 00 00 00 merlin.. ........ [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 162 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xa2 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 2 of length 166 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=162 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=3 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=65535 (0xFFFF) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 1 (0x1) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 80 (0x50) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]=49244 (0xC05C) smb_vwv[11]=32768 (0x8000) smb_bcc=103 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 60 4E 06 06 2B 06 01 05 05 02 A0 44 30 42 A0 0E `N..+... ...D0B.. [010] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A2 30 0...+... ..7....0 [020] 04 2E 4E 54 4C 4D 53 53 50 00 01 00 00 00 15 02 ..NTLMSS P....... [030] 08 60 08 00 08 00 20 00 00 00 06 00 06 00 28 00 .`.... . ......(. [040] 00 00 4D 49 44 45 41 52 54 48 4D 45 52 4C 49 4E ..MIDEAR THMERLIN [050] 00 55 00 6E 00 69 00 78 00 00 00 53 00 61 00 6D .U.n.i.x ...S.a.m [060] 00 62 00 61 00 00 00 .b.a... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBsesssetupX (pid 6132) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X(795) wct=12 flg2=0xc801 [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(632) Doing spnego session setup [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(663) NativeOS=[Unix] NativeLanMan=[Samba] PrimaryDomain=[] [2005/10/28 18:13:40, 10] smbd/password.c:register_vuid(182) register_vuid: allocated vuid = 100 [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_spnego_negotiate(524) Got OID 1 3 6 1 4 1 311 2 2 10 [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_spnego_negotiate(527) Got secblob of size 46 [2005/10/28 18:13:40, 5] auth/auth.c:make_auth_context_subsystem(482) Making default auth method list for DC, security=user, encrypt passwords = yes [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend rhosts [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'rhosts' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend hostsequiv [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'hostsequiv' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend sam [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'sam' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend sam_ignoredomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'sam_ignoredomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend unix [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'unix' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend winbind [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'winbind' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend smbserver [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'smbserver' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'trustdomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend ntdomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'ntdomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend guest [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'guest' [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match guest [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method guest has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match sam [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method sam has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match winbind:trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method trustdomain has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method winbind has a valid init [2005/10/28 18:13:40, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) Got NTLMSSP neg_flags=0x60080215 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH [2005/10/28 18:13:40, 5] auth/auth.c:get_ntlm_challenge(95) auth_get_challenge: module guest did not want to specify a challenge [2005/10/28 18:13:40, 5] auth/auth.c:get_ntlm_challenge(95) auth_get_challenge: module sam did not want to specify a challenge [2005/10/28 18:13:40, 5] auth/auth.c:get_ntlm_challenge(95) auth_get_challenge: module winbind did not want to specify a challenge [2005/10/28 18:13:40, 5] auth/auth.c:get_ntlm_challenge(135) auth_context challenge created by random [2005/10/28 18:13:40, 5] auth/auth.c:get_ntlm_challenge(136) challenge is: [2005/10/28 18:13:40, 5] lib/util.c:dump_data(2063) [000] C7 EA 6E B9 3A 4A CF 0F ..n.:J.. [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=380 smb_com=0x73 smb_rcls=22 smb_reh=0 smb_err=49152 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=100 smb_mid=3 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 229 (0xE5) smb_bcc=337 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] A1 81 E2 30 81 DF A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ [010] 06 01 04 01 82 37 02 02 0A A2 81 C9 04 81 C6 4E .....7.. .......N [020] 54 4C 4D 53 53 50 00 02 00 00 00 10 00 10 00 30 TLMSSP.. .......0 [030] 00 00 00 35 02 89 60 C7 EA 6E B9 3A 4A CF 0F 00 ...5..`. .n.:J... [040] 00 00 00 00 00 00 00 86 00 86 00 40 00 00 00 4D ........ ...@...M [050] 00 49 00 44 00 45 00 41 00 52 00 54 00 48 00 02 .I.D.E.A .R.T.H.. [060] 00 10 00 4D 00 49 00 44 00 45 00 41 00 52 00 54 ...M.I.D .E.A.R.T [070] 00 48 00 01 00 0C 00 4D 00 45 00 52 00 4C 00 49 .H.....M .E.R.L.I [080] 00 4E 00 04 00 24 00 74 00 65 00 72 00 70 00 73 .N...$.t .e.r.p.s [090] 00 74 00 72 00 61 00 2D 00 77 00 6F 00 72 00 6C .t.r.a.- .w.o.r.l [0A0] 00 64 00 2E 00 6F 00 72 00 67 00 03 00 32 00 6D .d...o.r .g...2.m [0B0] 00 65 00 72 00 6C 00 69 00 6E 00 2E 00 74 00 65 .e.r.l.i .n...t.e [0C0] 00 72 00 70 00 73 00 74 00 72 00 61 00 2D 00 77 .r.p.s.t .r.a.-.w [0D0] 00 6F 00 72 00 6C 00 64 00 2E 00 6F 00 72 00 67 .o.r.l.d ...o.r.g [0E0] 00 00 00 00 00 55 00 6E 00 69 00 78 00 00 00 53 .....U.n .i.x...S [0F0] 00 61 00 6D 00 62 00 61 00 20 00 33 00 2E 00 30 .a.m.b.a . .3...0 [100] 00 2E 00 32 00 31 00 70 00 72 00 65 00 31 00 2D ...2.1.p .r.e.1.- [110] 00 53 00 56 00 4E 00 2D 00 62 00 75 00 69 00 6C .S.V.N.- .b.u.i.l [120] 00 64 00 2D 00 55 00 4E 00 4B 00 4E 00 4F 00 57 .d.-.U.N .K.N.O.W [130] 00 4E 00 2D 00 53 00 55 00 53 00 45 00 00 00 4D .N.-.S.U .S.E...M [140] 00 49 00 44 00 45 00 41 00 52 00 54 00 48 00 00 .I.D.E.A .R.T.H.. [150] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 258 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x102 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 3 of length 262 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=258 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=100 smb_mid=4 smt_wct=12 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=65535 (0xFFFF) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 1 (0x1) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 176 (0xB0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]=49244 (0xC05C) smb_vwv[11]=32768 (0x8000) smb_bcc=199 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] A1 81 AD 30 81 AA A2 81 A7 04 81 A4 4E 54 4C 4D ...0.... ....NTLM [010] 53 53 50 00 03 00 00 00 18 00 18 00 40 00 00 00 SSP..... ....@... [020] 18 00 18 00 58 00 00 00 10 00 10 00 70 00 00 00 ....X... ....p... [030] 08 00 08 00 80 00 00 00 0C 00 0C 00 88 00 00 00 ........ ........ [040] 10 00 10 00 94 00 00 00 15 02 08 60 8A 18 C0 6D ........ ...`...m [050] 1A 1E 00 AA 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [060] 00 00 00 00 3D 91 28 B9 84 3C 6F B1 84 A0 76 50 ....=.(. .b. [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 4] lib/username.c:map_username(171) Scanning username map /etc/samba/smbusers [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info_map(191) make_user_info_map: Mapping user [MIDEARTH]\[root] from workstation [MERLIN] [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] auth/auth_util.c:is_trusted_domain(1634) is_trusted_domain: Checking for domain trust with [MIDEARTH] [2005/10/28 18:13:40, 5] passdb/secrets.c:secrets_fetch_trusted_domain_password(339) secrets_fetch failed! [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 10] lib/gencache.c:gencache_get(291) Cache entry with key = TDOM/MIDEARTH couldn't be found [2005/10/28 18:13:40, 5] libsmb/trustdom_cache.c:trustdom_cache_fetch(184) no entry for trusted domain MIDEARTH found. [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(99) attempting to make a user_info for root (root) [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(109) making strings for root's user_info struct [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(151) making blobs for root's user_info struct [2005/10/28 18:13:40, 10] auth/auth_util.c:make_user_info(167) made an encrypted user_info for root (root) [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user [MIDEARTH]\[root]@[MERLIN] with the new password interface [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: [MIDEARTH]\[root]@[MERLIN] [2005/10/28 18:13:40, 10] auth/auth.c:check_ntlm_password(231) check_ntlm_password: auth_context challenge created by NTLMSSP callback (NTLM2) [2005/10/28 18:13:40, 10] auth/auth.c:check_ntlm_password(233) challenge is: [2005/10/28 18:13:40, 5] lib/util.c:dump_data(2063) [000] AC D1 B9 48 E4 3E 62 17 ...H.>b. [2005/10/28 18:13:40, 10] auth/auth.c:check_ntlm_password(259) check_ntlm_password: guest had nothing to say [2005/10/28 18:13:40, 8] lib/util.c:is_myname(1884) is_myname("MIDEARTH") returns 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [dc=terpstra-world,dc=org], filter => [(&(uid=root)(objectclass=sambaSamAccount))], scope => [2] [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_close(894) The connection to the LDAP server was closed [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_open_connection(538) smbldap_open_connection: ldap://localhost [2005/10/28 18:13:40, 2] lib/smbldap.c:smbldap_open_connection(634) smbldap_open_connection: connection opened [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_connect_system(766) ldap_connect_system: Binding to ldap server ldap://localhost as "cn=Manager,dc=terpstra-world,dc=org" [2005/10/28 18:13:40, 3] lib/smbldap.c:smbldap_connect_system(809) ldap_connect_system: succesful connection to the LDAP server ldap_connect_system: LDAP server does support paged results [2005/10/28 18:13:40, 4] lib/smbldap.c:smbldap_open(874) The LDAP server is succesfully connected [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_sam_from_ldap(639) init_sam_from_ldap: Entry found for user: root [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username root, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username root, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557) pdb_set_user_sid_from_string: setting user sid S-1-5-21-726309263-4128913605-1168186429-500 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-500 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592) pdb_set_group_sid_from_string: setting group sid S-1-5-21-726309263-4128913605-1168186429-512 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-512 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name System Boss Man, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\root, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonScript] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\root, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaUserWorkstations] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaMungedDial] = [] [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonHours] = [] [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(83) Looking up login cache for user root [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(97) No cache entry found [2005/10/28 18:13:40, 9] passdb/pdb_ldap.c:init_sam_from_ldap(994) No cache entry, bad count = 0, bad time = 0 [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username root, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username root, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name System Boss Man, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\root, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\root, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-500 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-500 from rid 500 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-512 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-512 from rid 512 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 9] passdb/passdb.c:pdb_update_autolock_flag(2333) pdb_update_autolock_flag: Account root not autolocked, no check needed [2005/10/28 18:13:40, 4] libsmb/ntlm_check.c:ntlm_password_check(326) ntlm_password_check: Checking NT MD4 password [2005/10/28 18:13:40, 4] auth/auth_sam.c:sam_account_ok(122) sam_account_ok: Checking SMB password for user root [2005/10/28 18:13:40, 5] auth/auth_sam.c:logon_hours_ok(104) logon_hours_ok: user root allowed to logon at this time (Fri Oct 28 18:13:40 2005 ) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 10] lib/system_smbd.c:sys_getgrouplist(167) sys_getgrouplist: user [root] [2005/10/28 18:13:40, 10] lib/system_smbd.c:sys_getgrouplist(176) sys_getgrouplist(): disabled winbindd for group lookup [user == root] [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 8] lib/system_smbd.c:remove_duplicate_gids(49) remove_duplicate_gids: Enter 4 gids [2005/10/28 18:13:40, 8] lib/system_smbd.c:remove_duplicate_gids(67) remove_duplicate_gids: Exit 3 gids [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(240) fetch sid from gid cache 0 -> S-1-5-21-726309263-4128913605-1168186429-1001 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [ou=Groups,dc=terpstra-world,dc=org], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=64))], scope => [2] [2005/10/28 18:13:40, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2249) ldapsam_getgroup: Did not find group [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 10] passdb/passdb.c:local_gid_to_sid(1250) local_gid_to_sid: Fall back to algorithmic mapping: 64 -> S-1-5-21-726309263-4128913605-1168186429-1129 [2005/10/28 18:13:40, 10] passdb/lookup_sid.c:gid_to_sid(379) gid_to_sid: local 64 -> S-1-5-21-726309263-4128913605-1168186429-1129 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(0) : conn_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [ou=Groups,dc=terpstra-world,dc=org], filter => [(&(objectClass=sambaGroupMapping)(gidNumber=512))], scope => [2] [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_group_from_ldap(2143) init_group_from_ldap: Entry found for group: 512 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 10] passdb/passdb.c:local_gid_to_sid(1261) local_gid_to_sid: gid (512) -> SID S-1-5-21-726309263-4128913605-1168186429-512. [2005/10/28 18:13:40, 10] passdb/lookup_sid.c:gid_to_sid(379) gid_to_sid: local 512 -> S-1-5-21-726309263-4128913605-1168186429-512 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] lib/privileges.c:get_privileges(261) get_privileges: No privileges assigned to SID [S-1-5-21-726309263-4128913605-1168186429-500] [2005/10/28 18:13:40, 3] lib/privileges.c:get_privileges(261) get_privileges: No privileges assigned to SID [S-1-5-21-726309263-4128913605-1168186429-512] [2005/10/28 18:13:40, 5] lib/privileges.c:get_privileges_for_sids(459) get_privileges_for_sids: sid = S-1-1-0 Privilege set: SE_PRIV 0x0 0x0 0x0 0x0 [2005/10/28 18:13:40, 3] lib/privileges.c:get_privileges(261) get_privileges: No privileges assigned to SID [S-1-5-2] [2005/10/28 18:13:40, 3] lib/privileges.c:get_privileges(261) get_privileges: No privileges assigned to SID [S-1-5-11] [2005/10/28 18:13:40, 3] lib/privileges.c:get_privileges(261) get_privileges: No privileges assigned to SID [S-1-5-21-726309263-4128913605-1168186429-1001] [2005/10/28 18:13:40, 3] lib/privileges.c:get_privileges(261) get_privileges: No privileges assigned to SID [S-1-5-21-726309263-4128913605-1168186429-1129] [2005/10/28 18:13:40, 10] auth/auth_util.c:debug_nt_user_token(457) NT user token of user S-1-5-21-726309263-4128913605-1168186429-500 contains 7 SIDs SID[ 0]: S-1-5-21-726309263-4128913605-1168186429-500 SID[ 1]: S-1-5-21-726309263-4128913605-1168186429-512 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SID[ 5]: S-1-5-21-726309263-4128913605-1168186429-1001 SID[ 6]: S-1-5-21-726309263-4128913605-1168186429-1129 SE_PRIV 0x0 0x0 0x0 0x0 [2005/10/28 18:13:40, 5] auth/auth_util.c:make_server_info_sam(867) make_server_info_sam: made server info for user root -> root [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: sam authentication for user [root] succeeded [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(0) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth.c:check_ntlm_password(294) check_ntlm_password: PAM Account for user [root] succeeded [2005/10/28 18:13:40, 2] auth/auth.c:check_ntlm_password(307) check_ntlm_password: authentication for user [root] -> [root] -> [root] succeeded [2005/10/28 18:13:40, 5] auth/auth_util.c:free_user_info(1454) attempting to free (and zero) a user_info structure [2005/10/28 18:13:40, 10] auth/auth_util.c:free_user_info(1457) structure was created for root [2005/10/28 18:13:40, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(118) Got NT session key of length 16 [2005/10/28 18:13:40, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(125) Got LM session key of length 16 [2005/10/28 18:13:40, 10] libsmb/ntlmssp.c:ntlmssp_server_auth(708) ntlmssp_server_auth: Created NTLM2 session key. [2005/10/28 18:13:40, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(332) NTLMSSP Sign/Seal - Initialising with flags: [2005/10/28 18:13:40, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) Got NTLMSSP neg_flags=0x60080235 NTLMSSP_NEGOTIATE_UNICODE NTLMSSP_REQUEST_TARGET NTLMSSP_NEGOTIATE_SIGN NTLMSSP_NEGOTIATE_SEAL NTLMSSP_NEGOTIATE_NTLM NTLMSSP_NEGOTIATE_NTLM2 NTLMSSP_NEGOTIATE_128 NTLMSSP_NEGOTIATE_KEY_EXCH [2005/10/28 18:13:40, 10] smbd/password.c:register_vuid(182) register_vuid: allocated vuid = 101 [2005/10/28 18:13:40, 10] lib/util_pw.c:getpwnam_alloc(98) Got root from pwnam_cache [2005/10/28 18:13:40, 10] smbd/password.c:register_vuid(255) register_vuid: (0,0) root root MIDEARTH guest=0 [2005/10/28 18:13:40, 3] smbd/password.c:register_vuid(257) User name: root Real name: System Boss Man [2005/10/28 18:13:40, 3] smbd/password.c:register_vuid(276) UNIX uid 0 is UNIX user root, and will be vuid 101 [2005/10/28 18:13:40, 7] param/loadparm.c:lp_servicenumber(4229) lp_servicenumber: couldn't find root [2005/10/28 18:13:40, 3] smbd/password.c:register_vuid(305) Adding homes service for user 'root' using home directory: '/root' [2005/10/28 18:13:40, 8] param/loadparm.c:add_a_service(2397) add_a_service: Creating snum = 15 for root [2005/10/28 18:13:40, 3] param/loadparm.c:lp_add_home(2438) adding home's share [root] for user 'root' at '/data/users/%U/Documents' [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=160 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=101 smb_mid=4 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 9 (0x9) smb_bcc=117 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 [020] 00 2E 00 30 00 2E 00 32 00 31 00 70 00 72 00 65 ...0...2 .1.p.r.e [030] 00 31 00 2D 00 53 00 56 00 4E 00 2D 00 62 00 75 .1.-.S.V .N.-.b.u [040] 00 69 00 6C 00 64 00 2D 00 55 00 4E 00 4B 00 4E .i.l.d.- .U.N.K.N [050] 00 4F 00 57 00 4E 00 2D 00 53 00 55 00 53 00 45 .O.W.N.- .S.U.S.E [060] 00 00 00 4D 00 49 00 44 00 45 00 41 00 52 00 54 ...M.I.D .E.A.R.T [070] 00 48 00 00 00 .H... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 76 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x4c [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 4 of length 80 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=76 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=101 smb_mid=5 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1 (0x1) smb_bcc=33 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 5C 00 4D 00 45 00 52 00 4C 00 49 00 4E .\.\.M.E .R.L.I.N [010] 00 5C 00 49 00 50 00 43 00 24 00 00 00 49 50 43 .\.I.P.C .$...IPC [020] 00 . [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtconX (pid 6132) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 4] smbd/reply.c:reply_tcon_and_X(617) Client requested device type [IPC] for share [IPC$] [2005/10/28 18:13:40, 5] smbd/service.c:make_connection(815) making a connection to 'normal' service ipc$ [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_alloc(313) Finding user root [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_internals(262) Trying _Get_Pwnam(), username as lowercase is root [2005/10/28 18:13:40, 10] lib/util_pw.c:getpwnam_alloc(98) Got root from pwnam_cache [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_internals(290) Get_Pwnam_internals did find user [root]! [2005/10/28 18:13:40, 3] smbd/service.c:make_connection_snum(478) Connect path is '/var/tmp' for service [IPC$] [2005/10/28 18:13:40, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(218) get_share_security: using default secdesc for IPC$ [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_map_generic(176) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x00000002, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-500. