Terminal Output for three scenarios as below: winbind and wb- logs follow at end ======================================================================================= Two node samba cluster which talks to adprotocolx.com and two DCs (they are DNS as well). Each node has nameserver as both the DC IPs to search. nslookup would be round-robin or balanced. windc1 and windc2 are DC names. These DCs are old like 2016 etc. and not 2025. Scenario 1 ========== 4.19.9 default code with no fixes. The node currently uses windc1. We will make that down. Search for where wbinfo -P shifts to windc2. getpwuid (getent) will not shift to new DC. This is what we run in terminal. log.winbindd.scenario1 and log.wb-ADPROTOCOLX.scenario1 are the logs. Child process invokes cm_open_connection in PingDc doing the rediscovery. You can see that GetDcName (rediscovery) is never invoked by getwuid (getent). Meanwhile DCINFO could be written with an info and it would always keep reading from cache same name as failed DC. # date; while true; do sleep 5; echo "Clearing ids in cache"; for i in `net cache list | grep -E "IDMAP|SID2NAME|NAME2SID" | awk '{print $2}'`; do net cache del $i; done; echo ""; date; echo "Displaying net cache list"; net cache list; tdbdump /run/gpfs-samba/lock/gencache.tdb; echo "Pinging using wbinfo -P"; time wbinfo -P; echo "Issuing getent passwd"; time getent passwd 10001; echo ""; done Wed Apr 9 06:57:52 EDT 2025 Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 06:57:57 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.023s user 0m0.013s sys 0m0.006s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.017s user 0m0.002s sys 0m0.001s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 06:58:03 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.023s user 0m0.013s sys 0m0.005s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.013s user 0m0.002s sys 0m0.000s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 06:58:08 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.026s user 0m0.013s sys 0m0.007s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.015s user 0m0.001s sys 0m0.001s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 06:58:14 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.024s user 0m0.013s sys 0m0.006s Issuing getent passwd real 0m15.031s user 0m0.001s sys 0m0.003s Clearing ids in cache Wed Apr 9 06:58:34 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:06:20 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 06:02:16 Value: [2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:06:20 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00_\E3\D1\D8" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(76) = "\A8E\F6g\00\00\00\00[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.93:0,192.168.122.206:0\00P\A5 \C6" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\ACT\F6g\00\00\00\00windc1.adprotocolx.com\00Y\DC\A1\1E" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m26.804s user 0m0.011s sys 0m0.009s Issuing getent passwd real 0m6.408s user 0m0.004s sys 0m0.000s Clearing ids in cache Wed Apr 9 06:59:13 EDT 2025 Displaying net cache list Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:14:06 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:10:01 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:14:06 Value: windc2.adprotocolx.com { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00b_C#" } { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "~V\F6g\00\00\00\00windc2.adprotocolx.com\00\D9\ED\0F\A8" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\89U\F6g\00\00\00\0010.28.1.93:0\00rU\EFd" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "~V\F6g\00\00\00\00windc2.adprotocolx.com\00\DF\D2\7Fn" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.023s user 0m0.010s sys 0m0.009s Issuing getent passwd real 0m7.758s user 0m0.003s sys 0m0.002s Clearing ids in cache Wed Apr 9 06:59:25 EDT 2025 Displaying net cache list Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 Key: DCINFO/ADPROTOCOLX Timeout: 07:51:20 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:14:06 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:02:19 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:02:20 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 06:46:09 Value: (expired) Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:10:01 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:14:06 Value: windc2.adprotocolx.com { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00b_C#" } { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "8_\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\D3\8DF\02" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\1A\AC8\FC" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "~V\F6g\00\00\00\00windc2.adprotocolx.com\00\D9\ED\0F\A8" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\BBS\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\CD\C8\05\5C" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\BCS\F6g\00\00\00\0010.28.1.92:0\00\A0\94D1" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\F1O\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FFs\B3z\17" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\89U\F6g\00\00\00\0010.28.1.93:0\00rU\EFd" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "~V\F6g\00\00\00\00windc2.adprotocolx.com\00\DF\D2\7Fn" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.025s user 0m0.012s sys 0m0.008s Issuing getent passwd real 0m8.066s user 0m0.001s sys 0m0.003s Scenario 2 ========== 4.19.9 with fixes. Fixes as below. diff --git a/source3/winbindd/wb_sids2xids.c b/source3/winbindd/wb_sids2xids.c index f0f6c23fc20..58bff30e0d0 100644 --- a/source3/winbindd/wb_sids2xids.c +++ b/source3/winbindd/wb_sids2xids.c @@ -608,7 +608,9 @@ static void wb_sids2xids_done(struct tevent_req *subreq) return; } - if (NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) && + if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) || + NT_STATUS_EQUAL(result, NT_STATUS_HOST_UNREACHABLE) || + NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) && !state->tried_dclookup) { struct lsa_DomainInfo *d; @@ -618,7 +620,7 @@ static void wb_sids2xids_done(struct tevent_req *subreq) subreq = wb_dsgetdcname_send( state, state->ev, d->name.string, NULL, NULL, - DS_RETURN_DNS_NAME); + DS_RETURN_DNS_NAME | DS_FORCE_REDISCOVERY); if (tevent_req_nomem(subreq, req)) { return; } diff --git a/source3/winbindd/wb_xids2sids.c b/source3/winbindd/wb_xids2sids.c index 86bd7f9deab..4af4b7732d6 100644 --- a/source3/winbindd/wb_xids2sids.c +++ b/source3/winbindd/wb_xids2sids.c @@ -140,12 +140,14 @@ static void wb_xids2sids_dom_done(struct tevent_req *subreq) return; } - if (NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) && + if ((NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) || + NT_STATUS_EQUAL(result, NT_STATUS_HOST_UNREACHABLE) || + NT_STATUS_EQUAL(status, NT_STATUS_IO_TIMEOUT)) && !state->tried_dclookup) { subreq = wb_dsgetdcname_send( state, state->ev, state->dom_map->name, NULL, NULL, - DS_RETURN_DNS_NAME); + DS_RETURN_DNS_NAME | DS_FORCE_REDISCOVERY); if (tevent_req_nomem(subreq, req)) { return; } In terminal, we run as below again. Logs are attached as log.winbindd.scenario2 and log.wb-ADPROTOCOLX.scenario2. You can see in logs that getpwuid invokes GetDcName and gets shifted to new DC. # date; while true; do sleep 5; echo "Clearing ids in cache"; for i in `net cache list | grep -E "IDMAP|SID2NAME|NAME2SID" | awk '{print $2}'`; do net cache del $i; done; echo ""; date; echo "Displaying net cache list"; net cache list; tdbdump /run/gpfs-samba/lock/gencache.tdb; echo "Pinging using wbinfo -P"; time wbinfo -P; echo "Issuing getent passwd"; time getent passwd 10001; echo ""; done Wed Apr 9 07:30:30 EDT 2025 Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:30:36 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.025s user 0m0.012s sys 0m0.008s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.030s user 0m0.001s sys 0m0.002s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:30:42 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.022s user 0m0.009s sys 0m0.009s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.014s user 0m0.002s sys 0m0.000s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:30:47 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.022s user 0m0.012s sys 0m0.006s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.013s user 0m0.000s sys 0m0.002s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:30:53 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.023s user 0m0.010s sys 0m0.009s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.020s user 0m0.000s sys 0m0.002s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:30:58 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.028s user 0m0.012s sys 0m0.008s Issuing getent passwd real 0m13.029s user 0m0.000s sys 0m0.004s Clearing ids in cache Wed Apr 9 07:31:16 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:27:09 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:41:59 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:38:01 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:41:59 Value: windc2.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(408) = "\9Dg\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FC\F1\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\002\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1F\00\00\00\00\00\00\00\1F\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\00c\009\007\003\00:\00d\000\00d\007\00:\008\001\00c\008\00:\00f\000\000\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\ADB\F0\E2" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00*\D1\EAK" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(74) = "\19\5C\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00(\C4\06@" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\07]\F6g\00\00\00\00windc2.adprotocolx.com\00,\EE\9A\8D" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m13.612s user 0m0.013s sys 0m0.008s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m8.170s user 0m0.000s sys 0m0.002s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:31:44 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:32:23 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:46:30 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:42:27 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:32:23 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:46:30 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF\5C\F6\D5\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\16^\F6g\00\00\00\00windc1.adprotocolx.com\00\91LT\05" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\00KD\B6\1B" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "#]\F6g\00\00\00\0010.28.1.92:0\00\A6\DF\FE\1D" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\C7Z\F6g\00\00\00\00\17\00\00\00\FC\F1\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc2\C0\18\0BADPROTOCOLX\00\06WINDC2\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01]\00\05\00\00\00\FF\FF\FF\FF5\E9\97#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\16^\F6g\00\00\00\00windc1.adprotocolx.com\00\97s$\C3" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.022s user 0m0.016s sys 0m0.003s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.012s user 0m0.000s sys 0m0.002s Scenario 3 ========== 4.20.8 with fixes applied. log.winbindd.scenario3 and log.wb-ADPROTOCOLX.scenario3 are the attached files. getpwuid invokes GetDcName for rediscovery but that fails with NO_LOGON_SERVERS error, and keeps giving the same. # date; while true; do sleep 5; echo "Clearing ids in cache"; for i in `net cache list | grep -E "IDMAP|SID2NAME|NAME2SID" | awk '{print $2}'`; do net cache del $i; done; echo ""; date; echo "Displaying net cache list"; net cache list; tdbdump /run/gpfs-samba/lock/gencache.tdb; echo "Pinging using wbinfo -P"; time wbinfo -P; echo "Issuing getent passwd"; time getent passwd 10001; echo ""; done Wed Apr 9 07:45:38 EDT 2025 Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:45:44 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:57:07 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 (expired) Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:57:07 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B7f\1C\0E" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B1Yl\C8" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.025s user 0m0.012s sys 0m0.009s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.047s user 0m0.001s sys 0m0.002s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:45:50 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:57:07 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 (expired) Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:57:07 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B7f\1C\0E" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B1Yl\C8" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.025s user 0m0.012s sys 0m0.007s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.014s user 0m0.000s sys 0m0.002s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:45:55 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:57:07 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 (expired) Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:57:07 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B7f\1C\0E" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B1Yl\C8" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.025s user 0m0.012s sys 0m0.008s Issuing getent passwd ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false real 0m0.013s user 0m0.001s sys 0m0.001s Clearing ids in cache Entry deleted. Entry deleted. Entry deleted. Entry deleted. Wed Apr 9 07:46:01 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 07:57:07 Value: windc1.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:37:44 Value: 10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0 (expired) Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:37:54 Value: 10.28.1.93:0 (expired) Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 07:57:07 Value: windc1.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B7f\1C\0E" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\08\5C\F6g\00\00\00\0010.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0,10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0\00\A9\C7\89\01" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\12\5C\F6g\00\00\00\0010.28.1.93:0\00\5C\BC\E8\BB" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\93`\F6g\00\00\00\00windc1.adprotocolx.com\00\B1Yl\C8" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc1.adprotocolx.com" succeeded real 0m0.026s user 0m0.014s sys 0m0.006s Issuing getent passwd real 1m5.380s user 0m0.001s sys 0m0.003s Clearing ids in cache Wed Apr 9 07:47:11 EDT 2025 Displaying net cache list Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.92 windc1.