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-500 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-512 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1001 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1129 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 [2005/10/28 18:13:40, 5] lib/util_seaccess.c:se_access_check(308) se_access_check: access (2) granted. [2005/10/28 18:13:40, 3] smbd/vfs.c:vfs_init_default(215) Initialising default vfs hooks [2005/10/28 18:13:40, 5] smbd/connection.c:claim_connection(170) claiming IPC$ 0 [2005/10/28 18:13:40, 10] smbd/uid.c:is_share_read_only_for_user(122) is_share_read_only_for_user: share IPC$ is read-only for unix user root [2005/10/28 18:13:40, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(218) get_share_security: using default secdesc for IPC$ [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_map_generic(176) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x00000001, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-500. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-500 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-512 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1001 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1129 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 [2005/10/28 18:13:40, 5] lib/util_seaccess.c:se_access_check(308) se_access_check: access (1) granted. [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(457) NT user token of user S-1-5-21-726309263-4128913605-1168186429-500 contains 7 SIDs SID[ 0]: S-1-5-21-726309263-4128913605-1168186429-500 SID[ 1]: S-1-5-21-726309263-4128913605-1168186429-512 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SID[ 5]: S-1-5-21-726309263-4128913605-1168186429-1001 SID[ 6]: S-1-5-21-726309263-4128913605-1168186429-1129 SE_PRIV 0x0 0x0 0x0 0x0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 3 supplementary groups Group[ 0]: 0 Group[ 1]: 64 Group[ 2]: 512 [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_user(304) change_to_user uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/service.c:make_connection_snum(666) merlin (172.16.10.4) connect to service IPC$ initially as user root (uid=0, gid=0) (pid 6132) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/reply.c:reply_tcon_and_X(665) tconX service=IPC$ [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=48 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=5 smt_wct=3 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_bcc=7 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 49 50 43 00 00 00 00 IPC.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 100 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x64 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 5 of length 104 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=100 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=6 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 3584 (0xE00) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=17 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 18 5C 00 6C 00 73 00 61 00 72 00 70 00 63 00 00 .\.l.s.a .r.p.c.. [010] 00 . [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBntcreateX (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(457) NT user token of user S-1-5-21-726309263-4128913605-1168186429-500 contains 7 SIDs SID[ 0]: S-1-5-21-726309263-4128913605-1168186429-500 SID[ 1]: S-1-5-21-726309263-4128913605-1168186429-512 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-11 SID[ 5]: S-1-5-21-726309263-4128913605-1168186429-1001 SID[ 6]: S-1-5-21-726309263-4128913605-1168186429-1129 SE_PRIV 0x0 0x0 0x0 0x0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 3 supplementary groups Group[ 0]: 0 Group[ 1]: 64 Group[ 2]: 512 [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_user(304) change_to_user uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 4] smbd/vfs.c:vfs_ChDir(737) vfs_ChDir to /var/tmp [2005/10/28 18:13:40, 10] smbd/nttrans.c:reply_ntcreate_and_X(506) reply_ntcreateX: flags = 0x0, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 [2005/10/28 18:13:40, 4] smbd/nttrans.c:nt_open_pipe(330) nt_open_pipe: Opening pipe \lsarpc. [2005/10/28 18:13:40, 3] smbd/nttrans.c:nt_open_pipe(351) nt_open_pipe: Known pipe lsarpc opening. [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) Open pipe requested lsarpc (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) Create pipe requested lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) init_pipe_handles: created handle list for pipe lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) init_pipe_handles: pipe_handles ref count = 1 for pipe lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) Created internal pipe lsarpc (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) Opened pipe lsarpc with handle 7140 (pipes_open=1) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) open pipes: name lsarpc pnum=7140 [2005/10/28 18:13:40, 5] smbd/nttrans.c:do_ntcreate_pipe_open(400) do_ntcreate_pipe_open: open pipe = \lsarpc [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=6 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=16384 (0x4000) smb_vwv[ 3]= 369 (0x171) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 154 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x9a [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 6 of length 158 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=7 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28992 (0x7140) smb_bcc=87 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 08 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 W4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=72 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7140 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7140 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "lsarpc" (pnum 7140) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7140 name: lsarpc open: Yes len: 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0048 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000008 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 11, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 11 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1423) api_pipe_bind_req: decode request. 1423 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1434) api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_rb [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0008 num_contexts: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000c context_id : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 000e num_transfer_syntaxes: 01 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00000f smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 data : 12345778 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 data : 1234 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 data : abcd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0018 data : ef 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 001a data : 01 23 45 67 89 ab [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 version: 00000000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0028 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 002a data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002c data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002e data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0034 version: 00000002 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1476) api_pipe_bind_req: make response. 1476 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:check_bind_req(910) check_bind_req for \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_ba [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 000053f0 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 smb_io_rpc_addr_str [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 len: 000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000a str: \PIPE\lsass. [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 smb_io_rpc_results [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0018 num_results: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001c result : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001e reason : 0000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0026 data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0028 data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002a data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 version: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0044 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000008 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 56 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7140 name: lsarpc len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(979) read_from_pipe: lsarpc: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..68] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=7 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 08 00 00 ........ .D...... [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 150 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x96 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 7 of length 154 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=150 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=8 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 68 (0x44) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28992 (0x7140) smb_bcc=83 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 44 00 00 00 09 00 00 00 2C .......D ......., [020] 00 00 00 00 00 06 00 01 00 00 00 5C 00 00 00 18 ........ ...\.... [030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [040] 00 00 00 01 00 00 00 0C 00 00 00 02 00 01 00 00 ........ ........ [050] 00 00 02 ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=68 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7140 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7140 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "lsarpc" (pnum 7140) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7140 name: lsarpc open: Yes len: 68 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 68 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 68 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 68, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 52 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0044 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000009 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 52, incoming data = 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 0000002c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0006 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 70 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: lsarpc op 0x6 - api_rpcTNP: rpc command: LSA_OPENPOLICY [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[1].fn == 0x81343f6 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_q_open_pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 ptr : 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 system_name: 005c [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 lsa_io_obj_attr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 len : 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c ptr_root_dir: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 ptr_obj_name: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 attributes : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 ptr_sec_desc: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 001c ptr_sec_qos : 00000001 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000020 lsa_io_obj_qos sec_qos [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 len : 0000000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 sec_imp_level : 0002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0026 sec_ctxt_mode : 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0027 effective_only: 00 [2005/10/28 18:13:40, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(181) lsa_io_sec_qos: length c does not match size 8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0028 des_access: 02000000 [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x02000000, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-500. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-500 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-512 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1001 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1129 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) Opened policy hnd[1] [000] 00 00 00 00 01 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_r_open_pol [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0014 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called lsarpc successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 808 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 52 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7140 name: lsarpc len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0030 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=8 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 09 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ [020] 00 00 00 00 00 B4 BE 62 43 F4 17 00 00 00 00 00 .......b C....... [030] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 128 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x80 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 8 of length 132 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=9 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 46 (0x2E) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 46 (0x2E) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28992 (0x7140) smb_bcc=61 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 2E 00 00 00 0A 00 00 00 16 ........ ........ [020] 00 00 00 00 00 07 00 00 00 00 00 01 00 00 00 00 ........ ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 05 00 .....bC. ..... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=46 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7140 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7140 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "lsarpc" (pnum 7140) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7140 name: lsarpc open: Yes len: 46 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 46 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 46 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 46, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 30 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 30 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 002e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000a [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 30 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 30, incoming data = 30 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000016 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0007 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: lsarpc op 0x7 - api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[2].fn == 0x813466b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_q_query [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 info_class: 0005 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_r_query [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 undoc_buffer: 22000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 info_class: 0005 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 lsa_io_dom_query [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 uni_dom_max_len: 0010 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a uni_dom_str_len: 0012 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c buffer_dom_name: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 buffer_dom_sid : 00000001 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000014 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 001c uni_str_len: 00000008 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0020 buffer : M.I.D.E.A.R.T.H. [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000030 smb_io_dom_sid2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 num_auths: 00000004 [2005/10/28 18:13:40, 8] rpc_parse/parse_prs.c:prs_debug(84) 000034 smb_io_dom_sid sid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0034 sid_rev_num: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0035 num_auths : 04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0036 id_auth[0] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0037 id_auth[1] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0038 id_auth[2] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0039 id_auth[3] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 003a id_auth[4] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 003b id_auth[5] : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32s(930) 003c sub_auths : 00000015 2b4a998f f61a38c5 45a11c3d [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 004c status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called lsarpc successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 18 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 30 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7140 name: lsarpc len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 80. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0068 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000050 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..104] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=160 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=9 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 104 (0x68) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 104 (0x68) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=105 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 68 00 00 00 0A 00 00 ........ .h...... [010] 00 50 00 00 00 00 00 00 00 00 00 00 22 05 00 00 .P...... ...."... [020] 00 10 00 12 00 01 00 00 00 01 00 00 00 09 00 00 ........ ........ [030] 00 00 00 00 00 08 00 00 00 4D 00 49 00 44 00 45 ........ .M.I.D.E [040] 00 41 00 52 00 54 00 48 00 04 00 00 00 01 04 00 .A.R.T.H ........ [050] 00 00 00 00 05 15 00 00 00 8F 99 4A 2B C5 38 1A ........ ...J+.8. [060] F6 3D 1C A1 45 00 00 00 00 .=..E... . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 126 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x7e [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 9 of length 130 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=126 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=10 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28992 (0x7140) smb_bcc=59 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 2C 00 00 00 0B 00 00 00 14 ......., ........ [020] 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ........ ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 .....bC. ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=44 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7140 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7140 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "lsarpc" (pnum 7140) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7140 name: lsarpc open: Yes len: 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 002c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000b [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000014 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0000 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: lsarpc op 0x0 - api_rpcTNP: rpc command: LSA_CLOSE [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[4].fn == 0x8134b71 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_q_close [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 01 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 lsa_io_r_close [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: 00 00 00 00 00 00 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0014 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called lsarpc successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 28 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7140 name: lsarpc len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: lsarpc: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0030 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=10 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 0B 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [030] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 41 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x29 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 10 of length 45 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=11 smt_wct=3 smb_vwv[ 0]=28992 (0x7140) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBclose (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7140 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name lsarpc pnum=7140 (pipes_open=1) [2005/10/28 18:13:40, 5] smbd/pipes.c:reply_pipe_close(272) reply_pipe_close: pnum:7140 [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) close_policy_by_pipe: deleted handle list for pipe lsarpc [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1094) closed pipe name lsarpc pnum=7140 (pipes_open=0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=11 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 96 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x60 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 11 of length 100 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=96 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=12 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 2560 (0xA00) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=13 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 73 00 61 00 6D 00 72 00 00 00 .