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 08:02:11 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 07:58:06 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 08:02:11 Value: windc2.adprotocolx.com { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" data(21) = "V^\F6g\00\00\00\00c0000001\00\0B\18\1B\C9" } { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.92 windc1.adprotocolx.com\00\01\16\98\A6" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "\C3a\F6g\00\00\00\00windc2.adprotocolx.com\00\0F\ED\9C9" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com\00" data(21) = "V^\F6g\00\00\00\00c0000001\00\17\14\ED{" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "\CE`\F6g\00\00\00\0010.28.1.93:0\00\EA\B5Y(" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "\C3a\F6g\00\00\00\00windc2.adprotocolx.com\00\09\D2\EC\FF" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "" failed failed to call wbcPingDc: WBC_ERR_WINBIND_NOT_AVAILABLE real 1m4.732s user 0m0.014s sys 0m0.009s Issuing getent passwd real 1m5.181s user 0m0.002s sys 0m0.004s Clearing ids in cache Wed Apr 9 07:49:26 EDT 2025 Displaying net cache list Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 08:04:15 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) Key: NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com Timeout: 07:50:05 Value: c0000194 Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com Timeout: 07:50:05 Value: c0000194 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 08:00:10 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 08:04:15 Value: windc2.adprotocolx.com { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" data(21) = "V^\F6g\00\00\00\00c0000001\00\0B\18\1B\C9" } { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "?b\F6g\00\00\00\00windc2.adprotocolx.com\00\EC\F5G\C9" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com\00" data(21) = "V^\F6g\00\00\00\00c0000001\00\17\14\ED{" } { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com\00" data(21) = "\ED^\F6g\00\00\00\00c0000194\00\C8\FA&\BE" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com\00" data(21) = "\ED^\F6g\00\00\00\00c0000194\00\D4\F6\D0\0C" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "Ja\F6g\00\00\00\0010.28.1.93:0\00\B4\17tm" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "?b\F6g\00\00\00\00windc2.adprotocolx.com\00\EA\CA7\0F" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.026s user 0m0.014s sys 0m0.007s Issuing getent passwd real 0m7.914s user 0m0.000s sys 0m0.004s Clearing ids in cache Wed Apr 9 07:49:39 EDT 2025 Displaying net cache list Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) Key: NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com Timeout: 07:50:36 Value: c0000194 Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com Timeout: 07:50:36 Value: c0000194 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 08:00:10 Value: 10.28.1.93:0 { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" data(21) = "V^\F6g\00\00\00\00c0000001\00\0B\18\1B\C9" } { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com\00" data(21) = "V^\F6g\00\00\00\00c0000001\00\17\14\ED{" } { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com\00" data(21) = "\0C_\F6g\00\00\00\00c0000194\00\FC<\81^" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com\00" data(21) = "\0C_\F6g\00\00\00\00c0000194\00\E00w\EC" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "Ja\F6g\00\00\00\0010.28.1.93:0\00\B4\17tm" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.027s user 0m0.012s sys 0m0.007s Issuing getent passwd real 0m7.088s user 0m0.001s sys 0m0.003s Clearing ids in cache Wed Apr 9 07:49:52 EDT 2025 Displaying net cache list Key: NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 08:04:46 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com Timeout: 07:47:34 Value: c0000001 (expired) Key: NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com Timeout: 07:50:36 Value: c0000194 Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com Timeout: 07:50:36 Value: c0000194 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 08:00:41 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 08:04:46 Value: windc2.adprotocolx.com { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com\00" data(21) = "V^\F6g\00\00\00\00c0000001\00\0B\18\1B\C9" } { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "^b\F6g\00\00\00\00windc2.adprotocolx.com\00\9E94\CF" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com\00" data(21) = "V^\F6g\00\00\00\00c0000001\00\17\14\ED{" } { key(50) = "NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com\00" data(21) = "\0C_\F6g\00\00\00\00c0000194\00\FC<\81^" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(54) = "NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com\00" data(21) = "\0C_\F6g\00\00\00\00c0000194\00\E00w\EC" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "ia\F6g\00\00\00\0010.28.1.93:0\00\8F\B0\A2\81" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "^b\F6g\00\00\00\00windc2.adprotocolx.com\00\98\06D\09" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.025s user 0m0.011s sys 0m0.009s Issuing getent passwd real 0m22.120s user 0m0.000s sys 0m0.005s Clearing ids in cache Wed Apr 9 07:50:19 EDT 2025 Displaying net cache list Key: DCINFO/ADPROTOCOLX Timeout: 08:31:35 Value: Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX Timeout: 07:53:58 Value: Key: NBT/WINDC1#20 Timeout: 06:20:48 Value: [2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0 (expired) Key: NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com Timeout: 07:32:17 Value: c0000001 (expired) Key: CURRENT_DCNAME/ADPROTOCOLX Timeout: Mon Jan 18 22:14:07 2038 Value: 10.28.1.93 windc2.adprotocolx.com Key: SAF/DOMAIN/ADPROTOCOLX Timeout: 08:05:05 Value: windc2.adprotocolx.com Key: NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com Timeout: 06:59:51 Value: c0000001 (expired) Key: NEG_CONN_CACHE/adprotocolx.com, Timeout: 02:34:13 Value: c0000001 (expired) Key: NBT/ADPROTOCOLX.COM#1C Timeout: 07:57:35 Value: 10.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0 Key: NBT/WINDC1.ADPROTOCOLX.COM#20 Timeout: 07:53:04 Value: 10.28.1.92:0 Key: DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM Timeout: 07:53:58 Value: Key: NBT/WINDC2.ADPROTOCOLX.COM#20 Timeout: 08:01:00 Value: 10.28.1.93:0 Key: SAF/DOMAIN/ADPROTOCOLX.COM Timeout: 08:05:05 Value: windc2.adprotocolx.com { key(19) = "DCINFO/ADPROTOCOLX\00" data(404) = "\A7h\F6g\00\00\00\00\00\00\02\00\04\00\02\00\01\00\00\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\08\00\02\00\0C\00\02\00\FD\F3\01\E0\10\00\02\00\14\00\02\00\19\00\00\00\00\00\00\00\19\00\00\00\5C\00\5C\00w\00i\00n\00d\00c\001\00.\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\00\00\1D\00\00\00\00\00\00\00\1D\00\00\00\5C\00\5C\002\000\000\001\00:\001\009\002\00:\00:\006\005\006\00a\00:\003\004\008\00:\002\008\00e\001\00:\00d\001\00\00\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\10\00\00\00\00\00\00\00\10\00\00\00a\00d\00p\00r\00o\00t\00o\00c\00o\00l\00x\00.\00c\00o\00m\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\00\18\00\00\00\00\00\00\00\18\00\00\00D\00e\00f\00a\00u\00l\00t\00-\00F\00i\00r\00s\00t\00-\00S\00i\00t\00e\00-\00N\00a\00m\00e\00\00\005j\E5\80" } { key(31) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\A8\8E\BD\C8" } { key(14) = "NBT/WINDC1#20\00" data(74) = "\00J\F6g\00\00\00\00[2001:192::656a:348:28e1:d1]:0,10.28.1.92:0,192.168.122.133:0\00\E1\B8\D3\B4" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com\00" data(21) = "\C1Z\F6g\00\00\00\00c0000001\006\8CG\9C" } { key(27) = "CURRENT_DCNAME/ADPROTOCOLX\00" data(46) = "\FF\FF\FF\7F\00\00\00\0010.28.1.93 windc2.adprotocolx.com\00m[\95\E9" } { key(23) = "SAF/DOMAIN/ADPROTOCOLX\00" data(35) = "qb\F6g\00\00\00\00windc2.adprotocolx.com\00@\F90\97" } { key(59) = "IDMAP/SID2XID/S-1-5-21-2132440393-2340035198-831781571-514\00" data(13) = "\00\00\00\00\00\00\00\00\00\85\F1e\09" } { key(54) = "NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com\00" data(21) = "'S\F6g\00\00\00\00c0000001\00\1F\97\B2\A4" } { key(35) = "AD_SITENAME/DOMAIN/ADPROTOCOLX.COM\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\9A\96\A0\B8" } { key(32) = "NEG_CONN_CACHE/adprotocolx.com,\00" data(21) = "\E5\14\F6g\00\00\00\00c0000001\00\BF\E8`D" } { key(31) = "AD_SITENAME/DOMAIN/ADPROTOCOLX\00" data(36) = "\7F\A9T|\AB\C2\F0\00Default-First-Site-Name\00\B4%+\EA" } { key(23) = "NBT/ADPROTOCOLX.COM#1C\00" data(138) = "\AF`\F6g\00\00\00\0010.28.1.93:0,192.168.122.206:0,[2001:192::c973:d0d7:81c8:f00]:0,10.28.1.92:0,192.168.122.133:0,[2001:192::656a:348:28e1:d1]:0\00^\AAT\05" } { key(30) = "NBT/WINDC1.ADPROTOCOLX.COM#20\00" data(25) = "\A0_\F6g\00\00\00\0010.28.1.92:0\00j\B6\9D\9E" } { key(35) = "DSGETDCNAME/DOMAIN/ADPROTOCOLX.COM\00" data(131) = "\D6_\F6g\00\00\00\00\17\00\00\00\FD\F3\01\00M\12\AEp\DB\B2UO\B5^Ln\14\B7\01\08\0Badprotocolx\03com\00\C0\18\06windc1\C0\18\0BADPROTOCOLX\00\06WINDC1\00\00\17Default-First-Site-Name\00\C0J\08\02\00\00\00\0A\1C\01\5C\00\05\00\00\00\FF\FF\FF\FF\C1\91\FF#" } { key(30) = "NBT/WINDC2.ADPROTOCOLX.COM#20\00" data(25) = "|a\F6g\00\00\00\0010.28.1.93:0\00F%eG" } { key(27) = "SAF/DOMAIN/ADPROTOCOLX.COM\00" data(35) = "qb\F6g\00\00\00\00windc2.adprotocolx.com\00F\C6@Q" } Pinging using wbinfo -P checking the NETLOGON for domain[ADPROTOCOLX] dc connection to "windc2.adprotocolx.com" succeeded real 0m0.027s user 0m0.013s sys 0m0.009s Issuing getent passwd real 0m7.446s user 0m0.002s sys 0m0.002s Logs name: log.winbindd.scenario1 ======================== [2025/04/09 06:57:16.554986, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:57:16.555032, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2338102)]: ping [2025/04/09 06:57:16.555079, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338102):PING]: delivered response to client [2025/04/09 06:57:16.555194, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:57:16.573329, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:57:16.573402, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:16.573426, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338104)]: request interface version (version = 32) [2025/04/09 06:57:16.573468, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338104):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:16.573558, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:16.573589, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338104)]: request interface version (version = 32) [2025/04/09 06:57:16.573634, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338104):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:16.573725, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:57:16.573752, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2338104)]: request misc info [2025/04/09 06:57:16.573806, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338104):INFO]: delivered response to client [2025/04/09 06:57:16.573922, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:57:16.573947, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2338104)]: request netbios name [2025/04/09 06:57:16.574016, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338104):NETBIOS_NAME]: delivered response to client [2025/04/09 06:57:16.574107, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:57:16.574135, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2338104)]: request domain name [2025/04/09 06:57:16.574173, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338104):DOMAIN_NAME]: delivered response to client [2025/04/09 06:57:16.574278, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338104)] Handling async request: DOMAIN_INFO [2025/04/09 06:57:16.574311, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2338104]: domain_info [ADPROTOCOLX] [2025/04/09 06:57:16.574399, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338104):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:57:16.574461, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338104):DOMAIN_INFO]: delivered response to client [2025/04/09 06:57:16.574567, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338104)] Handling async request: PING_DC [2025/04/09 06:57:16.574659, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:57:16.578164, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:57:16.578271, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338104):PING_DC]: NT_STATUS_OK [2025/04/09 06:57:16.578348, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338104):PING_DC]: delivered response to client [2025/04/09 06:57:16.578984, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:57:19.789222, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 06:57:19.789607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:57:19.789645, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 06:57:19.789671, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:57:19.789690, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 06:57:19.789715, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:57:30.993987, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:57:30.999533, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:30.999587, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338343)]: request interface version (version = 32) [2025/04/09 06:57:30.999658, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338343):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:31.006234, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:57:31.006271, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2338343)]: ping [2025/04/09 06:57:31.006319, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338343):PING]: delivered response to client [2025/04/09 06:57:31.008580, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:57:31.032482, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:57:31.032607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:31.032634, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338365)]: request interface version (version = 32) [2025/04/09 06:57:31.032700, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338365):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:31.032804, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:31.032830, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338365)]: request interface version (version = 32) [2025/04/09 06:57:31.032869, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338365):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:31.032982, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:57:31.033011, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2338365)]: request misc info [2025/04/09 06:57:31.033054, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338365):INFO]: delivered response to client [2025/04/09 06:57:31.033148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:57:31.033179, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2338365)]: request netbios name [2025/04/09 06:57:31.033222, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338365):NETBIOS_NAME]: delivered response to client [2025/04/09 06:57:31.033314, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:57:31.033339, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2338365)]: request domain name [2025/04/09 06:57:31.033377, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338365):DOMAIN_NAME]: delivered response to client [2025/04/09 06:57:31.033494, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338365)] Handling async request: DOMAIN_INFO [2025/04/09 06:57:31.033528, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2338365]: domain_info [ADPROTOCOLX] [2025/04/09 06:57:31.033562, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338365):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:57:31.033616, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338365):DOMAIN_INFO]: delivered response to client [2025/04/09 06:57:31.033720, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338365)] Handling async request: PING_DC [2025/04/09 06:57:31.033803, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:57:31.036454, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:57:31.036527, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338365):PING_DC]: NT_STATUS_OK [2025/04/09 06:57:31.036583, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338365):PING_DC]: delivered response to client [2025/04/09 06:57:31.038060, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:57:45.954060, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:57:45.955858, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:45.955900, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338645)]: request interface version (version = 32) [2025/04/09 06:57:45.955978, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338645):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:45.956121, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:57:45.956147, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2338645)]: ping [2025/04/09 06:57:45.956188, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338645):PING]: delivered response to client [2025/04/09 06:57:45.958168, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:57:45.979206, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:57:45.979343, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:45.979370, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338649)]: request interface version (version = 32) [2025/04/09 06:57:45.979429, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338649):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:45.980605, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:45.980687, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338649)]: request interface version (version = 32) [2025/04/09 06:57:45.980744, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338649):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:45.981653, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:57:45.981699, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2338649)]: request misc info [2025/04/09 06:57:45.981756, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338649):INFO]: delivered response to client [2025/04/09 06:57:45.981861, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:57:45.981886, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2338649)]: request netbios name [2025/04/09 06:57:45.981938, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338649):NETBIOS_NAME]: delivered response to client [2025/04/09 06:57:45.982067, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:57:45.982092, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2338649)]: request domain name [2025/04/09 06:57:45.982132, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338649):DOMAIN_NAME]: delivered response to client [2025/04/09 06:57:45.982226, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338649)] Handling async request: DOMAIN_INFO [2025/04/09 06:57:45.982253, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2338649]: domain_info [ADPROTOCOLX] [2025/04/09 06:57:45.982283, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338649):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:57:45.982347, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338649):DOMAIN_INFO]: delivered response to client [2025/04/09 06:57:45.982447, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338649)] Handling async request: PING_DC [2025/04/09 06:57:45.982504, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:57:46.002698, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:57:46.002784, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338649):PING_DC]: NT_STATUS_OK [2025/04/09 06:57:46.002839, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338649):PING_DC]: delivered response to client [2025/04/09 06:57:46.006128, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:57:49.791752, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 06:57:49.791975, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:57:49.792002, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 06:57:49.792035, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:57:49.792053, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 06:57:49.792077, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:57:58.084527, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:57:58.084675, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:58.084711, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338939)]: request interface version (version = 32) [2025/04/09 06:57:58.084756, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338939):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:58.084866, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:58.084901, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338939)]: request interface version (version = 32) [2025/04/09 06:57:58.084942, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338939):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:58.085079, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:57:58.085111, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2338939)]: request misc info [2025/04/09 06:57:58.085153, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338939):INFO]: delivered response to client [2025/04/09 06:57:58.085242, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:57:58.085266, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2338939)]: request netbios name [2025/04/09 06:57:58.085304, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338939):NETBIOS_NAME]: delivered response to client [2025/04/09 06:57:58.085392, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:57:58.085415, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2338939)]: request domain name [2025/04/09 06:57:58.085452, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338939):DOMAIN_NAME]: delivered response to client [2025/04/09 06:57:58.085543, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338939)] Handling async request: DOMAIN_INFO [2025/04/09 06:57:58.085569, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2338939]: domain_info [ADPROTOCOLX] [2025/04/09 06:57:58.085609, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338939):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:57:58.085660, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338939):DOMAIN_INFO]: delivered response to client [2025/04/09 06:57:58.085759, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338939)] Handling async request: PING_DC [2025/04/09 06:57:58.085802, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:57:58.088284, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:57:58.088348, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338939):PING_DC]: NT_STATUS_OK [2025/04/09 06:57:58.088392, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338939):PING_DC]: delivered response to client [2025/04/09 06:57:58.089549, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:57:58.091915, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:57:58.092020, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:57:58.092049, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2338940)]: request interface version (version = 32) [2025/04/09 06:57:58.092093, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2338940):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:57:58.092187, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2338940)] Handling async request: GETPWUID [2025/04/09 06:57:58.092221, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2338940)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 06:57:58.092258, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 06:57:58.092362, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 06:57:58.092389, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:57:58.092435, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:57:58.094401, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 06:57:58.094493, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:57:58.094515, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 06:57:58.094536, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 06:57:58.094555, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:57:58.094596, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:57:58.098214, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 06:57:58.098318, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:57:58.098340, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:57:58.098363, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 06:57:58.098392, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 06:57:58.098457, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 06:57:58 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 06:57:58.098514, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 06:57:58 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 06:57:58.098565, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 06:57:58.098588, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:418(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:57:58.098626, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:57:58.098662, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:57:58.098709, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 06:57:58.098746, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 06:57:58.098776, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:57:58.098809, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 06:57:58.098832, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 06:57:58.098857, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 06:57:58.098888, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:775(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 06:57:58.098918, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:782(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:57:58.098938, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:57:58.098983, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:57:58.099009, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 06:57:58.099027, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 06:57:58.099077, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 06:57:58.099135, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 06:57:58.099174, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:57:58.099272, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 06:57:58.099297, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 06:57:58.099331, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 06:57:58.099416, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 06:57:58.099441, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 06:57:58.099471, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:57:58.103236, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 06:57:58.103278, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 06:57:58.103377, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 06:57:58.103397, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 06:57:58.103430, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:57:58.103531, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 06:57:58.103578, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:57:58.105953, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 06:57:58.106140, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:57:58.106245, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 06:57:58.106264, 5, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:57:58.106398, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 06:57:58.106435, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 06:57:58.106464, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2338940):GETPWUID]: NT_STATUS_OK [2025/04/09 06:57:58.106509, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2338940):GETPWUID]: delivered response to client [2025/04/09 06:57:58.106823, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:00.991440, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:00.991619, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:00.991648, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338960)]: request interface version (version = 32) [2025/04/09 06:58:00.991710, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338960):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:00.999986, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:58:01.000021, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2338960)]: ping [2025/04/09 06:58:01.000073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338960):PING]: delivered response to client [2025/04/09 06:58:01.001263, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:01.022265, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:01.022402, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:01.022431, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338982)]: request interface version (version = 32) [2025/04/09 06:58:01.022484, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338982):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:01.023163, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:01.023196, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2338982)]: request interface version (version = 32) [2025/04/09 06:58:01.023255, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338982):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:01.026361, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:58:01.026394, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2338982)]: request misc info [2025/04/09 06:58:01.026446, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338982):INFO]: delivered response to client [2025/04/09 06:58:01.028028, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:58:01.028061, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2338982)]: request netbios name [2025/04/09 06:58:01.028110, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338982):NETBIOS_NAME]: delivered response to client [2025/04/09 06:58:01.031030, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:58:01.031079, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2338982)]: request domain name [2025/04/09 06:58:01.031139, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338982):DOMAIN_NAME]: delivered response to client [2025/04/09 06:58:01.031289, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338982)] Handling async request: DOMAIN_INFO [2025/04/09 06:58:01.031318, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2338982]: domain_info [ADPROTOCOLX] [2025/04/09 06:58:01.031365, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338982):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:58:01.031418, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338982):DOMAIN_INFO]: delivered response to client [2025/04/09 06:58:01.031520, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2338982)] Handling async request: PING_DC [2025/04/09 06:58:01.031570, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:01.035083, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:01.035180, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2338982):PING_DC]: NT_STATUS_OK [2025/04/09 06:58:01.035233, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2338982):PING_DC]: delivered response to client [2025/04/09 06:58:01.038367, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:03.536097, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:03.536314, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:03.536341, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339048)]: request interface version (version = 32) [2025/04/09 06:58:03.536395, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339048):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:03.536516, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:03.536541, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339048)]: request interface version (version = 32) [2025/04/09 06:58:03.536580, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339048):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:03.536670, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:58:03.536694, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2339048)]: request misc info [2025/04/09 06:58:03.536732, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339048):INFO]: delivered response to client [2025/04/09 06:58:03.536821, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:58:03.536845, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2339048)]: request netbios name [2025/04/09 06:58:03.536882, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339048):NETBIOS_NAME]: delivered response to client [2025/04/09 06:58:03.536998, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:58:03.537030, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2339048)]: request domain name [2025/04/09 06:58:03.537073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339048):DOMAIN_NAME]: delivered response to client [2025/04/09 06:58:03.537176, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339048)] Handling async request: DOMAIN_INFO [2025/04/09 06:58:03.537202, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2339048]: domain_info [ADPROTOCOLX] [2025/04/09 06:58:03.537230, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339048):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:58:03.537280, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339048):DOMAIN_INFO]: delivered response to client [2025/04/09 06:58:03.537374, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339048)] Handling async request: PING_DC [2025/04/09 06:58:03.537424, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:03.540577, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:03.540643, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339048):PING_DC]: NT_STATUS_OK [2025/04/09 06:58:03.540687, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339048):PING_DC]: delivered response to client [2025/04/09 06:58:03.541862, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:03.543733, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:03.543806, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:03.543831, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2339049)]: request interface version (version = 32) [2025/04/09 06:58:03.543874, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2339049):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:03.544010, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2339049)] Handling async request: GETPWUID [2025/04/09 06:58:03.544055, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2339049)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 06:58:03.544080, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 06:58:03.544148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 06:58:03.544176, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:58:03.544200, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:58:03.545108, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 06:58:03.545194, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:58:03.545216, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 06:58:03.545238, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 06:58:03.545269, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:58:03.545292, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:58:03.547495, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 06:58:03.547579, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:58:03.547600, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:58:03.547630, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 06:58:03.547651, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 06:58:03.547679, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 06:58:03 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 06:58:03.547743, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 06:58:03 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 06:58:03.547779, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 06:58:03.547799, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:418(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:03.547822, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:58:03.547847, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:03.547875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 06:58:03.547898, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 06:58:03.547921, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:03.547947, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 06:58:03.548016, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 06:58:03.548038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 06:58:03.548061, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:775(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 06:58:03.548092, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:782(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:03.548113, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:58:03.548132, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:58:03.548158, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 06:58:03.548177, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 06:58:03.548224, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 06:58:03.548263, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 06:58:03.548285, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:03.548377, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 06:58:03.548397, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 06:58:03.548416, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 06:58:03.548455, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 06:58:03.548480, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 06:58:03.548505, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:03.551596, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 06:58:03.551648, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 06:58:03.551744, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 06:58:03.551765, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 06:58:03.551786, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:03.551887, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 06:58:03.551926, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:03.553685, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 06:58:03.553841, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:03.553944, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 06:58:03.553998, 5, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:03.554112, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 06:58:03.554139, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 06:58:03.554166, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2339049):GETPWUID]: NT_STATUS_OK [2025/04/09 06:58:03.554208, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2339049):GETPWUID]: delivered response to client [2025/04/09 06:58:03.554495, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:09.012559, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:09.012798, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:09.012828, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339420)]: request interface version (version = 32) [2025/04/09 06:58:09.012897, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339420):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:09.013017, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:09.013046, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339420)]: request interface version (version = 32) [2025/04/09 06:58:09.013111, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339420):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:09.013382, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:58:09.013415, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2339420)]: request misc info [2025/04/09 06:58:09.013471, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339420):INFO]: delivered response to client [2025/04/09 06:58:09.013670, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:58:09.013697, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2339420)]: request netbios name [2025/04/09 06:58:09.013748, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339420):NETBIOS_NAME]: delivered response to client [2025/04/09 06:58:09.013842, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:58:09.013867, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2339420)]: request domain name [2025/04/09 06:58:09.013916, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339420):DOMAIN_NAME]: delivered response to client [2025/04/09 06:58:09.014029, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339420)] Handling async request: DOMAIN_INFO [2025/04/09 06:58:09.014079, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2339420]: domain_info [ADPROTOCOLX] [2025/04/09 06:58:09.014133, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339420):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:58:09.014191, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339420):DOMAIN_INFO]: delivered response to client [2025/04/09 06:58:09.014341, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339420)] Handling async request: PING_DC [2025/04/09 06:58:09.014405, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:09.017721, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:09.017808, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339420):PING_DC]: NT_STATUS_OK [2025/04/09 06:58:09.017864, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339420):PING_DC]: delivered response to client [2025/04/09 06:58:09.017995, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:09.021610, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:09.021700, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:09.021726, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2339421)]: request interface version (version = 32) [2025/04/09 06:58:09.021780, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2339421):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:09.021856, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2339421)] Handling async request: GETPWUID [2025/04/09 06:58:09.021883, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2339421)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 06:58:09.021908, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 06:58:09.021972, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 06:58:09.022010, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:58:09.022045, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:58:09.022947, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 06:58:09.023059, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:58:09.023101, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 06:58:09.023124, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 06:58:09.023144, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:58:09.023169, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:58:09.027025, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 06:58:09.027151, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:58:09.027174, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:58:09.027198, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 06:58:09.027217, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 06:58:09.027257, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 06:58:09 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 06:58:09.027322, 10, pid=2329712, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 06:58:09 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 06:58:09.027361, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 06:58:09.027387, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:418(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:09.027413, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:58:09.027440, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:09.027469, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 06:58:09.027493, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 06:58:09.027516, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:09.027543, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 06:58:09.027565, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 06:58:09.027585, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 06:58:09.027606, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:775(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 06:58:09.027626, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:782(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:09.027647, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:58:09.027667, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 06:58:09.027689, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 06:58:09.027708, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 06:58:09.027742, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 06:58:09.027774, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 06:58:09.027794, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:09.027895, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 06:58:09.027917, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 06:58:09.027936, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 06:58:09.028000, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 06:58:09.028025, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 06:58:09.028054, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:09.031768, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 06:58:09.031818, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 06:58:09.031906, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 06:58:09.031931, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 06:58:09.031954, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:09.032116, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 06:58:09.032146, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:09.034075, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 06:58:09.034229, 10, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:09.034344, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 06:58:09.034366, 5, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 06:58:09.034484, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 06:58:09.034513, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 06:58:09.034541, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2339421):GETPWUID]: NT_STATUS_OK [2025/04/09 06:58:09.034595, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2339421):GETPWUID]: delivered response to client [2025/04/09 06:58:09.034653, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:14.516451, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:14.516651, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:14.516690, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339448)]: request interface version (version = 32) [2025/04/09 06:58:14.516750, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339448):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:14.516834, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:14.516859, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339448)]: request interface version (version = 32) [2025/04/09 06:58:14.516904, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339448):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:14.516992, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:58:14.517033, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2339448)]: request misc info [2025/04/09 06:58:14.517082, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339448):INFO]: delivered response to client [2025/04/09 06:58:14.517196, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:58:14.517223, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2339448)]: request netbios name [2025/04/09 06:58:14.517270, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339448):NETBIOS_NAME]: delivered response to client [2025/04/09 06:58:14.517341, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:58:14.517365, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2339448)]: request domain name [2025/04/09 06:58:14.517408, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339448):DOMAIN_NAME]: delivered response to client [2025/04/09 06:58:14.517468, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339448)] Handling async request: DOMAIN_INFO [2025/04/09 06:58:14.517493, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2339448]: domain_info [ADPROTOCOLX] [2025/04/09 06:58:14.517526, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339448):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:58:14.517585, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339448):DOMAIN_INFO]: delivered response to client [2025/04/09 06:58:14.517655, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339448)] Handling async request: PING_DC [2025/04/09 06:58:14.517705, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:14.520216, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:14.520291, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339448):PING_DC]: NT_STATUS_OK [2025/04/09 06:58:14.520343, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339448):PING_DC]: delivered response to client [2025/04/09 06:58:14.520478, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:14.523456, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:14.523527, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:14.523551, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2339449)]: request interface version (version = 32) [2025/04/09 06:58:14.523597, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2339449):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:14.523868, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2339449)] Handling async request: GETPWUID [2025/04/09 06:58:14.523897, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2339449)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 06:58:14.523937, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 06:58:14.524015, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 06:58:14.524042, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:58:14.524068, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:58:14.524847, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 06:58:14.524925, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:58:14.524946, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 06:58:14.524988, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 06:58:14.525010, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:58:14.525039, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:58:15.981039, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 06:58:15.981171, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:15.981215, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339480)]: request interface version (version = 32) [2025/04/09 06:58:15.981275, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339480):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:15.984492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:58:15.984527, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2339480)]: ping [2025/04/09 06:58:15.984582, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339480):PING]: delivered response to client [2025/04/09 06:58:15.985438, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 06:58:16.011439, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 