\.s.a.m .r... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBntcreateX (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 10] smbd/nttrans.c:reply_ntcreate_and_X(506) reply_ntcreateX: flags = 0x0, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 [2005/10/28 18:13:40, 4] smbd/nttrans.c:nt_open_pipe(330) nt_open_pipe: Opening pipe \samr. [2005/10/28 18:13:40, 3] smbd/nttrans.c:nt_open_pipe(351) nt_open_pipe: Known pipe samr opening. [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) Open pipe requested samr (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) Create pipe requested samr [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) init_pipe_handles: created handle list for pipe samr [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) init_pipe_handles: pipe_handles ref count = 1 for pipe samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) Created internal pipe samr (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) Opened pipe samr with handle 7141 (pipes_open=1) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) open pipes: name samr pnum=7141 [2005/10/28 18:13:40, 5] smbd/nttrans.c:do_ntcreate_pipe_open(400) do_ntcreate_pipe_open: open pipe = \samr [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=12 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=16640 (0x4100) smb_vwv[ 3]= 369 (0x171) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 154 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x9a [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 12 of length 158 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=13 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=87 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 0C 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AC 01 W4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=72 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0048 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000c [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 11, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 11 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1423) api_pipe_bind_req: decode request. 1423 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1434) api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_rb [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0008 num_contexts: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000c context_id : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 000e num_transfer_syntaxes: 01 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00000f smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 data : 12345778 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 data : 1234 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 data : abcd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0018 data : ef 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 001a data : 01 23 45 67 89 ac [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 version: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0028 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 002a data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002c data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002e data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0034 version: 00000002 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1476) api_pipe_bind_req: make response. 1476 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:check_bind_req(910) check_bind_req for \PIPE\samr [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\samr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_ba [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 000053f0 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 smb_io_rpc_addr_str [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 len: 000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000a str: \PIPE\lsass. [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 smb_io_rpc_results [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0018 num_results: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001c result : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001e reason : 0000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0026 data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0028 data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002a data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 version: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0044 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000c [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 56 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(979) read_from_pipe: samr: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..68] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=13 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 0C 00 00 ........ .D...... [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 142 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x8e [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 13 of length 146 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=142 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=14 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 60 (0x3C) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=75 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 3C 00 00 00 0D 00 00 00 24 .......< .......$ [020] 00 00 00 00 00 39 00 01 00 00 00 07 00 00 00 00 .....9.. ........ [030] 00 00 00 07 00 00 00 4D 00 45 00 52 00 4C 00 49 .......M .E.R.L.I [040] 00 4E 00 00 00 00 00 00 00 00 02 .N...... ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=60 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 60, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 44 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 003c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000d [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 44, incoming data = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000024 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0039 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 68 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: samr op 0x39 - api_rpcTNP: rpc command: SAMR_CONNECT [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[1].fn == 0x8176414 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_q_connect [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 ptr_srv_name: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000004 smb_io_unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 uni_max_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c uni_str_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0010 buffer : M.E.R.L.I.N... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 access_mask: 02000000 [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_connect(2160) _samr_connect: 2160 [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x02000000, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-500. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-500 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-512 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1001 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1129 [2005/10/28 18:13:40, 4] rpc_server/srv_samr_nt.c:access_check_samr_object(182) _samr_connect: access GRANTED (requested: 0x02000000, granted: 0x000f003f) [2005/10/28 18:13:40, 10] rpc_server/srv_samr_nt.c:get_samr_info_by_sid(240) get_samr_info_by_sid: created new info for sid (NULL) [2005/10/28 18:13:40, 10] rpc_server/srv_samr_nt.c:get_samr_info_by_sid(244) get_samr_info_by_sid: created new info for NULL sid. [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) Opened policy hnd[1] [000] 00 00 00 00 02 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_connect(2192) _samr_connect: 2192 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_r_connect [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd connect_pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0014 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called samr successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 970 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 44 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0030 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000d [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=14 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 0D 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ [020] 00 00 00 00 00 B4 BE 62 43 F4 17 00 00 00 00 00 .......b C....... [030] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 158 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x9e [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 14 of length 162 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=158 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=15 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 76 (0x4C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 76 (0x4C) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=91 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 4C 00 00 00 0E 00 00 00 34 .......L .......4 [020] 00 00 00 00 00 07 00 00 00 00 00 02 00 00 00 00 ........ ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 00 00 00 02 04 .....bC. ........ [040] 00 00 00 01 04 00 00 00 00 00 05 15 00 00 00 8F ........ ........ [050] 99 4A 2B C5 38 1A F6 3D 1C A1 45 .J+.8..= ..E [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=76 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 76 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 76 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 76 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 76, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 004c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000e [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 60, incoming data = 60 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000034 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0007 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: samr op 0x7 - api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[39].fn == 0x817478d [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_q_open_domain [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 flags: 02000000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000018 smb_io_dom_sid2 sid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 num_auths: 00000004 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 00001c smb_io_dom_sid sid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 001c sid_rev_num: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 001d num_auths : 04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 001e id_auth[0] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 001f id_auth[1] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0020 id_auth[2] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0021 id_auth[3] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0022 id_auth[4] : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0023 id_auth[5] : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32s(930) 0024 sub_auths : 00000015 2b4a998f f61a38c5 45a11c3d [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(194) _samr_open_domain: access check ((granted: 0x000f003f; required: 0x00000020) [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x02000000, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-500. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-500 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-512 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1001 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1129 [2005/10/28 18:13:40, 4] rpc_server/srv_samr_nt.c:access_check_samr_object(182) _samr_open_domain: access GRANTED (requested: 0x02000000, granted: 0x000f07ff) [2005/10/28 18:13:40, 10] rpc_server/srv_samr_nt.c:get_samr_info_by_sid(240) get_samr_info_by_sid: created new info for sid S-1-5-21-726309263-4128913605-1168186429 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) Opened policy hnd[2] [000] 00 00 00 00 03 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_open_domain(390) samr_open_domain: 390 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_r_open_domain [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd domain_pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000003 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0014 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called samr successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 956 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 60 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0030 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=15 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 0E 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 03 00 00 ........ ........ [020] 00 00 00 00 00 B4 BE 62 43 F4 17 00 00 00 00 00 .......b C....... [030] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 170 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xaa [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 15 of length 174 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=170 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=16 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 88 (0x58) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=103 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 58 00 00 00 0F 00 00 00 40 .......X .......@ [020] 00 00 00 00 00 32 00 00 00 00 00 03 00 00 00 00 .....2.. ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 0E 00 0E 00 01 .....bC. ........ [040] 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 6D ........ .......m [050] 00 65 00 72 00 6C 00 69 00 6E 00 24 00 00 00 00 .e.r.l.i .n.$.... [060] 01 00 00 0B 00 05 E0 ....... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=88 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 88 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 88 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 88 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 88, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 72 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0058 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000f [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 72, incoming data = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000040 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0032 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: samr op 0x32 - api_rpcTNP: rpc command: SAMR_CREATE_USER [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[33].fn == 0x81760e9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_q_create_user [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd domain_pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000003 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000014 smb_io_unihdr hdr_name [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 uni_str_len: 000e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 uni_max_len: 000e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 buffer : 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00001c smb_io_unistr2 uni_name [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 001c uni_max_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 uni_str_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0028 buffer : m.e.r.l.i.n.$. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0038 acb_info : 00000100 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 003c access_mask: e005000b [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 03 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(194) _samr_create_user: access check ((granted: 0x000f07ff; required: 0x00000010) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [dc=terpstra-world,dc=org], filter => [(&(uid=merlin$)(objectclass=sambaSamAccount))], scope => [2] [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_sam_from_ldap(639) init_sam_from_ldap: Entry found for user: merlin$ [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557) pdb_set_user_sid_from_string: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592) pdb_set_group_sid_from_string: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogoffTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaKickoffTime] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomeDrive] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomePath] = [] [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonScript] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaProfilePath] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaUserWorkstations] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaMungedDial] = [] [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordCount] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonHours] = [] [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(83) Looking up login cache for user merlin$ [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(97) No cache entry found [2005/10/28 18:13:40, 9] passdb/pdb_ldap.c:init_sam_from_ldap(994) No cache entry, bad count = 0, bad time = 0 [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 from rid 3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 from rid 553 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_r_create_user [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd user_pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: 00 00 00 00 00 00 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 access_granted: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 user_rid : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 001c status: NT_STATUS_USER_EXISTS [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called samr successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 14 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 72 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 32. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0038 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000000f [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000020 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..56] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=112 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=16 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 56 (0x38) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 56 (0x38) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=57 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 38 00 00 00 0F 00 00 ........ .8...... [010] 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 . ...... ........ [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [030] 00 00 00 00 00 63 00 00 C0 .....c.. . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 176 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xb0 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 16 of length 180 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=176 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=17 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 94 (0x5E) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 94 (0x5E) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=109 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 5E 00 00 00 10 00 00 00 46 .......^ .......F [020] 00 00 00 00 00 11 00 00 00 00 00 03 00 00 00 00 ........ ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 01 00 00 00 E8 .....bC. ........ [040] 03 00 00 00 00 00 00 01 00 00 00 0E 00 0E 00 01 ........ ........ [050] 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 6D ........ .......m [060] 00 65 00 72 00 6C 00 69 00 6E 00 24 00 .e.r.l.i .n.$. [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=94 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 94, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 78 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 005e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000010 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 78, incoming data = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000046 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0011 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: samr op 0x11 - api_rpcTNP: rpc command: SAMR_LOOKUP_NAMES [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[19].fn == 0x81755c1 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_q_lookup_names [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000003 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 num_names1: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 flags : 000003e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 001c ptr : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 num_names2: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_unihdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 uni_str_len: 000e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0026 uni_max_len: 000e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0028 buffer : 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00002c smb_io_unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 002c uni_max_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0034 uni_str_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0038 buffer : m.e.r.l.i.n.