06:58:16.011527, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:16.011552, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339493)]: request interface version (version = 32) [2025/04/09 06:58:16.011598, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339493):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:16.011692, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:16.011717, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339493)]: request interface version (version = 32) [2025/04/09 06:58:16.011756, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339493):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:16.011856, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:58:16.011880, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2339493)]: request misc info [2025/04/09 06:58:16.011920, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339493):INFO]: delivered response to client [2025/04/09 06:58:16.012033, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:58:16.012062, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2339493)]: request netbios name [2025/04/09 06:58:16.012113, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339493):NETBIOS_NAME]: delivered response to client [2025/04/09 06:58:16.012232, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:58:16.012256, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2339493)]: request domain name [2025/04/09 06:58:16.012295, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339493):DOMAIN_NAME]: delivered response to client [2025/04/09 06:58:16.012387, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339493)] Handling async request: DOMAIN_INFO [2025/04/09 06:58:16.012413, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2339493]: domain_info [ADPROTOCOLX] [2025/04/09 06:58:16.012459, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339493):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:58:16.012505, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339493):DOMAIN_INFO]: delivered response to client [2025/04/09 06:58:16.012604, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339493)] Handling async request: PING_DC [2025/04/09 06:58:16.012651, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:16.014801, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:16.014872, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339493):PING_DC]: NT_STATUS_OK [2025/04/09 06:58:16.014920, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339493):PING_DC]: delivered response to client [2025/04/09 06:58:16.016130, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 06:58:19.796048, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 06:58:19.796254, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:19.796290, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 06:58:19.796316, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:19.796335, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 06:58:19.796358, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:29.549058, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_IO_TIMEOUT [2025/04/09 06:58:29.549184, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 06:58:29.549212, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_IO_TIMEOUT [2025/04/09 06:58:29.549245, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_IO_TIMEOUT [2025/04/09 06:58:29.549284, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2339449):GETPWUID]: NT_STATUS_IO_TIMEOUT [2025/04/09 06:58:29.549377, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_IO_TIMEOUT. [2025/04/09 06:58:29.549424, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2339449):GETPWUID]: delivered response to client [2025/04/09 06:58:29.549486, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 15.025583 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:58:14.523866] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:58:29.549449] [15.025583] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 06:58:14.523897] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 06:58:29.549244] [15.025347] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:256 [2025/04/09 06:58:14.523936] ../../source3/winbindd/wb_xids2sids.c:349 [2025/04/09 06:58:29.549176] [15.025240] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 06:58:14.524009] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 06:58:14.524009] [0.000000] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:58:14.524014] ../../source3/winbindd/wb_xids2sids.c:191 [2025/04/09 06:58:14.524985] [0.000971] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:58:14.524064] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:58:14.524924] [0.000860] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:58:14.524065] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:58:14.524922] [0.000857] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:58:14.524066] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:58:14.524921] [0.000855] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:58:14.524181] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:58:14.524843] [0.000662] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:58:14.524183] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:58:14.524842] [0.000659] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:58:14.524183] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:58:14.524840] [0.000657] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:58:14.524185] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:58:14.524188] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:58:14.524195] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:58:14.524836] [0.000641] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:58:14.524195] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:58:14.524240] [0.000045] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:14.524195] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:14.524238] [0.000043] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:58:14.524241] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:58:14.524835] [0.000594] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:58:14.524241] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:58:14.524833] [0.000592] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:58:14.524988] ../../source3/winbindd/wb_xids2sids.c:157 [2025/04/09 06:58:29.549175] [15.024187] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:58:14.525035] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:58:29.549173] [15.024138] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:58:14.525036] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:58:29.549164] [15.024128] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:58:14.525037] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:58:29.549148] [15.024111] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:58:14.525118] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:58:29.549044] [15.023926] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:58:14.525120] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:58:29.549030] [15.023910] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:58:14.525120] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:58:29.549022] [15.023902] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:58:14.525122] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:58:14.525125] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:58:14.525131] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:58:29.549010] [15.023879] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:58:14.525131] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:58:14.525168] [0.000037] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:14.525132] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:14.525166] [0.000034] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:58:14.525170] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:58:29.549008] [15.023838] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:58:14.525171] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:58:29.548993] [15.023822] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:58:29.549342] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:58:29.549423] [0.000081] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:29.549343] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:29.549361] [0.000018] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 06:58:29.551938, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:30.964107, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:30.964231, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:30.964257, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339766)]: request interface version (version = 32) [2025/04/09 06:58:30.964319, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339766):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:30.964630, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:58:30.964658, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2339766)]: ping [2025/04/09 06:58:30.964699, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339766):PING]: delivered response to client [2025/04/09 06:58:30.966143, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:31.006176, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:31.006299, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:31.006335, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339778)]: request interface version (version = 32) [2025/04/09 06:58:31.006390, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339778):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:31.008914, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:31.008971, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339778)]: request interface version (version = 32) [2025/04/09 06:58:31.009024, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339778):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:31.009148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:58:31.009174, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2339778)]: request misc info [2025/04/09 06:58:31.009214, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339778):INFO]: delivered response to client [2025/04/09 06:58:31.009305, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:58:31.009335, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2339778)]: request netbios name [2025/04/09 06:58:31.009378, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339778):NETBIOS_NAME]: delivered response to client [2025/04/09 06:58:31.009485, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:58:31.009517, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2339778)]: request domain name [2025/04/09 06:58:31.009555, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339778):DOMAIN_NAME]: delivered response to client [2025/04/09 06:58:31.009645, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339778)] Handling async request: DOMAIN_INFO [2025/04/09 06:58:31.009678, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2339778]: domain_info [ADPROTOCOLX] [2025/04/09 06:58:31.009726, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339778):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:58:31.009769, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339778):DOMAIN_INFO]: delivered response to client [2025/04/09 06:58:31.009902, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339778)] Handling async request: PING_DC [2025/04/09 06:58:31.010008, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:34.733173, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 06:58:34.733358, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:34.733386, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339863)]: request interface version (version = 32) [2025/04/09 06:58:34.733444, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339863):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:34.733533, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:34.733586, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2339863)]: request interface version (version = 32) [2025/04/09 06:58:34.733632, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339863):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:34.733692, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:58:34.733715, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2339863)]: request misc info [2025/04/09 06:58:34.733758, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339863):INFO]: delivered response to client [2025/04/09 06:58:34.733817, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:58:34.733839, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2339863)]: request netbios name [2025/04/09 06:58:34.733892, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339863):NETBIOS_NAME]: delivered response to client [2025/04/09 06:58:34.733969, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:58:34.734006, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2339863)]: request domain name [2025/04/09 06:58:34.734052, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339863):DOMAIN_NAME]: delivered response to client [2025/04/09 06:58:34.734135, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339863)] Handling async request: DOMAIN_INFO [2025/04/09 06:58:34.734162, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2339863]: domain_info [ADPROTOCOLX] [2025/04/09 06:58:34.734192, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339863):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:58:34.734256, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339863):DOMAIN_INFO]: delivered response to client [2025/04/09 06:58:34.734555, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2339863)] Handling async request: PING_DC [2025/04/09 06:58:34.734623, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:49.799413, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 06:58:49.799519, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:49.799545, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 06:58:49.799568, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:49.799586, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 06:58:49.799608, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:56.018312, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) winbind_client_activity[2339778:PING_DC]: client has closed connection - removing client [2025/04/09 06:58:56.018409, 2, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) final write to client failed: Broken pipe [2025/04/09 06:58:56.018618, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) wb_child_request_cleanup: keep orphaned subreq[0x56144d5bd960] [2025/04/09 06:58:56.082322, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:56.082451, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:56.082479, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340362)]: request interface version (version = 32) [2025/04/09 06:58:56.082525, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340362):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:56.082649, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:58:56.082674, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2340362)]: ping [2025/04/09 06:58:56.082712, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340362):PING]: delivered response to client [2025/04/09 06:58:56.083464, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:58:56.100438, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:58:56.100510, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:56.100535, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340364)]: request interface version (version = 32) [2025/04/09 06:58:56.100577, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340364):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:56.100670, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:58:56.100694, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340364)]: request interface version (version = 32) [2025/04/09 06:58:56.100732, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340364):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:58:56.100827, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:58:56.100861, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2340364)]: request misc info [2025/04/09 06:58:56.100902, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340364):INFO]: delivered response to client [2025/04/09 06:58:56.101012, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:58:56.101040, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2340364)]: request netbios name [2025/04/09 