$. [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_lookup_names(1094) _samr_lookup_names: 1094 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 03 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(194) _samr_lookup_names: access check ((granted: 0x000f07ff; required: 0000000000) [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_lookup_names(1113) _samr_lookup_names: looking name on SID S-1-5-21-726309263-4128913605-1168186429 [2005/10/28 18:13:40, 10] passdb/util_sam_sid.c:map_name_to_wellknown_sid(204) map_name_to_wellknown_sid: looking up merlin$ [2005/10/28 18:13:40, 4] lib/username.c:map_username(171) Scanning username map /etc/samba/smbusers [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [dc=terpstra-world,dc=org], filter => [(&(uid=merlin$)(objectclass=sambaSamAccount))], scope => [2] [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_sam_from_ldap(639) init_sam_from_ldap: Entry found for user: merlin$ [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557) pdb_set_user_sid_from_string: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592) pdb_set_group_sid_from_string: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogoffTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaKickoffTime] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomeDrive] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomePath] = [] [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonScript] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaProfilePath] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaUserWorkstations] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaMungedDial] = [] [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordCount] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonHours] = [] [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(83) Looking up login cache for user merlin$ [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(97) No cache entry found [2005/10/28 18:13:40, 9] passdb/pdb_ldap.c:init_sam_from_ldap(994) No cache entry, bad count = 0, bad time = 0 [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 from rid 3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 from rid 553 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_samr.c:init_samr_r_lookup_names(4689) init_samr_r_lookup_names [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_lookup_names(1157) _samr_lookup_names: 1157 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_r_lookup_names [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 num_rids1: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 ptr_rids : 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 num_rids2: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c rid[00] : 00000bca [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 num_types1: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 ptr_types : 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 num_types2: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 001c type[00] : 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0020 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called samr successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 46 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 78 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 36. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 003c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000010 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000024 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..60] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=116 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=17 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 60 (0x3C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 60 (0x3C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=61 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 3C 00 00 00 10 00 00 ........ .<...... [010] 00 24 00 00 00 00 00 00 00 01 00 00 00 01 00 00 .$...... ........ [020] 00 01 00 00 00 CA 0B 00 00 01 00 00 00 01 00 00 ........ ........ [030] 00 01 00 00 00 01 00 00 00 00 00 00 00 ........ ..... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 134 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x86 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 17 of length 138 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=134 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=18 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 52 (0x34) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 52 (0x34) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=67 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 34 00 00 00 11 00 00 00 1C .......4 ........ [020] 00 00 00 00 00 22 00 00 00 00 00 03 00 00 00 00 .....".. ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 00 00 00 02 CA .....bC. ........ [040] 0B 00 00 ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=52 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 52, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 36 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 36 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0034 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000011 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 36 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 36, incoming data = 36 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 0000001c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0022 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: samr op 0x22 - api_rpcTNP: rpc command: SAMR_OPEN_USER [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[20].fn == 0x8175aa2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_q_open_user [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd domain_pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000003 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0014 access_mask: 02000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 user_rid : 00000bca [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 03 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(194) _samr_open_user: access check ((granted: 0x000f07ff; required: 0x00000200) [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x02000000, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-500. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-500 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-512 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-11 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1001 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-1129 [2005/10/28 18:13:40, 4] rpc_server/srv_samr_nt.c:access_check_samr_object(182) _samr_open_user: access GRANTED (requested: 0x02000000, granted: 0x000f07ff) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 from rid 3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 from rid 553 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_samr_nt.c:get_samr_info_by_sid(240) get_samr_info_by_sid: created new info for sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:create_policy_hnd(142) Opened policy hnd[3] [000] 00 00 00 00 04 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_r_open_user [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd user_pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000004 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0014 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called samr successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 1744 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 36 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0030 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000011 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=18 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 11 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 04 00 00 ........ ........ [020] 00 00 00 00 00 B4 BE 62 43 F4 17 00 00 00 00 00 .......b C....... [030] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 650 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x28a [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 18 of length 654 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=650 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=19 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 568 (0x238) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 568 (0x238) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=583 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 38 02 00 00 12 00 00 00 20 .......8 ....... [020] 02 00 00 00 00 3A 00 00 00 00 00 04 00 00 00 00 .....:.. ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 18 00 18 00 60 .....bC. .......` [040] 85 E9 D6 41 1C 81 71 61 76 17 BC 58 E7 79 42 60 ...A..qa v..X.yB` [050] 0A D0 D0 1F AB E3 DE 93 B9 59 B1 A1 AF D1 31 D6 ........ .Y....1. [060] A6 15 18 11 90 02 82 9D 28 21 B4 F6 1B 7B 81 31 ........ (!...{.1 [070] C6 D6 DB 24 69 8C 3D D9 F9 CB BD F7 70 E2 66 B0 ...$i.=. ....p.f. [080] 80 4D 0B 84 E6 59 1C B7 61 B0 B3 D9 09 93 9C 5E .M...Y.. a......^ [090] 10 36 EC A2 C2 2C D5 7C 3D 66 25 78 AD 94 31 46 .6...,.| =f%x..1F [0A0] 0A 0B EE 9D D5 C4 A1 8B BD 76 3D 75 E3 C3 74 3D ........ .v=u..t= [0B0] 99 30 5B C5 F8 DB 8A 23 2E 3F A2 F3 95 DC 2B 5E .0[....# .?....+^ [0C0] 26 50 B2 DD D0 49 EB 20 F3 26 48 6F 1F C6 F7 03 &P...I. .&Ho.... [0D0] 4C AF FF 75 57 99 8E CB B2 4D 29 79 CF 7D 34 26 L..uW... .M)y.}4& [0E0] 08 E6 02 67 88 BC 11 2F 95 E7 EC 41 CE 8E C1 F6 ...g.../ ...A.... [0F0] 63 37 6A F2 BB 35 CF 7F D3 BA 11 F5 4E D1 F9 9C c7j..5.. ....N... [100] C4 0A 4F 7D BA 83 32 5D 00 AC FA AA 07 F7 75 DA ..O}..2] ......u. [110] CC 2A B6 43 20 D9 47 B2 D6 39 3D 0C 3F C8 D7 D4 .*.C .G. .9=.?... [120] 3E 6F 42 F5 FD 90 ED B3 CC 1D 07 16 2D 59 30 F7 >oB..... ....-Y0. [130] 79 8B 81 9B ED 2F 7D A2 C4 05 87 F0 1A 11 2A 2C y..../}. ......*, [140] E5 CF 40 D3 67 07 98 FD 06 2E A9 08 FA B3 38 21 ..@.g... ......8! [150] C3 DC 31 CC C2 F7 DC F7 4A 92 14 E2 87 07 88 48 ..1..... J......H [160] 2E A0 5F BA F0 9C 59 12 55 43 EC BD E7 90 20 89 .._...Y. UC.... . [170] A9 EB 01 F7 83 59 C0 23 58 17 A7 CE 73 A1 6E FC .....Y.# X...s.n. [180] 51 B8 92 6C 99 B9 1F 86 EB 60 AC 95 06 96 2E E6 Q..l.... .`...... [190] 73 0D EF 62 22 A6 D5 87 6E 72 1E 84 81 85 B0 62 s..b"... nr.....b [1A0] F7 03 F0 FE A2 EF 05 55 21 E9 1C E5 A6 6A 52 CA .......U !....jR. [1B0] F2 EF E6 45 9B 4A 19 E7 1E E4 4C B4 6A 55 D9 CB ...E.J.. ..L.jU.. [1C0] 7E F6 9C 6F 63 BF AF 18 2C 4F 8B 78 9C DE 25 B7 ~..oc... ,O.x..%. [1D0] EC 19 F1 18 21 63 D6 99 22 18 01 A8 72 E7 46 33 ....!c.. "...r.F3 [1E0] 68 6C F4 F8 69 9F FA D5 B0 7E FD CF AF 6D 63 70 hl..i... .~...mcp [1F0] 66 F7 4E 55 D9 F8 6B 0E 2B FA F1 9F 6B BE B5 61 f.NU..k. +...k..a [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=568 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 568 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 568 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 568 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 568, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 552 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 552 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0238 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000012 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 552 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 552, incoming data = 552 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000220 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 003a [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: samr op 0x3a - api_rpcTNP: rpc command: SAMR_SET_USERINFO [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[22].fn == 0x8176c0a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_q_set_userinfo [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000004 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 switch_value: 0018 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 samr_io_userinfo_ctr ctr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 switch_value: 0018 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000018 sam_io_user_info24 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0018 password: 60 85 e9 d6 41 1c 81 71 61 76 17 bc 58 e7 79 42 60 0a d0 d0 1f ab e3 de 93 b9 59 b1 a1 af d1 31 d6 a6 15 18 11 90 02 82 9d 28 21 b4 f6 1b 7b 81 31 c6 d6 db 24 69 8c 3d d9 f9 cb bd f7 70 e2 66 b0 80 4d 0b 84 e6 59 1c b7 61 b0 b3 d9 09 93 9c 5e 10 36 ec a2 c2 2c d5 7c 3d 66 25 78 ad 94 31 46 0a 0b ee 9d d5 c4 a1 8b bd 76 3d 75 e3 c3 74 3d 99 30 5b c5 f8 db 8a 23 2e 3f a2 f3 95 dc 2b 5e 26 50 b2 dd d0 49 eb 20 f3 26 48 6f 1f c6 f7 03 4c af ff 75 57 99 8e cb b2 4d 29 79 cf 7d 34 26 08 e6 02 67 88 bc 11 2f 95 e7 ec 41 ce 8e c1 f6 63 37 6a f2 bb 35 cf 7f d3 ba 11 f5 4e d1 f9 9c c4 0a 4f 7d ba 83 32 5d 00 ac fa aa 07 f7 75 da cc 2a b6 43 20 d9 47 b2 d6 39 3d 0c 3f c8 d7 d4 3e 6f 42 f5 fd 90 ed b3 cc 1d 07 16 2d 59 30 f7 79 8b 81 9b ed 2f 7d a2 c4 05 87 f0 1a 11 2a 2c e5 cf 40 d3 67 07 98 fd 06 2e a9 08 fa b3 38 21 c3 dc 31 cc c2 f7 dc f7 4a 92 14 e2 87 07 88 48 2e a0 5f ba f0 9c 59 12 55 43 ec bd e7 90 20 89 a9 eb 01 f7 83 59 c0 23 58 17 a7 ce 73 a1 6e fc 51 b8 92 6c 99 b9 1f 86 eb 60 a +> c 95 06 96 2e e6 73 0d ef 62 22 a6 d5 87 6e 72 1e 84 81 85 b0 62 f7 03 f0 fe a2 ef 05 55 21 e9 1c e5 a6 6a 52 ca f2 ef e6 45 9b 4a 19 e7 1e e4 4c b4 6a 55 d9 cb 7e f6 9c 6f 63 bf af 18 2c 4f 8b 78 9c de 25 b7 ec 19 f1 18 21 63 d6 99 22 18 01 a8 72 e7 46 33 68 6c f4 f8 69 9f fa d5 b0 7e fd cf af 6d 63 70 66 f7 4e 55 d9 f8 6b 0e 2b fa f1 9f 6b be b5 61 85 9d a1 56 1a 42 90 dc 9b 04 ec 7d a3 f0 97 b0 b6 45 d2 7f d0 74 78 08 0e b8 df 68 8e ff 08 aa ed b7 01 ae c6 ee 1f cf ab 9a 86 08 a4 67 e5 09 7c 0f fb d5 50 ab db 06 f4 a3 79 ba cd cc 8b 98 00 58 f5 [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_set_userinfo(2755) _samr_set_userinfo: 2755 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 04 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(194) _samr_set_userinfo: access check ((granted: 0x000f07ff; required: 0x000000b0) [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_set_userinfo(2771) _samr_set_userinfo: sid:S-1-5-21-726309263-4128913605-1168186429-3018, level:24 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 from rid 3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 from rid 553 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_set_userinfo(2803) _samr_set_userinfo: does possess sufficient rights [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:set_user_info_pw(2687) Attempting administrator password change for user merlin$ [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:12:39 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_get(401) cache_account_policy_get: no valid cache entry (cache expired) [2005/10/28 18:13:40, 10] passdb/pdb_ldap.c:ldapsam_get_account_policy_from_ldap(3349) ldapsam_get_account_policy_from_ldap [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [sambaDomainName=MIDEARTH,dc=terpstra-world,dc=org], filter => [(objectclass=*)], scope => [0] [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_set(368) cache_account_policy_set: updating account pol cache [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_set(348) account_policy_set: name: maximum password age, value: -1 [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:12:39 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(203) account policy cache lastset now: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_set(380) cache_account_policy_set: cache valid until: Fri, 28 Oct 2005 18:14:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:12:39 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_get(401) cache_account_policy_get: no valid cache entry (cache expired) [2005/10/28 18:13:40, 10] passdb/pdb_ldap.c:ldapsam_get_account_policy_from_ldap(3349) ldapsam_get_account_policy_from_ldap [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [sambaDomainName=MIDEARTH,dc=terpstra-world,dc=org], filter => [(objectclass=*)], scope => [0] [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_set(368) cache_account_policy_set: updating account pol cache [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_set(348) account_policy_set: name: minimum password age, value: 0 [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:12:39 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(203) account policy cache lastset now: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:cache_account_policy_set(380) cache_account_policy_set: cache valid until: Fri, 28 Oct 2005 18:14:40 GMT [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:set_user_info_pw(2707) Changing trust account or non-unix-user password, not updating /etc/passwd [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:set_user_info_pw(2725) set_user_info_pw: pdb_update_pwd() [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [dc=terpstra-world,dc=org], filter => [(&(uid=merlin$)(objectclass=sambaSamAccount))], scope => [2] [2005/10/28 18:13:40, 4] passdb/pdb_ldap.c:ldapsam_update_sam_account(1836) ldapsam_update_sam_account: user merlin$ to be modified has dn: uid=merlin$,ou=Computers,ou=Users,dc=terpstra-world,dc=org [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_ldap_from_sam(1054) init_ldap_from_sam: Setting entry for user: merlin$ [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(454) smbldap_make_mod: deleting attribute |sambaPwdCanChange| values |1130544759| [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(463) smbldap_make_mod: adding attribute |sambaPwdCanChange| value |1130544820| [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(438) smbldap_make_mod: attribute |sambaPwdMustChange| not changed. [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(454) smbldap_make_mod: deleting attribute |sambaLMPassword| values |6DDB6584C6DCFC2D64AD4C2D8725BFCC| [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(463) smbldap_make_mod: adding attribute |sambaLMPassword| value |9418E92DD6FF1190B13B4D390E77FEED| [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(454) smbldap_make_mod: deleting attribute |sambaNTPassword| values |60CAA50831FFDBE466509EC2162D1192| [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(463) smbldap_make_mod: adding attribute |sambaNTPassword| value |57D16D15B4E6D066A70F90ABDDAF5420| [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(454) smbldap_make_mod: deleting attribute |sambaPwdLastSet| values |1130544759| [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(463) smbldap_make_mod: adding attribute |sambaPwdLastSet| value |1130544820| [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_modify(1159) smbldap_modify: dn => [uid=merlin$,ou=Computers,ou=Users,dc=terpstra-world,dc=org] [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:ldapsam_update_sam_account(1869) ldapsam_update_sam_account: successfully modified uid = merlin$ in the LDAP database [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_r_set_userinfo [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0000 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called samr successfully [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:api_rpcTNP(2214) api_rpcTNP: rpc input buffer underflow (parse error?) [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 021c : 18 00 00 00 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 526 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 552 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 4. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 001c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000012 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000004 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..28] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=84 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=19 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 28 (0x1C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 28 (0x1C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=29 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 1C 00 00 00 12 00 00 ........ ........ [010] 00 04 00 00 00 00 00 00 00 00 00 00 00 ........ ..... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 134 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x86 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 19 of length 138 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=134 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=20 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 52 (0x34) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 52 (0x34) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=67 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 34 00 00 00 13 00 00 00 1C .......4 ........ [020] 00 00 00 00 00 25 00 00 00 00 00 04 00 00 00 00 .....%.. ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 10 00 10 00 00 .....bC. ........ [040] 01 00 00 ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=52 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 52 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 52, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 36 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 36 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0034 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000013 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 36 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 36, incoming data = 36 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 0000001c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0025 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: samr op 0x25 - api_rpcTNP: rpc command: SAMR_SET_USERINFO2 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[23].fn == 0x8176db5 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_q_set_userinfo2 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000004 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 switch_value: 0010 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 samr_io_userinfo_ctr ctr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 switch_value: 0010 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000018 samr_io_r_user_info16 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0018 acb_info: 00000100 [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_set_userinfo2(2896) samr_reply_set_userinfo2: 2896 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 04 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:access_check_samr_function(194) _samr_set_userinfo2: access check ((granted: 0x000f07ff; required: 0x000000b0) [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_set_userinfo2(2912) samr_reply_set_userinfo2: sid:S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [dc=terpstra-world,dc=org], filter => [(&(sambaSID=S-1-5-21-726309263-4128913605-1168186429-3018)(objectclass=sambaSamAccount))], scope => [2] [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_sam_from_ldap(639) init_sam_from_ldap: Entry found for user: merlin$ [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557) pdb_set_user_sid_from_string: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592) pdb_set_group_sid_from_string: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogoffTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaKickoffTime] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomeDrive] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomePath] = [] [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonScript] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaProfilePath] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaUserWorkstations] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaMungedDial] = [] [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordCount] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonHours] = [] [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(83) Looking up login cache for user merlin$ [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(97) No cache entry found [2005/10/28 18:13:40, 9] passdb/pdb_ldap.c:init_sam_from_ldap(994) No cache entry, bad count = 0, bad time = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_set_userinfo2(2943) _samr_set_userinfo: does possess sufficient rights [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 4] passdb/pdb_ldap.c:ldapsam_update_sam_account(1836) ldapsam_update_sam_account: user merlin$ to be modified has dn: uid=merlin$,ou=Computers,ou=Users,dc=terpstra-world,dc=org [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_ldap_from_sam(1054) init_ldap_from_sam: Setting entry for user: merlin$ [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_make_mod(438) smbldap_make_mod: attribute |sambaAcctFlags| not changed. [2005/10/28 18:13:40, 4] passdb/pdb_ldap.c:ldapsam_update_sam_account(1849) ldapsam_update_sam_account: mods is empty: nothing to update for user: merlin$ [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_r_set_userinfo2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0000 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called samr successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 12 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 36 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 4. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 001c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000013 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000004 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..28] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=84 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=20 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 28 (0x1C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 28 (0x1C) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=29 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 1C 00 00 00 13 00 00 ........ ........ [010] 00 04 00 00 00 00 00 00 00 00 00 00 00 ........ ..... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 126 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x7e [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 20 of length 130 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=126 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=21 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 44 (0x2C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 44 (0x2C) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=59 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 2C 00 00 00 14 00 00 00 14 ......., ........ [020] 00 00 00 00 00 01 00 00 00 00 00 04 00 00 00 00 ........ ........ [030] 00 00 00 B4 BE 62 43 F4 17 00 00 .....bC. ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=44 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "samr" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: samr open: Yes len: 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 44 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 44, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 28 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 002c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000014 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 28, incoming data = 28 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000014 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0001 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: samr op 0x1 - api_rpcTNP: rpc command: SAMR_CLOSE_HND [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[0].fn == 0x81745fe [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_q_close_hnd [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000004 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: b4 be 62 43 f4 17 00 00 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 04 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2005/10/28 18:13:40, 5] rpc_server/srv_samr_nt.c:_samr_close_hnd(334) samr_reply_close_hnd: 334 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 samr_io_r_close_hnd [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_pol_hnd pol [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 data1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 data2: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 data3: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a data4: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000c data5: 00 00 00 00 00 00 00 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0014 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called samr successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 28 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: samr len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: samr: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 24. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0030 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000014 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..48] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=21 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 48 (0x30) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 48 (0x30) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=49 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 14 00 00 ........ .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [020] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [030] 00 . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 41 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x29 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 21 of length 45 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=22 smt_wct=3 smb_vwv[ 0]=28993 (0x7141) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBclose (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name samr pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 5] smbd/pipes.c:reply_pipe_close(272) reply_pipe_close: pnum:7141 [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 03 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2005/10/28 18:13:40, 4] rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(162) Found policy hnd[0] [000] 00 00 00 00 02 00 00 00 00 00 00 00 B4 BE 62 43 ........ ......bC [010] F4 17 00 00 .... [2005/10/28 18:13:40, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200) Closed policy [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) close_policy_by_pipe: deleted handle list for pipe samr [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1094) closed pipe name samr pnum=7141 (pipes_open=0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=22 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 104 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x68 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 22 of length 108 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=23 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 4608 (0x1200) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=21 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 4E 00 45 00 54 00 4C 00 4F 00 47 00 4F .\.N.E.T .L.O.G.O [010] 00 4E 00 00 00 .N... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBntcreateX (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 10] smbd/nttrans.c:reply_ntcreate_and_X(506) reply_ntcreateX: flags = 0x0, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 [2005/10/28 18:13:40, 4] smbd/nttrans.c:nt_open_pipe(330) nt_open_pipe: Opening pipe \NETLOGON. [2005/10/28 18:13:40, 3] smbd/nttrans.c:nt_open_pipe(351) nt_open_pipe: Known pipe NETLOGON opening. [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) Open pipe requested NETLOGON (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) Create pipe requested NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) init_pipe_handles: created handle list for pipe NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) init_pipe_handles: pipe_handles ref count = 1 for pipe NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) Created internal pipe NETLOGON (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) Opened pipe NETLOGON with handle 7142 (pipes_open=1) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) open pipes: name NETLOGON pnum=7142 [2005/10/28 18:13:40, 5] smbd/nttrans.c:do_ntcreate_pipe_open(400) do_ntcreate_pipe_open: open pipe = \NETLOGON [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=23 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=16896 (0x4200) smb_vwv[ 3]= 369 (0x171) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 154 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x9a [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 23 of length 158 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=24 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28994 (0x7142) smb_bcc=87 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 15 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=72 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7142 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7142 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7142) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7142 name: NETLOGON open: Yes len: 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0048 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000015 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 11, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 11 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1423) api_pipe_bind_req: decode request. 1423 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1434) api_pipe_bind_req: \PIPE\NETLOGON -> \PIPE\lsass [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_rb [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0008 num_contexts: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000c context_id : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 000e num_transfer_syntaxes: 01 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00000f smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 data : 12345678 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 data : 1234 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 data : abcd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0018 data : ef 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 001a data : 01 23 45 67 cf fb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 version: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0028 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 002a data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002c data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002e data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0034 version: 00000002 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1476) api_pipe_bind_req: make response. 1476 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:check_bind_req(910) check_bind_req for \PIPE\NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\samr [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\NETLOGON [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_ba [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 000053f0 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 smb_io_rpc_addr_str [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 len: 000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000a str: \PIPE\lsass. [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 smb_io_rpc_results [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0018 num_results: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001c result : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001e reason : 0000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0026 data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0028 data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002a data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 version: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0044 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000015 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 56 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7142 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(979) read_from_pipe: NETLOGON: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..68] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=24 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 15 00 00 ........ .D...... [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 176 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xb0 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 24 of length 180 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=176 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=25 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 94 (0x5E) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 94 (0x5E) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28994 (0x7142) smb_bcc=109 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 5E 00 00 00 16 00 00 00 46 .......^ .......F [020] 00 00 00 00 00 04 00 01 00 00 00 09 00 00 00 00 ........ ........ [030] 00 00 00 09 00 00 00 5C 00 5C 00 4D 00 45 00 52 .......\ .\.M.E.R [040] 00 4C 00 49 00 4E 00 00 00 00 00 07 00 00 00 00 .L.I.N.. ........ [050] 00 00 00 07 00 00 00 4D 00 45 00 52 00 4C 00 49 .......M .E.R.L.I [060] 00 4E 00 00 00 28 49 64 FC 45 64 9E B6 .N...(Id .Ed.. [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=94 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7142 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7142 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7142) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7142 name: NETLOGON open: Yes len: 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 94 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 94, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 78 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 005e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000016 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 78, incoming data = 78 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000046 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0004 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 72 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: NETLOGON op 0x4 - api_rpcTNP: rpc command: NET_REQCHAL [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[0].fn == 0x814890e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_q_req_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 undoc_buffer: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000004 smb_io_unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c uni_str_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0010 buffer : \.\.M.E.R.L.I.N... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000022 smb_io_unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 uni_max_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0028 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 002c uni_str_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0030 buffer : M.E.R.L.I.N... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00003e smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 003e data: 28 49 64 fc 45 64 9e b6 [2005/10/28 18:13:40, 6] rpc_server/srv_netlog_nt.c:init_net_r_req_chal(41) init_net_r_req_chal: 41 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_r_req_chal [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0000 data: fd 4e 74 40 ee 0e a8 bd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0008 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called NETLOGON successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 32 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 78 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7142 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 12. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0024 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000016 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 0000000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..36] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=92 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=25 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 36 (0x24) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 36 (0x24) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=37 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 16 00 00 ........ .$...... [010] 00 0C 00 00 00 00 00 00 00 FD 4E 74 40 EE 0E A8 ........ ..Nt@... [020] BD 00 00 00 00 ..... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 214 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xd6 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 25 of length 218 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=214 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=26 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 132 (0x84) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 132 (0x84) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28994 (0x7142) smb_bcc=147 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 84 00 00 00 17 00 00 00 6C ........ .......l [020] 00 00 00 00 00 0F 00 01 00 00 00 09 00 00 00 00 ........ ........ [030] 00 00 00 09 00 00 00 5C 00 5C 00 4D 00 45 00 52 .......\ .\.M.E.R [040] 00 4C 00 49 00 4E 00 00 00 00 00 08 00 00 00 00 .L.I.N.. ........ [050] 00 00 00 08 00 00 00 4D 00 45 00 52 00 4C 00 49 .......M .E.R.L.I [060] 00 4E 00 24 00 00 00 06 00 00 00 07 00 00 00 00 .N.$.... ........ [070] 00 00 00 07 00 00 00 4D 00 45 00 52 00 4C 00 49 .......M .E.R.L.I [080] 00 4E 00 00 00 A2 2B 97 FD 33 3D 01 E6 00 00 FF .N....+. .3=..... [090] 01 07 40 ..@ [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=132 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7142 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7142 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7142) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7142 name: NETLOGON open: Yes len: 132 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 132 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 132 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 132, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 116 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 116 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0084 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000017 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 116 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 116, incoming data = 116 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 0000006c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 000f [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: NETLOGON op 0xf - api_rpcTNP: rpc command: NET_AUTH2 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[2].fn == 0x8148c3a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_q_auth_2 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_log_info [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 undoc_buffer: 00000001 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000004 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c uni_str_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0010 buffer : \.\.M.E.R.L.I.N... [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000022 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 uni_max_len: 00000008 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0028 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 002c uni_str_len: 00000008 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0030 buffer : M.E.R.L.I.N.$... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0040 sec_chan: 0006 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000042 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0044 uni_max_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0048 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 004c uni_str_len: 00000007 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0050 buffer : M.E.R.L.I.N... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00005e smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 005e data: a2 2b 97 fd 33 3d 01 e6 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000066 net_io_neg_flags [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0068 neg_flags: 400701ff [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [dc=terpstra-world,dc=org], filter => [(&(uid=MERLIN$)(objectclass=sambaSamAccount))], scope => [2] [2005/10/28 18:13:40, 2] passdb/pdb_ldap.c:init_sam_from_ldap(639) init_sam_from_ldap: Entry found for user: merlin$ [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid_from_string(557) pdb_set_user_sid_from_string: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid_from_string(592) pdb_set_group_sid_from_string: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogoffTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaKickoffTime] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomeDrive] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaHomePath] = [] [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonScript] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaProfilePath] = [] [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaUserWorkstations] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaMungedDial] = [] [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordCount] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaBadPasswordTime] = [] [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_get_single_attribute(297) smbldap_get_single_attribute: [sambaLogonHours] = [] [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(83) Looking up login cache for user merlin$ [2005/10/28 18:13:40, 7] passdb/login_cache.c:login_cache_read(97) No cache entry found [2005/10/28 18:13:40, 9] passdb/pdb_ldap.c:init_sam_from_ldap(994) No cache entry, bad count = 0, bad time = 0 [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username merlin$, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name Computer - Merlin, was [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\merlin_, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-3018 from rid 3018 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-553 from rid 553 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] lib/util.c:dump_data(2063) [000] 57 D1 6D 15 B4 E6 D0 66 A7 0F 90 AB DD AF 54 20 W.m....f ......T [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(116) creds_server_init: client chal : 284964FC45649EB6 [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(117) creds_server_init: server chal : FD4E7440EE0EA8BD [2005/10/28 18:13:40, 4] libsmb/credentials.c:cred_create_session_key(65) cred_create_session_key [2005/10/28 18:13:40, 5] libsmb/credentials.c:cred_create_session_key(67) clnt_chal_in: 284964FC45649EB6 [2005/10/28 18:13:40, 5] libsmb/credentials.c:cred_create_session_key(68) srv_chal_in : FD4E7440EE0EA8BD [2005/10/28 18:13:40, 5] libsmb/credentials.c:cred_create_session_key(69) clnt+srv : 2598D83C33734674 [2005/10/28 18:13:40, 5] libsmb/credentials.c:cred_create_session_key(70) sess_key_out : 94D786EFE60E4BC4 [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(143) creds_server_init: clnt : A22B97FD333D01E6 [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(144) creds_server_init: server : 18BD479498D9668D [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_init(145) creds_server_init: seed : A22B97FD333D01E6 [2005/10/28 18:13:40, 10] libsmb/credentials.c:creds_server_check(162) creds_server_check: credentials check OK. [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 3] passdb/secrets.c:secrets_store_schannel_session_info(1054) secrets_store_schannel_session_info: stored schannel info with key SECRETS/SCHANNEL/MERLIN [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_r_auth_2 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0000 data: 18 bd 47 94 98 d9 66 8d [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 net_io_neg_flags [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 neg_flags: 400001ff [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 000c status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called NETLOGON successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 48 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 116 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7142 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 16. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0028 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000017 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000010 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..40] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=96 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=26 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=41 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 17 00 00 ........ .(...... [010] 00 10 00 00 00 00 00 00 00 18 BD 47 94 98 D9 66 ........ ...G...f [020] 8D FF 01 00 40 00 00 00 00 ....@... . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 104 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x68 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 26 of length 108 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=27 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 4608 (0x1200) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=21 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 4E 00 45 00 54 00 4C 00 4F 00 47 00 4F .\.N.E.T .L.O.G.O [010] 00 4E 00 00 00 .N... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBntcreateX (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 10] smbd/nttrans.c:reply_ntcreate_and_X(506) reply_ntcreateX: flags = 0x0, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 [2005/10/28 18:13:40, 4] smbd/nttrans.c:nt_open_pipe(330) nt_open_pipe: Opening pipe \NETLOGON. [2005/10/28 18:13:40, 3] smbd/nttrans.c:nt_open_pipe(351) nt_open_pipe: Known pipe NETLOGON opening. [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) Open pipe requested NETLOGON (pipes_open=1) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(210) open_rpc_pipe_p: name NETLOGON pnum=7142 [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) Create pipe requested NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) init_pipe_handles: pipe_handles ref count = 2 for pipe NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) Created internal pipe NETLOGON (pipes_open=1) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) Opened pipe NETLOGON with handle 7143 (pipes_open=2) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) open pipes: name NETLOGON pnum=7143 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) open pipes: name NETLOGON pnum=7142 [2005/10/28 18:13:40, 5] smbd/nttrans.c:do_ntcreate_pipe_open(400) do_ntcreate_pipe_open: open pipe = \NETLOGON [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=27 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=17152 (0x4300) smb_vwv[ 3]= 369 (0x171) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 186 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xba [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 27 of length 190 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=186 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=28 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 104 (0x68) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 104 (0x68) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28995 (0x7143) smb_bcc=119 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 68 00 18 00 18 00 00 00 B8 .......h ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 44 06 00 00 01 00 00 00 00 .H`....D ........ [060] 00 00 00 03 00 00 00 4D 49 44 45 41 52 54 48 00 .......M IDEARTH. [070] 4D 45 52 4C 49 4E 00 MERLIN. [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=104 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7143 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7143 (pipes_open=2) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7142 (pipes_open=2) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7143) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d6920 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7143 name: NETLOGON open: Yes len: 104 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 104 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 104 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 104, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 88 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 88 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0068 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0018 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000018 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 11, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 88 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 88, incoming data = 88 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 11 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1423) api_pipe_bind_req: decode request. 1423 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1434) api_pipe_bind_req: \PIPE\NETLOGON -> \PIPE\lsass [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_rb [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0008 num_contexts: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000c context_id : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 000e num_transfer_syntaxes: 01 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00000f smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 data : 12345678 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 data : 1234 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 data : abcd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0018 data : ef 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 001a data : 01 23 45 67 cf fb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 version: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0028 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 002a data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002c data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002e data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0034 version: 00000002 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1476) api_pipe_bind_req: make response. 1476 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000038 smb_io_rpc_hdr_auth [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0038 auth_type : 44 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0039 auth_level : 06 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 003a auth_pad_len : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 003b auth_reserved: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 003c auth_context_id: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000040 smb_io_rpc_auth_schannel_neg [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0040 type1: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0044 type2: 00000003 [2005/10/28 18:13:40, 6] lib/util.c:dump_data(2063) [000] 4D 49 44 45 41 52 54 48 MIDEARTH [2005/10/28 18:13:40, 6] lib/util.c:dump_data(2063) [000] 4D 45 52 4C 49 4E MERLIN [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(101) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 3] passdb/secrets.c:secrets_restore_schannel_session_info(1142) secrets_store_schannel_session_info: restored schannel info key SECRETS/SCHANNEL/MERLIN [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_auth [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 auth_type : 44 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 auth_level : 06 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 auth_pad_len : 08 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 auth_reserved: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 auth_context_id: 00000001 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000008 smb_io_rpc_schannel_verifier [2005/10/28 18:13:40, 6] lib/util.c:dump_data(2063) [000] 01 . [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000a msg_type : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 flags : 00000005 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:pipe_schannel_auth_bind(1279) pipe_schannel_auth_bind: schannel auth: domain [MIDEARTH] myname [MERLIN] [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:check_bind_req(910) check_bind_req for \PIPE\NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\samr [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\NETLOGON [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_ba [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 000053f0 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 smb_io_rpc_addr_str [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 len: 000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000a str: \PIPE\lsass. [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 smb_io_rpc_results [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0018 num_results: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001c result : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001e reason : 0000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0026 data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0028 data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002a data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 version: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0058 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000018 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 88 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7143 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(979) read_from_pipe: NETLOGON: current_pdu_len = 88, current_pdu_sent = 0 returning 88 bytes. [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..88] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=144 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=28 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 88 (0x58) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 88 (0x58) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=89 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 0C 03 10 00 00 00 58 00 0C 00 18 00 00 ........ .X...... [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 44 06 08 00 01 00 00 00 01 00 00 `....D.. ........ [050] 00 00 00 00 00 05 00 00 00 ........ . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 41 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x29 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 28 of length 45 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=29 smt_wct=3 smb_vwv[ 0]=28994 (0x7142) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBclose (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7142 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7143 (pipes_open=2) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7142 (pipes_open=2) [2005/10/28 18:13:40, 5] smbd/pipes.c:reply_pipe_close(272) reply_pipe_close: pnum:7142 [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1094) closed pipe name NETLOGON pnum=7142 (pipes_open=1) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=29 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 41 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x29 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 29 of length 45 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=30 smt_wct=3 smb_vwv[ 0]=28995 (0x7143) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBclose (pid 6132) conn 0x83daa30 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7143 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7143 (pipes_open=1) [2005/10/28 18:13:40, 5] smbd/pipes.c:reply_pipe_close(272) reply_pipe_close: pnum:7143 [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) close_policy_by_pipe: deleted handle list for pipe NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1094) closed pipe name NETLOGON pnum=7143 (pipes_open=0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=30 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] smbd/reply.c:reply_special(494) init msg_type=0x81 msg_flags=0x0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 179 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xb3 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 1 of length 183 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=179 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=55297 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=2 smt_wct=0 smb_bcc=144 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 02 50 43 20 4E 45 54 57 4F 52 4B 20 50 52 4F 47 .PC NETW ORK PROG [010] 52 41 4D 20 31 2E 30 00 02 4D 49 43 52 4F 53 4F RAM 1.0. .MICROSO [020] 46 54 20 4E 45 54 57 4F 52 4B 53 20 31 2E 30 33 FT NETWO RKS 1.03 [030] 00 02 4D 49 43 52 4F 53 4F 46 54 20 4E 45 54 57 ..MICROS OFT NETW [040] 4F 52 4B 53 20 33 2E 30 00 02 4C 41 4E 4D 41 4E ORKS 3.0 ..LANMAN [050] 31 2E 30 00 02 4C 4D 31 2E 32 58 30 30 32 00 02 1.0..LM1 .2X002.. [060] 44 4F 53 20 4C 41 4E 4D 41 4E 32 2E 31 00 02 53 DOS LANM AN2.1..S [070] 61 6D 62 61 00 02 4E 54 20 4C 41 4E 4D 41 4E 20 amba..NT LANMAN [080] 31 2E 30 00 02 4E 54 20 4C 4D 20 30 2E 31 32 00 1.0..NT LM 0.12. [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBnegprot (pid 6133) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [PC NETWORK PROGRAM 1.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [MICROSOFT NETWORKS 1.03] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [MICROSOFT NETWORKS 3.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [LANMAN1.0] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [LM1.2X002] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [DOS LANMAN2.1] [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(474) Requested protocol [Samba] [2005/10/28 18:13:40, 10] lib/util.c:set_remote_arch(2038) set_remote_arch: Client arch is 'Samba' [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] smbd/connection.c:claim_connection(170) claiming 0 [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_nt1(345) using SPNEGO [2005/10/28 18:13:40, 3] smbd/negprot.c:reply_negprot(567) Selected protocol NT LANMAN 1.0 [2005/10/28 18:13:40, 5] smbd/negprot.c:reply_negprot(573) negprot index=7 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=85 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=2 smt_wct=17 smb_vwv[ 0]= 7 (0x7) smb_vwv[ 1]=12803 (0x3203) smb_vwv[ 2]= 256 (0x100) smb_vwv[ 3]= 1024 (0x400) smb_vwv[ 4]= 65 (0x41) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 256 (0x100) smb_vwv[ 7]=62720 (0xF500) smb_vwv[ 8]= 23 (0x17) smb_vwv[ 9]=64768 (0xFD00) smb_vwv[10]=32995 (0x80E3) smb_vwv[11]= 128 (0x80) smb_vwv[12]=15186 (0x3B52) smb_vwv[13]= 7581 (0x1D9D) smb_vwv[14]=50652 (0xC5DC) smb_vwv[15]=26625 (0x6801) smb_vwv[16]= 1 (0x1) smb_bcc=16 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 6D 65 72 6C 69 6E 00 00 00 00 00 00 00 00 00 00 merlin.. ........ [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 88 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x58 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 2 of length 92 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=88 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=0 smb_mid=3 smt_wct=13 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=65535 (0xFFFF) smb_vwv[ 3]= 2 (0x2) smb_vwv[ 4]= 6130 (0x17F2) smb_vwv[ 5]= 6133 (0x17F5) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]=49244 (0xC05C) smb_vwv[12]= 0 (0x0) smb_bcc=27 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 00 00 00 00 55 00 6E 00 69 00 78 00 00 00 53 .....U.n .i.x...S [010] 00 61 00 6D 00 62 00 61 00 00 00 .a.m.b.a ... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBsesssetupX (pid 6133) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X(795) wct=13 flg2=0xc801 [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X(941) Domain=[] NativeOS=[Unix] NativeLanMan=[Samba] PrimaryDomain=[] [2005/10/28 18:13:40, 3] smbd/sesssetup.c:reply_sesssetup_and_X(956) sesssetupX:name=[]\[]@[merlin] [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 3] smbd/sesssetup.c:check_guest_password(115) Got anonymous request [2005/10/28 18:13:40, 5] auth/auth.c:make_auth_context_subsystem(482) Making default auth method list for DC, security=user, encrypt passwords = yes [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend rhosts [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'rhosts' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend hostsequiv [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'hostsequiv' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend sam [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'sam' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend sam_ignoredomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'sam_ignoredomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend unix [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'unix' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend winbind [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'winbind' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend smbserver [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'smbserver' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'trustdomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend ntdomain [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'ntdomain' [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(45) Attempting to register auth backend guest [2005/10/28 18:13:40, 5] auth/auth.c:smb_register_auth(57) Successfully added auth method 'guest' [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match guest [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method guest has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match sam [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method sam has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match winbind:trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(389) load_auth_module: Attempting to find an auth method to match trustdomain [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method trustdomain has a valid init [2005/10/28 18:13:40, 5] auth/auth.c:load_auth_module(414) load_auth_module: auth method winbind has a valid init [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(99) attempting to make a user_info for () [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(109) making strings for 's user_info struct [2005/10/28 18:13:40, 5] auth/auth_util.c:make_user_info(151) making blobs for 's user_info struct [2005/10/28 18:13:40, 10] auth/auth_util.c:make_user_info(167) made an encrypted user_info for () [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(219) check_ntlm_password: Checking password for unmapped user []\[]@[] with the new password interface [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(222) check_ntlm_password: mapped user is: []\[]@[] [2005/10/28 18:13:40, 10] auth/auth.c:check_ntlm_password(231) check_ntlm_password: auth_context challenge created by fixed [2005/10/28 18:13:40, 10] auth/auth.c:check_ntlm_password(233) challenge is: [2005/10/28 18:13:40, 5] lib/util.c:dump_data(2063) [000] 00 00 00 00 00 00 00 00 ........ [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_username(617) pdb_set_username: setting username nobody, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_domain(644) pdb_set_domain: setting domain MIDEARTH, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_nt_username(671) pdb_set_nt_username: setting nt username , was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_fullname(698) pdb_set_full_name: setting full name nobody, was [2005/10/28 18:13:40, 4] lib/substitute.c:automount_server(337) Home server: merlin [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_homedir(806) pdb_set_homedir: setting home dir \\merlin\nobody, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(779) pdb_set_dir_drive: setting dir drive H:, was NULL [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_logon_script(725) pdb_set_logon_script: setting logon script scripts\logon.bat, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_profile_path(752) pdb_set_profile_path: setting profile path \\merlin\profiles\nobody, was [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_workstations(885) pdb_set_workstations: setting workstations , was [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_cache_timestamp(193) account policy cache lastset was: Fri, 28 Oct 2005 18:13:40 GMT [2005/10/28 18:13:40, 10] lib/account_pol.c:account_policy_get(321) account_policy_get: name: password history, val: 0 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_user_sid(544) pdb_set_user_sid: setting user sid S-1-5-21-726309263-4128913605-1168186429-501 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(73) pdb_set_user_sid_from_rid: setting user sid S-1-5-21-726309263-4128913605-1168186429-501 from rid 501 [2005/10/28 18:13:40, 10] passdb/pdb_get_set.c:pdb_set_group_sid(580) pdb_set_group_sid: setting group sid S-1-5-21-726309263-4128913605-1168186429-514 [2005/10/28 18:13:40, 10] passdb/pdb_compat.c:pdb_set_group_sid_from_rid(100) pdb_set_group_sid_from_rid: setting group sid S-1-5-21-726309263-4128913605-1168186429-514 from rid 514 [2005/10/28 18:13:40, 3] auth/auth.c:check_ntlm_password(268) check_ntlm_password: guest authentication for user [] succeeded [2005/10/28 18:13:40, 5] auth/auth.c:check_ntlm_password(307) check_ntlm_password: guest authentication for user [] -> [] -> [nobody] succeeded [2005/10/28 18:13:40, 5] auth/auth_util.c:free_user_info(1454) attempting to free (and zero) a user_info structure [2005/10/28 18:13:40, 10] auth/auth_util.c:free_user_info(1457) structure was created for [2005/10/28 18:13:40, 5] auth/auth_util.c:free_user_info(1454) attempting to free (and zero) a user_info structure [2005/10/28 18:13:40, 10] smbd/password.c:register_vuid(182) register_vuid: allocated vuid = 100 [2005/10/28 18:13:40, 10] lib/util_pw.c:getpwnam_alloc(98) Got nobody from pwnam_cache [2005/10/28 18:13:40, 10] smbd/password.c:register_vuid(255) register_vuid: (65534,65533) nobody nobody MIDEARTH guest=1 [2005/10/28 18:13:40, 3] smbd/password.c:register_vuid(257) User name: nobody Real name: nobody [2005/10/28 18:13:40, 3] smbd/password.c:register_vuid(276) UNIX uid 65534 is UNIX user nobody, and will be vuid 100 [2005/10/28 18:13:40, 6] param/loadparm.c:lp_file_list_changed(2838) lp_file_list_changed() file /etc/samba/smb-%L.conf -> /etc/samba/smb-merlin.conf last mod_time: Wed Oct 19 01:55:41 2005 file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Oct 28 18:13:36 2005 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=150 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=100 smb_mid=3 smt_wct=3 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_bcc=109 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 55 00 6E 00 69 00 78 00 00 00 53 00 61 00 6D .U.n.i.x ...S.a.m [010] 00 62 00 61 00 20 00 33 00 2E 00 30 00 2E 00 32 .b.a. .3 ...0...2 [020] 00 31 00 70 00 72 00 65 00 31 00 2D 00 53 00 56 .1.p.r.e .1.-.S.V [030] 00 4E 00 2D 00 62 00 75 00 69 00 6C 00 64 00 2D .N.-.b.u .i.l.d.- [040] 00 55 00 4E 00 4B 00 4E 00 4F 00 57 00 4E 00 2D .U.N.K.N .O.W.N.- [050] 00 53 00 55 00 53 00 45 00 00 00 4D 00 49 00 44 .S.U.S.E ...M.I.D [060] 00 45 00 41 00 52 00 54 00 48 00 00 00 .E.A.R.T .H... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 76 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x4c [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 3 of length 80 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=76 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=0 smb_pid=6130 smb_uid=100 smb_mid=4 smt_wct=4 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 1 (0x1) smb_bcc=33 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 5C 00 4D 00 45 00 52 00 4C 00 49 00 4E .\.\.M.E .R.L.I.N [010] 00 5C 00 49 00 50 00 43 00 24 00 00 00 49 50 43 .\.I.P.C .$...IPC [020] 00 . [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtconX (pid 6133) conn 0x0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 4] smbd/reply.c:reply_tcon_and_X(617) Client requested device type [IPC] for share [IPC$] [2005/10/28 18:13:40, 5] smbd/service.c:make_connection(815) making a connection to 'normal' service ipc$ [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_alloc(313) Finding user nobody [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_internals(262) Trying _Get_Pwnam(), username as lowercase is nobody [2005/10/28 18:13:40, 10] lib/util_pw.c:getpwnam_alloc(98) Got nobody from pwnam_cache [2005/10/28 18:13:40, 5] lib/username.c:Get_Pwnam_internals(290) Get_Pwnam_internals did find user [nobody]! [2005/10/28 18:13:40, 3] smbd/service.c:make_connection_snum(478) Connect path is '/var/tmp' for service [IPC$] [2005/10/28 18:13:40, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(218) get_share_security: using default secdesc for IPC$ [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_map_generic(176) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x00000002, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-501. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-501 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132067 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132069 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 2 [2005/10/28 18:13:40, 5] lib/util_seaccess.c:se_access_check(308) se_access_check: access (2) granted. [2005/10/28 18:13:40, 3] smbd/vfs.c:vfs_init_default(215) Initialising default vfs hooks [2005/10/28 18:13:40, 5] smbd/connection.c:claim_connection(170) claiming IPC$ 0 [2005/10/28 18:13:40, 10] smbd/uid.c:is_share_read_only_for_user(122) is_share_read_only_for_user: share IPC$ is read-only for unix user nobody [2005/10/28 18:13:40, 4] rpc_server/srv_srvsvc_nt.c:get_share_security(218) get_share_security: using default secdesc for IPC$ [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_map_generic(176) se_map_generic(): mapped mask 0x10000000 to 0x001f01ff [2005/10/28 18:13:40, 10] lib/util_seaccess.c:se_access_check(233) se_access_check: requested access 0x00000001, for NT token with 7 entries and first sid S-1-5-21-726309263-4128913605-1168186429-501. [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(250) [2005/10/28 18:13:40, 3] lib/util_seaccess.c:se_access_check(251) se_access_check: user sid is S-1-5-21-726309263-4128913605-1168186429-501 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-514 se_access_check: also S-1-1-0 se_access_check: also S-1-5-2 se_access_check: also S-1-5-32-546 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132067 se_access_check: also S-1-5-21-726309263-4128913605-1168186429-132069 se_access_check: ACE 0: type 0, flags = 0x00, SID = S-1-1-0 mask = 101f01ff, current desired = 1 [2005/10/28 18:13:40, 5] lib/util_seaccess.c:se_access_check(308) se_access_check: access (1) granted. [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65533) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(457) NT user token of user S-1-5-21-726309263-4128913605-1168186429-501 contains 7 SIDs SID[ 0]: S-1-5-21-726309263-4128913605-1168186429-501 SID[ 1]: S-1-5-21-726309263-4128913605-1168186429-514 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-32-546 SID[ 5]: S-1-5-21-726309263-4128913605-1168186429-132067 SID[ 6]: S-1-5-21-726309263-4128913605-1168186429-132069 SE_PRIV 0x0 0x0 0x0 0x0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 65534 Primary group is 65533 and contains 2 supplementary groups Group[ 0]: 65533 Group[ 1]: 65534 [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_user(304) change_to_user uid=(65534,65534) gid=(0,65533) [2005/10/28 18:13:40, 3] smbd/service.c:make_connection_snum(666) merlin (172.16.10.4) connect to service IPC$ initially as user nobody (uid=65534, gid=65533) (pid 6133) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/reply.c:reply_tcon_and_X(665) tconX service=IPC$ [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=48 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=4 smt_wct=3 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 1 (0x1) smb_bcc=7 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 49 50 43 00 00 00 00 IPC.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 104 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x68 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 4 of length 108 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=104 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=5 smt_wct=24 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]= 4608 (0x1200) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]=40704 (0x9F00) smb_vwv[ 8]= 513 (0x201) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 768 (0x300) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 256 (0x100) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]= 512 (0x200) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_bcc=21 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 4E 00 45 00 54 00 4C 00 4F 00 47 00 4F .\.N.E.T .L.O.G.O [010] 00 4E 00 00 00 .N... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBntcreateX (pid 6133) conn 0x836db50 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (65534, 65533) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(457) NT user token of user S-1-5-21-726309263-4128913605-1168186429-501 contains 7 SIDs SID[ 0]: S-1-5-21-726309263-4128913605-1168186429-501 SID[ 1]: S-1-5-21-726309263-4128913605-1168186429-514 SID[ 2]: S-1-1-0 SID[ 3]: S-1-5-2 SID[ 4]: S-1-5-32-546 SID[ 5]: S-1-5-21-726309263-4128913605-1168186429-132067 SID[ 6]: S-1-5-21-726309263-4128913605-1168186429-132069 SE_PRIV 0x0 0x0 0x0 0x0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 65534 Primary group is 65533 and contains 2 supplementary groups Group[ 0]: 65533 Group[ 1]: 65534 [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_user(304) change_to_user uid=(65534,65534) gid=(0,65533) [2005/10/28 18:13:40, 4] smbd/vfs.c:vfs_ChDir(737) vfs_ChDir to /var/tmp [2005/10/28 18:13:40, 10] smbd/nttrans.c:reply_ntcreate_and_X(506) reply_ntcreateX: flags = 0x0, access_mask = 0x2019f file_attributes = 0x0, share_access = 0x3, create_disposition = 0x1 create_options = 0x0 root_dir_fid = 0x0 [2005/10/28 18:13:40, 4] smbd/nttrans.c:nt_open_pipe(330) nt_open_pipe: Opening pipe \NETLOGON. [2005/10/28 18:13:40, 3] smbd/nttrans.c:nt_open_pipe(351) nt_open_pipe: Known pipe NETLOGON opening. [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(180) Open pipe requested NETLOGON (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(285) Create pipe requested NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(77) init_pipe_handles: created handle list for pipe NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:init_pipe_handle_list(93) init_pipe_handles: pipe_handles ref count = 1 for pipe NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:make_internal_rpc_pipe_p(366) Created internal pipe NETLOGON (pipes_open=0) [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(263) Opened pipe NETLOGON with handle 7141 (pipes_open=1) [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:open_rpc_pipe_p(269) open pipes: name NETLOGON pnum=7141 [2005/10/28 18:13:40, 5] smbd/nttrans.c:do_ntcreate_pipe_open(400) do_ntcreate_pipe_open: open pipe = \NETLOGON [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=5 smt_wct=34 smb_vwv[ 0]= 255 (0xFF) smb_vwv[ 1]= 0 (0x0) smb_vwv[ 2]=16640 (0x4100) smb_vwv[ 3]= 369 (0x171) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 0 (0x0) smb_vwv[11]= 0 (0x0) smb_vwv[12]= 0 (0x0) smb_vwv[13]= 0 (0x0) smb_vwv[14]= 0 (0x0) smb_vwv[15]= 0 (0x0) smb_vwv[16]= 0 (0x0) smb_vwv[17]= 0 (0x0) smb_vwv[18]= 0 (0x0) smb_vwv[19]= 0 (0x0) smb_vwv[20]= 0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]= 0 (0x0) smb_vwv[23]= 0 (0x0) smb_vwv[24]= 0 (0x0) smb_vwv[25]= 0 (0x0) smb_vwv[26]= 0 (0x0) smb_vwv[27]= 0 (0x0) smb_vwv[28]= 0 (0x0) smb_vwv[29]= 0 (0x0) smb_vwv[30]= 0 (0x0) smb_vwv[31]= 512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]= 5 (0x5) smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 154 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x9a [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 5 of length 158 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=6 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 72 (0x48) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 72 (0x48) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=87 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 03 10 00 00 00 48 00 00 00 19 00 00 00 B8 .......H ........ [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6133) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=72 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: NETLOGON open: Yes len: 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 72 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 72, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 56 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0048 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000019 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 11, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 56, incoming data = 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 11 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1423) api_pipe_bind_req: decode request. 1423 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(1434) api_pipe_bind_req: \PIPE\NETLOGON -> \PIPE\lsass [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_rb [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0008 num_contexts: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000c context_id : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 000e num_transfer_syntaxes: 01 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00000f smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 data : 12345678 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 data : 1234 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0016 data : abcd [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0018 data : ef 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 001a data : 01 23 45 67 cf fb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 version: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000024 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0028 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 002a data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002c data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002e data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0034 version: 00000002 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_bind_req(1476) api_pipe_bind_req: make response. 1476 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe.c:check_bind_req(910) check_bind_req for \PIPE\NETLOGON [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\lsarpc [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\samr [2005/10/28 18:13:40, 10] rpc_server/srv_pipe.c:check_bind_req(915) checking \PIPE\NETLOGON [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_ba [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_bba [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0000 max_tsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0002 max_rsize: 10b8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 assoc_gid: 000053f0 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 smb_io_rpc_addr_str [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 len: 000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 000a str: \PIPE\lsass. [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000016 smb_io_rpc_results [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0018 num_results: 01 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001c result : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 001e reason : 0000 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_rpc_iface [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000020 smb_io_uuid uuid [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0020 data : 8a885d04 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0024 data : 1ceb [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0026 data : 11c9 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0028 data : 9f e8 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 002a data : 08 00 2b 10 48 60 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0030 version: 00000002 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 0c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0044 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 00000019 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 56 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(979) read_from_pipe: NETLOGON: current_pdu_len = 68, current_pdu_sent = 0 returning 68 bytes. [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..68] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=6 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 68 (0x44) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 68 (0x44) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=69 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 19 00 00 ........ .D...... [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 180 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xb4 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 6 of length 184 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=180 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=7 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 98 (0x62) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 98 (0x62) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=113 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 62 00 00 00 1A 00 00 00 4A .......b .......J [020] 00 00 00 00 00 04 00 01 00 00 00 09 00 00 00 00 ........ ........ [030] 00 00 00 09 00 00 00 5C 00 5C 00 4D 00 45 00 52 .......\ .\.M.E.R [040] 00 4C 00 49 00 4E 00 00 00 00 00 09 00 00 00 00 .L.I.N.. ........ [050] 00 00 00 09 00 00 00 4D 00 49 00 44 00 45 00 41 .......M .I.D.E.A [060] 00 52 00 54 00 48 00 00 00 CC 7A 47 11 41 12 4C .R.T.H.. ..zG.A.L [070] 29 ) [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6133) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=98 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: NETLOGON open: Yes len: 98 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 98 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 98 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 98, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 82 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 82 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0062 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000001a [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 82 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 82, incoming data = 82 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 0000004a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 0004 [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 72 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: NETLOGON op 0x4 - api_rpcTNP: rpc command: NET_REQCHAL [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[0].fn == 0x814890e [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_q_req_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 undoc_buffer: 00000001 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000004 smb_io_unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c uni_str_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0010 buffer : \.\.M.E.R.L.I.N... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000022 smb_io_unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0028 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 002c uni_str_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0030 buffer : M.I.D.E.A.R.T.H... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000042 smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0042 data: cc 7a 47 11 41 12 4c 29 [2005/10/28 18:13:40, 6] rpc_server/srv_netlog_nt.c:init_net_r_req_chal(41) init_net_r_req_chal: 41 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_r_req_chal [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0000 data: 1c 2d 56 ab d8 41 c3 20 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 0008 status: NT_STATUS_OK [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called NETLOGON successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 36 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 82 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 12. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0024 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000001a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 0000000c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..36] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=92 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=7 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 36 (0x24) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 36 (0x24) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=37 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 1A 00 00 ........ .$...... [010] 00 0C 00 00 00 00 00 00 00 1C 2D 56 AB D8 41 C3 ........ ..-V..A. [020] 20 00 00 00 00 .... [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 222 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0xde [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 7 of length 226 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=222 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=8 smt_wct=16 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 140 (0x8C) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 4280 (0x10B8) smb_vwv[ 4]= 0 (0x0) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 0 (0x0) smb_vwv[ 7]= 0 (0x0) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_vwv[10]= 82 (0x52) smb_vwv[11]= 140 (0x8C) smb_vwv[12]= 82 (0x52) smb_vwv[13]= 2 (0x2) smb_vwv[14]= 38 (0x26) smb_vwv[15]=28993 (0x7141) smb_bcc=155 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 8C 00 00 00 1B 00 00 00 74 ........ .......t [020] 00 00 00 00 00 0F 00 01 00 00 00 09 00 00 00 00 ........ ........ [030] 00 00 00 09 00 00 00 5C 00 5C 00 4D 00 45 00 52 .......\ .\.M.E.R [040] 00 4C 00 49 00 4E 00 00 00 00 00 0A 00 00 00 00 .L.I.N.. ........ [050] 00 00 00 0A 00 00 00 4D 00 49 00 44 00 45 00 41 .......M .I.D.E.A [060] 00 52 00 54 00 48 00 24 00 00 00 06 00 00 00 09 .R.T.H.$ ........ [070] 00 00 00 00 00 00 00 09 00 00 00 4D 00 49 00 44 ........ ...M.I.D [080] 00 45 00 41 00 52 00 54 00 48 00 00 00 29 19 56 .E.A.R.T .H...).V [090] B3 0F 8A C8 BF 00 00 FF 01 07 40 ........ ..@ [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtrans (pid 6133) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 3] smbd/ipc.c:reply_trans(539) trans <\PIPE\> data=140 params=0 setup=2 [2005/10/28 18:13:40, 5] smbd/ipc.c:reply_trans(560) calling named_pipe [2005/10/28 18:13:40, 3] smbd/ipc.c:named_pipe(334) named pipe command on <> name [2005/10/28 18:13:40, 5] smbd/ipc.c:api_fd_reply(265) api_fd_reply [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 3] smbd/ipc.c:api_fd_reply(294) Got API command 0x26 on pipe "NETLOGON" (pnum 7141) [2005/10/28 18:13:40, 10] smbd/ipc.c:api_fd_reply(299) api_fd_reply: p:0x83d74e0 max_trans_reply: 4280 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:write_to_pipe(862) write_to_pipe: 7141 name: NETLOGON open: Yes len: 140 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 140 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 0, pdu_needed_len = 0, incoming data = 140 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:fill_rpc_header(395) fill_rpc_header: data_to_copy = 140, len_needed_to_complete_hdr = 16, receive_len = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 16 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 124 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 0, incoming data = 124 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 008c [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000001b [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(482) unmarshall_rpc_header: using little-endian RPC [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:unmarshall_rpc_header(511) unmarshall_rpc_header: type = 0, flags = 3 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 0 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(884) write_to_pipe: data_left = 124 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_incoming_data(783) process_incoming_data: Start: pdu_received_len = 16, pdu_needed_len = 124, incoming data = 124 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:process_complete_pdu(719) process_complete_pdu: processing packet type 0 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr_req req [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 alloc_hint: 00000074 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0004 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0006 opnum : 000f [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 0 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_pipe_request(2123) Requested \PIPE\NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe.c:api_rpcTNP(2158) api_rpcTNP: NETLOGON op 0xf - api_rpcTNP: rpc command: NET_AUTH2 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe.c:api_rpcTNP(2184) api_rpc_cmds[2].fn == 0x8148c3a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_q_auth_2 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_log_info [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0000 undoc_buffer: 00000001 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000004 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0004 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c uni_str_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0010 buffer : \.\.M.E.R.L.I.N... [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000022 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0024 uni_max_len: 0000000a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0028 offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 002c uni_str_len: 0000000a [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0030 buffer : M.I.D.E.A.R.T.H.$... [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0044 sec_chan: 0006 [2005/10/28 18:13:40, 7] rpc_parse/parse_prs.c:prs_debug(84) 000046 smb_io_unistr2 unistr2 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0048 uni_max_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 004c offset : 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0050 uni_str_len: 00000009 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:dbg_rw_punival(875) 0054 buffer : M.I.D.E.A.R.T.H... [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000066 smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0066 data: 29 19 56 b3 0f 8a c8 bf [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 00006e net_io_neg_flags [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0070 neg_flags: 400701ff [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:push_sec_ctx(256) push_sec_ctx(65534, 65533) : sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 3] smbd/uid.c:push_conn_ctx(388) push_conn_ctx(100) : conn_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_search_ext(985) smbldap_search_ext: base => [dc=terpstra-world,dc=org], filter => [(&(uid=MIDEARTH$)(objectclass=sambaSamAccount))], scope => [2] [2005/10/28 18:13:40, 5] lib/smbldap.c:smbldap_close(894) The connection to the LDAP server was closed [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_open_connection(538) smbldap_open_connection: ldap://localhost [2005/10/28 18:13:40, 2] lib/smbldap.c:smbldap_open_connection(634) smbldap_open_connection: connection opened [2005/10/28 18:13:40, 10] lib/smbldap.c:smbldap_connect_system(766) ldap_connect_system: Binding to ldap server ldap://localhost as "cn=Manager,dc=terpstra-world,dc=org" [2005/10/28 18:13:40, 3] lib/smbldap.c:smbldap_connect_system(809) ldap_connect_system: succesful connection to the LDAP server ldap_connect_system: LDAP server does support paged results [2005/10/28 18:13:40, 4] lib/smbldap.c:smbldap_open(874) The LDAP server is succesfully connected [2005/10/28 18:13:40, 4] passdb/pdb_ldap.c:ldapsam_getsampwnam(1477) ldapsam_getsampwnam: Unable to locate user [MIDEARTH$] count=0 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:pop_sec_ctx(386) pop_sec_ctx (65534, 65533) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 0] rpc_server/srv_netlog_nt.c:get_md4pw(241) get_md4pw: Workstation MIDEARTH$: no account in domain [2005/10/28 18:13:40, 0] rpc_server/srv_netlog_nt.c:_net_auth_2(409) _net_auth2: failed to get machine password for account MIDEARTH$ [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 net_io_r_auth_2 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_chal [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8s(790) 0000 data: 00 00 00 00 00 00 00 00 [2005/10/28 18:13:40, 6] rpc_parse/parse_prs.c:prs_debug(84) 000008 net_io_neg_flags [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0008 neg_flags: 00000000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_ntstatus(733) 000c status: NT_STATUS_ACCESS_DENIED [2005/10/28 18:13:40, 5] rpc_server/srv_pipe.c:api_rpcTNP(2205) api_rpcTNP: called NETLOGON successfully [2005/10/28 18:13:40, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(529) free_pipe_context: destroying talloc pool of size 56 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:write_to_internal_pipe(888) write_to_pipe: data_used = 124 [2005/10/28 18:13:40, 6] rpc_server/srv_pipe_hnd.c:read_from_pipe(920) read_from_pipe: 7141 name: NETLOGON len: 4280 [2005/10/28 18:13:40, 10] rpc_server/srv_pipe_hnd.c:read_from_internal_pipe(993) read_from_pipe: NETLOGON: fault_state = 0 : data_sent_length = 0, prs_offset(&p->out_data.rdata) = 16. [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000000 smb_io_rpc_hdr hdr [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0000 major : 05 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0001 minor : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0002 pkt_type : 02 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0003 flags : 03 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0004 pack_type0: 10 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0005 pack_type1: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0006 pack_type2: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0007 pack_type3: 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0008 frag_len : 0028 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 000a auth_len : 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 000c call_id : 0000001b [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_debug(84) 000010 smb_io_rpc_hdr_resp resp [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint32(703) 0010 alloc_hint: 00000010 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint16(674) 0014 context_id: 0000 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0016 cancel_ct : 00 [2005/10/28 18:13:40, 5] rpc_parse/parse_prs.c:prs_uint8(614) 0017 reserved : 00 [2005/10/28 18:13:40, 5] smbd/ipc.c:copy_trans_params_and_data(60) copy_trans_params_and_data: params[0..0] data[0..40] [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=96 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=8 smt_wct=10 smb_vwv[ 0]= 0 (0x0) smb_vwv[ 1]= 40 (0x28) smb_vwv[ 2]= 0 (0x0) smb_vwv[ 3]= 0 (0x0) smb_vwv[ 4]= 56 (0x38) smb_vwv[ 5]= 0 (0x0) smb_vwv[ 6]= 40 (0x28) smb_vwv[ 7]= 56 (0x38) smb_vwv[ 8]= 0 (0x0) smb_vwv[ 9]= 0 (0x0) smb_bcc=41 [2005/10/28 18:13:40, 10] lib/util.c:dump_data(2063) [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 1B 00 00 ........ .(...... [010] 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [020] 00 00 00 00 00 22 00 00 C0 .....".. . [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 41 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x29 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 8 of length 45 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=41 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=9 smt_wct=3 smb_vwv[ 0]=28993 (0x7141) smb_vwv[ 1]=65535 (0xFFFF) smb_vwv[ 2]=65535 (0xFFFF) smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBclose (pid 6133) conn 0x836db50 [2005/10/28 18:13:40, 4] smbd/uid.c:change_to_user(217) change_to_user: Skipping user change - already user [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1191) search for pipe pnum=7141 [2005/10/28 18:13:40, 5] rpc_server/srv_pipe_hnd.c:get_rpc_pipe(1195) pipe name NETLOGON pnum=7141 (pipes_open=1) [2005/10/28 18:13:40, 5] smbd/pipes.c:reply_pipe_close(272) reply_pipe_close: pnum:7141 [2005/10/28 18:13:40, 10] rpc_server/srv_lsa_hnd.c:close_policy_by_pipe(235) close_policy_by_pipe: deleted handle list for pipe NETLOGON [2005/10/28 18:13:40, 4] rpc_server/srv_pipe_hnd.c:close_rpc_pipe_hnd(1094) closed pipe name NETLOGON pnum=7141 (pipes_open=0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x4 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=9 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) got smb length of 35 [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) got message type 0x0 of len 0x23 [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) Transaction 9 of length 39 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=10 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) switch message SMBtdis (pid 6133) conn 0x836db50 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/service.c:close_cnum(839) merlin (172.16.10.4) closed connection to service IPC$ [2005/10/28 18:13:40, 3] smbd/connection.c:yield_connection(69) Yielding connection to IPC$ [2005/10/28 18:13:40, 4] smbd/vfs.c:vfs_ChDir(737) vfs_ChDir to / [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=100 smb_mid=10 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_data(517) [2005/10/28 18:13:40, 10] lib/util_sock.c:read_smb_length_return_keepalive(615) read_data: read of 4 returned 0. Error = Success got smb length of 35 [2005/10/28 18:13:40, 10] lib/util_sock.c:receive_smb_raw(666) receive_smb_raw: length < 0! [2005/10/28 18:13:40, 6] smbd/process.c:process_smb(1193) [2005/10/28 18:13:40, 3] smbd/process.c:timeout_processing(1447) timeout_processing: End of file from client (client has disconnected). got message type 0x0 of len 0x23 [2005/10/28 18:13:40, 5] lib/gencache.c:gencache_shutdown(88) Closing cache file [2005/10/28 18:13:40, 3] smbd/process.c:process_smb(1194) [2005/10/28 18:13:40, 5] libsmb/namecache.c:namecache_shutdown(79) namecache_shutdown: netbios namecache closed successfully. Transaction 30 of length 39 [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=31 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 3] smbd/process.c:switch_message(993) [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) switch message SMBtdis (pid 6132) conn 0x83daa30 change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) [2005/10/28 18:13:40, 2] smbd/server.c:exit_server(614) Closing connections setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:free_server_info(1480) attempting to free (and zero) a server_info structure [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) [2005/10/28 18:13:40, 3] smbd/connection.c:yield_connection(69) Yielding connection to NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) [2005/10/28 18:13:40, 3] smbd/server.c:exit_server(655) Server exit (normal exit) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 3] smbd/service.c:close_cnum(839) merlin (172.16.10.4) closed connection to service IPC$ [2005/10/28 18:13:40, 3] smbd/connection.c:yield_connection(69) Yielding connection to IPC$ [2005/10/28 18:13:40, 4] smbd/vfs.c:vfs_ChDir(737) vfs_ChDir to / [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(454) [2005/10/28 18:13:40, 5] lib/util.c:show_msg(464) size=35 smb_com=0x71 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=51201 smb_tid=1 smb_pid=6130 smb_uid=101 smb_mid=31 smt_wct=0 smb_bcc=0 [2005/10/28 18:13:40, 10] smbd/process.c:setup_select_timeout(1372) change_notify_timeout: -1 [2005/10/28 18:13:40, 10] smbd/process.c:run_events(299) run_events: No events [2005/10/28 18:13:40, 10] lib/util_sock.c:read_data(517) read_data: read of 4 returned 0. Error = Success [2005/10/28 18:13:40, 10] lib/util_sock.c:receive_smb_raw(666) receive_smb_raw: length < 0! [2005/10/28 18:13:40, 3] smbd/process.c:timeout_processing(1447) timeout_processing: End of file from client (client has disconnected). [2005/10/28 18:13:40, 5] lib/gencache.c:gencache_shutdown(88) Closing cache file [2005/10/28 18:13:40, 5] libsmb/namecache.c:namecache_shutdown(79) namecache_shutdown: netbios namecache closed successfully. [2005/10/28 18:13:40, 3] smbd/sec_ctx.c:set_sec_ctx(288) setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0 [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_nt_user_token(452) NT user token: (NULL) [2005/10/28 18:13:40, 5] auth/auth_util.c:debug_unix_user_token(473) UNIX token of user 0 Primary group is 0 and contains 0 supplementary groups [2005/10/28 18:13:40, 5] smbd/uid.c:change_to_root_user(319) change_to_root_user: now uid=(0,0) gid=(0,0) [2005/10/28 18:13:40, 2] smbd/server.c:exit_server(614) Closing connections [2005/10/28 18:13:40, 5] auth/auth_util.c:free_server_info(1480) attempting to free (and zero) a server_info structure [2005/10/28 18:13:40, 3] smbd/connection.c:yield_connection(69) Yielding connection to [2005/10/28 18:13:40, 3] smbd/server.c:exit_server(655) Server exit (normal exit)