06:58:56.101085, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340364):NETBIOS_NAME]: delivered response to client [2025/04/09 06:58:56.101175, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:58:56.101199, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2340364)]: request domain name [2025/04/09 06:58:56.101237, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340364):DOMAIN_NAME]: delivered response to client [2025/04/09 06:58:56.101326, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2340364)] Handling async request: DOMAIN_INFO [2025/04/09 06:58:56.101351, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2340364]: domain_info [ADPROTOCOLX] [2025/04/09 06:58:56.101382, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2340364):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:58:56.101435, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340364):DOMAIN_INFO]: delivered response to client [2025/04/09 06:58:56.101531, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2340364)] Handling async request: PING_DC [2025/04/09 06:58:56.101586, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:56.101649, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1673(fork_domain_child) fork_domain_child called for domain 'ADPROTOCOLX' [2025/04/09 06:58:56.103704, 10, pid=2340366, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1747(fork_domain_child) Child process 2340366 [2025/04/09 06:58:56.104246, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) msg_ctdb_ref_destructor: refs=(nil) [2025/04/09 06:58:56.104304, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) msg_dgm_ref_destructor: refs=0x56144d5eb480 [2025/04/09 06:58:56.104864, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) messaging_dgm_ref: messaging_dgm_init returned Success [2025/04/09 06:58:56.104927, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) messaging_dgm_ref: unique = 7358286915525418268 [2025/04/09 06:58:56.105060, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 06:58:56.105234, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 06:58:56.105404, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=12937543341900013315 [2025/04/09 06:58:56.105569, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2340366 [2025/04/09 06:58:56.105677, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 [2025/04/09 06:58:56.105773, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=7358286915525418268 [2025/04/09 06:58:56.105870, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) vnn pid 2340366 = 1 [2025/04/09 06:58:56.105904, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) messaging_ctdb_ref: messaging_ctdb_init returned Success [2025/04/09 06:58:56.105950, 5, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE [2025/04/09 06:58:56.106071, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 06:58:56.106183, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 06:58:56.106269, 10, pid=2340366, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=13153174298078018425 [2025/04/09 06:58:56.106418, 5, pid=2340366, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:157(make_pdb_method_name) Attempting to find a passdb backend to match tdbsam (tdbsam) [2025/04/09 06:58:56.106456, 5, pid=2340366, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:178(make_pdb_method_name) Found pdb backend tdbsam [2025/04/09 06:58:56.106585, 5, pid=2340366, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:190(make_pdb_method_name) pdb backend tdbsam has a valid init [2025/04/09 06:58:57.783467, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2329712 matches my id: 1:2329712, type=0x40b [2025/04/09 06:58:57.783544, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2329718 [2025/04/09 06:58:57.783584, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! [2025/04/09 06:58:57.795803, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) wb_child_request_orphaned: cleanup orphaned subreq[0x56144d5bd960] [2025/04/09 06:59:01.505438, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2329712 matches my id: 1:2329712, type=0x40b [2025/04/09 06:59:01.505519, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2329769 [2025/04/09 06:59:01.505569, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! [2025/04/09 06:59:01.515612, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:01.515708, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2339863):PING_DC]: NT_STATUS_OK [2025/04/09 06:59:01.515782, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2339863):PING_DC]: delivered response to client [2025/04/09 06:59:01.515846, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 26.781257 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:58:34.734552] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:01.515809] [26.781257] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 06:58:34.734591] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 06:59:01.515705] [26.781114] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 06:58:34.734595] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 06:59:01.515704] [26.781109] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 06:58:34.734597] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 06:59:01.515702] [26.781105] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:58:34.734619] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:01.515698] [26.781079] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:58:34.734673] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:01.515596] [26.780923] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:58:34.734675] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 06:59:01.515592] [26.780917] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 06:58:34.734676] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 06:59:01.515586] [26.780910] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:58:34.734689] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:01.515583] [26.780894] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:58:34.734691] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:58:34.734697] [0.000006] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:58:34.734705] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:01.515555] [26.780850] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:58:34.734706] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:58:34.734743] [0.000037] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:34.734706] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:34.734741] [0.000035] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:58:34.734745] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:01.515549] [26.780804] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:58:34.734750] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:01.515544] [26.780794] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:01.515753] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:01.515781] [0.000028] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:01.515754] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:01.515775] [0.000021] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 06:59:01.516572, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 06:59:01.521898, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 06:59:01.522133, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:01.522162, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2340452)]: request interface version (version = 32) [2025/04/09 06:59:01.522230, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2340452):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:01.522310, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2340452)] Handling async request: GETPWUID [2025/04/09 06:59:01.522349, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2340452)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 06:59:01.522382, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 06:59:01.522457, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 06:59:01.522493, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:59:01.522529, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:59:01.523789, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 06:59:01.523875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:59:01.523903, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 06:59:01.523926, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 06:59:01.523990, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:59:01.524029, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:59:06.347566, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2329712 matches my id: 1:2329712, type=0x40b [2025/04/09 06:59:06.347633, 10, pid=2329712, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2340366 [2025/04/09 06:59:06.347665, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! [2025/04/09 06:59:06.351881, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:06.352037, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2340364):PING_DC]: NT_STATUS_OK [2025/04/09 06:59:06.352123, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340364):PING_DC]: delivered response to client [2025/04/09 06:59:06.352169, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 10.250622 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:58:56.101529] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:06.352151] [10.250622] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 06:58:56.101556] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 06:59:06.352012] [10.250456] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 06:58:56.101559] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 06:59:06.352010] [10.250451] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 06:58:56.101569] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 06:59:06.352008] [10.250439] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:58:56.101575] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:06.351993] [10.250418] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:58:56.101625] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:06.351871] [10.250246] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:58:56.101626] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 06:59:06.351869] [10.250243] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 06:58:56.101627] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 06:59:06.351867] [10.250240] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:58:56.101633] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:06.351861] [10.250228] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:58:56.101634] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:58:56.101647] [0.000013] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:58:56.107623] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:06.351838] [10.244215] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:58:56.107630] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:58:56.107689] [0.000059] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:58:56.107631] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:58:56.107686] [0.000055] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:58:56.107692] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:06.351837] [10.244145] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:58:56.107695] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:06.351825] [10.244130] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:06.352094] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:06.352122] [0.000028] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:06.352096] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:06.352115] [0.000019] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 06:59:06.352808, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:06.410009, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:59:06.410138, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:06.410163, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340460)]: request interface version (version = 32) [2025/04/09 06:59:06.410216, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340460):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:06.410291, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:59:06.410313, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2340460)]: ping [2025/04/09 06:59:06.410363, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340460):PING]: delivered response to client [2025/04/09 06:59:06.410427, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:06.428317, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:59:06.428392, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:06.428417, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340462)]: request interface version (version = 32) [2025/04/09 06:59:06.428458, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340462):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:06.428549, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:06.428573, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340462)]: request interface version (version = 32) [2025/04/09 06:59:06.428612, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340462):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:06.428702, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:59:06.428725, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2340462)]: request misc info [2025/04/09 06:59:06.428764, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340462):INFO]: delivered response to client [2025/04/09 06:59:06.428853, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:59:06.428876, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2340462)]: request netbios name [2025/04/09 06:59:06.428914, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340462):NETBIOS_NAME]: delivered response to client [2025/04/09 06:59:06.429031, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:59:06.429059, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2340462)]: request domain name [2025/04/09 06:59:06.429099, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340462):DOMAIN_NAME]: delivered response to client [2025/04/09 06:59:06.429190, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2340462)] Handling async request: DOMAIN_INFO [2025/04/09 06:59:06.429220, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2340462]: domain_info [ADPROTOCOLX] [2025/04/09 06:59:06.429259, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2340462):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:59:06.429303, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340462):DOMAIN_INFO]: delivered response to client [2025/04/09 06:59:06.429398, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2340462)] Handling async request: PING_DC [2025/04/09 06:59:06.429432, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:06.431729, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:06.431799, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2340462):PING_DC]: NT_STATUS_OK [2025/04/09 06:59:06.431847, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340462):PING_DC]: delivered response to client [2025/04/09 06:59:06.432431, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:07.924029, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:07.924182, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 06:59:07.924206, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:07.924251, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:07.924276, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2340452):GETPWUID]: NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:07.924325, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_HOST_UNREACHABLE. [2025/04/09 06:59:07.924355, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2340452):GETPWUID]: delivered response to client [2025/04/09 06:59:07.924398, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 6.402074 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:59:01.522308] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:07.924382] [6.402074] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 06:59:01.522348] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 06:59:07.924249] [6.401901] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:256 [2025/04/09 06:59:01.522381] ../../source3/winbindd/wb_xids2sids.c:349 [2025/04/09 06:59:07.924181] [6.401800] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 06:59:01.522450] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 06:59:01.522450] [0.000000] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:01.522456] ../../source3/winbindd/wb_xids2sids.c:191 [2025/04/09 06:59:01.523922] [0.001466] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:01.522520] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:01.523873] [0.001353] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:01.522523] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:01.523872] [0.001349] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:01.522526] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:01.523870] [0.001344] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:01.522648] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:01.523785] [0.001137] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:01.522651] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:01.523783] [0.001132] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:01.522652] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:01.523780] [0.001128] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:01.522654] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:01.522658] [0.000004] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:01.522665] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:01.523776] [0.001111] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:01.522667] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:01.522709] [0.000042] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:01.522668] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:01.522707] [0.000039] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:01.522711] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:01.523775] [0.001064] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:01.522712] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:01.523773] [0.001061] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:01.523925] ../../source3/winbindd/wb_xids2sids.c:157 [2025/04/09 06:59:07.924179] [6.400254] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:01.524025] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:07.924178] [6.400153] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:01.524027] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:07.924176] [6.400149] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:01.524028] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:07.924172] [6.400144] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:01.524110] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:07.924007] [6.399897] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:01.524111] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:07.924003] [6.399892] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:01.524112] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:07.923999] [6.399887] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:01.524114] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:01.524117] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:01.524123] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:07.923991] [6.399868] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:01.524124] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:01.524150] [0.000026] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:01.524125] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:01.524148] [0.000023] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:01.524152] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:07.923990] [6.399838] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:01.524153] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:07.923985] [6.399832] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:07.924303] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:07.924354] [0.000051] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:07.924305] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:07.924323] [0.000018] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 06:59:07.928164, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 06:59:13.093059, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:59:13.093261, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:13.093288, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340835)]: request interface version (version = 32) [2025/04/09 06:59:13.093347, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340835):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:13.093471, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:13.093495, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340835)]: request interface version (version = 32) [2025/04/09 06:59:13.093534, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340835):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:13.093629, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:59:13.093654, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2340835)]: request misc info [2025/04/09 06:59:13.093698, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340835):INFO]: delivered response to client [2025/04/09 06:59:13.093787, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:59:13.093811, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2340835)]: request netbios name [2025/04/09 06:59:13.093849, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340835):NETBIOS_NAME]: delivered response to client [2025/04/09 06:59:13.093937, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:59:13.093985, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2340835)]: request domain name [2025/04/09 06:59:13.094028, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340835):DOMAIN_NAME]: delivered response to client [2025/04/09 06:59:13.094196, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2340835)] Handling async request: DOMAIN_INFO [2025/04/09 06:59:13.094225, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2340835]: domain_info [ADPROTOCOLX] [2025/04/09 06:59:13.094254, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2340835):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:59:13.094305, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340835):DOMAIN_INFO]: delivered response to client [2025/04/09 06:59:13.094408, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2340835)] Handling async request: PING_DC [2025/04/09 06:59:13.094459, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:13.097254, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:13.097339, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2340835):PING_DC]: NT_STATUS_OK [2025/04/09 06:59:13.097388, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340835):PING_DC]: delivered response to client [2025/04/09 06:59:13.098014, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:13.100518, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:59:13.100593, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:13.100618, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2340836)]: request interface version (version = 32) [2025/04/09 06:59:13.100667, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2340836):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:13.100745, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2340836)] Handling async request: GETPWUID [2025/04/09 06:59:13.100782, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2340836)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 06:59:13.100806, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 06:59:13.100852, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 06:59:13.100878, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:59:13.100911, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:59:13.102051, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 06:59:13.102148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:59:13.102170, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 06:59:13.102191, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 06:59:13.102209, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:59:13.102231, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:59:15.983501, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 06:59:15.983607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:15.983633, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340866)]: request interface version (version = 32) [2025/04/09 06:59:15.983678, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340866):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:15.983782, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:59:15.983807, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2340866)]: ping [2025/04/09 06:59:15.983852, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340866):PING]: delivered response to client [2025/04/09 06:59:15.984908, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 06:59:16.004127, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 06:59:16.004255, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:16.004286, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340875)]: request interface version (version = 32) [2025/04/09 06:59:16.004357, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340875):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:16.005023, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:16.005055, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2340875)]: request interface version (version = 32) [2025/04/09 06:59:16.005099, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340875):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:16.005222, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:59:16.005248, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2340875)]: request misc info [2025/04/09 06:59:16.005289, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340875):INFO]: delivered response to client [2025/04/09 06:59:16.005382, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:59:16.005406, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2340875)]: request netbios name [2025/04/09 06:59:16.005457, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340875):NETBIOS_NAME]: delivered response to client [2025/04/09 06:59:16.005577, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:59:16.005615, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2340875)]: request domain name [2025/04/09 06:59:16.005660, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340875):DOMAIN_NAME]: delivered response to client [2025/04/09 06:59:16.005784, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2340875)] Handling async request: DOMAIN_INFO [2025/04/09 06:59:16.005809, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2340875]: domain_info [ADPROTOCOLX] [2025/04/09 06:59:16.005846, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2340875):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:59:16.005887, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340875):DOMAIN_INFO]: delivered response to client [2025/04/09 06:59:16.005980, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2340875)] Handling async request: PING_DC [2025/04/09 06:59:16.006039, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:16.008201, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:16.008276, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2340875):PING_DC]: NT_STATUS_OK [2025/04/09 06:59:16.008321, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2340875):PING_DC]: delivered response to client [2025/04/09 06:59:16.008929, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 06:59:19.800165, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 06:59:19.800545, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:59:19.800574, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 06:59:19.800599, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:59:19.800618, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 06:59:19.800642, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:59:20.851861, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:20.851997, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 06:59:20.852026, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:20.852047, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:20.852077, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2340836):GETPWUID]: NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:20.852138, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_HOST_UNREACHABLE. [2025/04/09 06:59:20.852169, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2340836):GETPWUID]: delivered response to client [2025/04/09 06:59:20.852220, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 7.751447 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:59:13.100743] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:20.852190] [7.751447] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 06:59:13.100782] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 06:59:20.852046] [7.751264] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:256 [2025/04/09 06:59:13.100806] ../../source3/winbindd/wb_xids2sids.c:349 [2025/04/09 06:59:20.851996] [7.751190] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 06:59:13.100847] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 06:59:13.100848] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:13.100852] ../../source3/winbindd/wb_xids2sids.c:191 [2025/04/09 06:59:13.102188] [0.001336] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:13.100907] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:13.102147] [0.001240] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:13.100908] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:13.102146] [0.001238] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:13.100909] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:13.102144] [0.001235] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:13.101059] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:13.102047] [0.000988] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:13.101061] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:13.102046] [0.000985] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:13.101061] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:13.102044] [0.000983] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:13.101062] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:13.101065] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:13.101071] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:13.102040] [0.000969] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:13.101072] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:13.101107] [0.000035] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:13.101072] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:13.101105] [0.000033] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:13.101108] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:13.102040] [0.000932] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:13.101108] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:13.102037] [0.000929] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:13.102190] ../../source3/winbindd/wb_xids2sids.c:157 [2025/04/09 06:59:20.851994] [7.749804] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:13.102228] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:20.851993] [7.749765] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:13.102229] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:20.851991] [7.749762] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:13.102230] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:20.851987] [7.749757] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:13.102306] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:20.851849] [7.749543] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:13.102308] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:20.851846] [7.749538] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:13.102308] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:20.851843] [7.749535] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:13.102310] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:13.102312] [0.000002] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:13.102318] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:20.851831] [7.749513] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:13.102318] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:13.102343] [0.000025] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:13.102319] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:13.102341] [0.000022] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:13.102344] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:20.851824] [7.749480] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:13.102345] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:20.851819] [7.749474] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:20.852111] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:20.852168] [0.000057] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:20.852119] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:20.852136] [0.000017] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 06:59:20.856067, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:26.031326, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:59:26.031481, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:26.031511, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341152)]: request interface version (version = 32) [2025/04/09 06:59:26.031587, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341152):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:26.031701, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:26.031727, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341152)]: request interface version (version = 32) [2025/04/09 06:59:26.031768, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341152):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:26.031875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:59:26.031901, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2341152)]: request misc info [2025/04/09 06:59:26.031943, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341152):INFO]: delivered response to client [2025/04/09 06:59:26.032090, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:59:26.032120, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2341152)]: request netbios name [2025/04/09 06:59:26.032163, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341152):NETBIOS_NAME]: delivered response to client [2025/04/09 06:59:26.032259, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:59:26.032284, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2341152)]: request domain name [2025/04/09 06:59:26.032324, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341152):DOMAIN_NAME]: delivered response to client [2025/04/09 06:59:26.032442, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2341152)] Handling async request: DOMAIN_INFO [2025/04/09 06:59:26.032470, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2341152]: domain_info [ADPROTOCOLX] [2025/04/09 06:59:26.032514, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2341152):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:59:26.032581, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341152):DOMAIN_INFO]: delivered response to client [2025/04/09 06:59:26.032722, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2341152)] Handling async request: PING_DC [2025/04/09 06:59:26.032776, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:26.035205, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:26.035275, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2341152):PING_DC]: NT_STATUS_OK [2025/04/09 06:59:26.035327, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341152):PING_DC]: delivered response to client [2025/04/09 06:59:26.036022, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:26.038503, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:59:26.038581, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:26.038608, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2341153)]: request interface version (version = 32) [2025/04/09 06:59:26.038665, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2341153):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:26.038733, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2341153)] Handling async request: GETPWUID [2025/04/09 06:59:26.038760, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2341153)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 06:59:26.038790, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:262(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 06:59:26.038839, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 06:59:26.038866, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:59:26.038891, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:59:26.039761, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 06:59:26.039849, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:163(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 06:59:26.039875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:186(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 06:59:26.039897, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 06:59:26.039918, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 06:59:26.039943, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 06:59:31.009818, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 06:59:31.009970, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:31.010011, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341184)]: request interface version (version = 32) [2025/04/09 06:59:31.010066, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341184):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:31.012393, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:59:31.012481, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2341184)]: ping [2025/04/09 06:59:31.012535, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341184):PING]: delivered response to client [2025/04/09 06:59:31.015628, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 06:59:31.035554, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 06:59:31.035632, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:31.035665, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341197)]: request interface version (version = 32) [2025/04/09 06:59:31.035714, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341197):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:31.038031, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:31.038070, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341197)]: request interface version (version = 32) [2025/04/09 06:59:31.038116, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341197):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:31.038247, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:59:31.038272, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2341197)]: request misc info [2025/04/09 06:59:31.038312, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341197):INFO]: delivered response to client [2025/04/09 06:59:31.038404, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:59:31.038458, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2341197)]: request netbios name [2025/04/09 06:59:31.038501, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341197):NETBIOS_NAME]: delivered response to client [2025/04/09 06:59:31.038605, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:59:31.038637, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2341197)]: request domain name [2025/04/09 06:59:31.038678, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341197):DOMAIN_NAME]: delivered response to client [2025/04/09 06:59:31.042772, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2341197)] Handling async request: DOMAIN_INFO [2025/04/09 06:59:31.042812, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2341197]: domain_info [ADPROTOCOLX] [2025/04/09 06:59:31.042849, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2341197):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:59:31.042911, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341197):DOMAIN_INFO]: delivered response to client [2025/04/09 06:59:31.044056, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2341197)] Handling async request: PING_DC [2025/04/09 06:59:31.044115, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:31.051077, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:31.051145, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2341197):PING_DC]: NT_STATUS_OK [2025/04/09 06:59:31.051196, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341197):PING_DC]: delivered response to client [2025/04/09 06:59:31.052713, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 06:59:34.099860, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:34.100025, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:405(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 06:59:34.100049, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:34.100075, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:34.100104, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2341153):GETPWUID]: NT_STATUS_HOST_UNREACHABLE [2025/04/09 06:59:34.100161, 1, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_HOST_UNREACHABLE. [2025/04/09 06:59:34.100198, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2341153):GETPWUID]: delivered response to client [2025/04/09 06:59:34.100234, 0, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 8.061489 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 06:59:26.038731] ../../source3/winbindd/winbindd.c:619 [2025/04/09 06:59:34.100220] [8.061489] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 06:59:26.038759] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 06:59:34.100069] [8.061310] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:256 [2025/04/09 06:59:26.038790] ../../source3/winbindd/wb_xids2sids.c:349 [2025/04/09 06:59:34.100017] [8.061227] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 06:59:26.038833] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 06:59:26.038834] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:26.038838] ../../source3/winbindd/wb_xids2sids.c:191 [2025/04/09 06:59:26.039894] [0.001056] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:26.038887] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:26.039848] [0.000961] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:26.038888] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:26.039847] [0.000959] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:26.038890] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:26.039845] [0.000955] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:26.039017] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:26.039756] [0.000739] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:26.039019] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:26.039754] [0.000735] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:26.039019] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:26.039728] [0.000709] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:26.039020] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:26.039023] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:26.039030] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:26.039724] [0.000694] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:26.039030] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:26.039064] [0.000034] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:26.039031] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:26.039062] [0.000031] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:26.039065] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:26.039723] [0.000658] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:26.039065] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:26.039721] [0.000656] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 06:59:26.039897] ../../source3/winbindd/wb_xids2sids.c:157 [2025/04/09 06:59:34.100016] [8.060119] -> TEVENT_REQ_USER_ERROR (3 10483072397370982973)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 06:59:26.039939] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 06:59:34.100011] [8.060072] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 06:59:26.039940] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 06:59:34.100006] [8.060066] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 06:59:26.039941] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 06:59:34.099995] [8.060054] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 06:59:26.040102] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 06:59:34.099836] [8.059734] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 06:59:26.040104] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 06:59:34.099830] [8.059726] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 06:59:26.040104] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 06:59:34.099822] [8.059718] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 06:59:26.040105] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 06:59:26.040109] [0.000004] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 06:59:26.040114] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 06:59:34.099815] [8.059701] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 06:59:26.040115] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 06:59:26.040147] [0.000032] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:26.040116] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:26.040145] [0.000029] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 06:59:26.040149] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 06:59:34.099809] [8.059660] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 06:59:26.040150] ../../lib/async_req/async_sock.c:568 [2025/04/09 06:59:34.099805] [8.059655] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 06:59:34.100143] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 06:59:34.100197] [0.000054] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 06:59:34.100145] ../../lib/async_req/async_sock.c:373 [2025/04/09 06:59:34.100159] [0.000014] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 06:59:34.105376, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:49.375563, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:59:49.375729, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:49.375768, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341583)]: request interface version (version = 32) [2025/04/09 06:59:49.375840, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341583):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:49.375928, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 06:59:49.375974, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2341583)]: ping [2025/04/09 06:59:49.376038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341583):PING]: delivered response to client [2025/04/09 06:59:49.376112, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:49.395122, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 06:59:49.395199, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:49.395225, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341585)]: request interface version (version = 32) [2025/04/09 06:59:49.395268, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341585):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:49.395364, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 06:59:49.395388, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341585)]: request interface version (version = 32) [2025/04/09 06:59:49.395427, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341585):INTERFACE_VERSION]: delivered response to client [2025/04/09 06:59:49.395528, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 06:59:49.395552, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2341585)]: request misc info [2025/04/09 06:59:49.395591, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341585):INFO]: delivered response to client [2025/04/09 06:59:49.395682, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 06:59:49.395713, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2341585)]: request netbios name [2025/04/09 06:59:49.395765, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341585):NETBIOS_NAME]: delivered response to client [2025/04/09 06:59:49.395859, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 06:59:49.395882, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2341585)]: request domain name [2025/04/09 06:59:49.395921, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341585):DOMAIN_NAME]: delivered response to client [2025/04/09 06:59:49.396040, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2341585)] Handling async request: DOMAIN_INFO [2025/04/09 06:59:49.396083, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2341585]: domain_info [ADPROTOCOLX] [2025/04/09 06:59:49.396131, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2341585):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 06:59:49.396184, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341585):DOMAIN_INFO]: delivered response to client [2025/04/09 06:59:49.396289, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2341585)] Handling async request: PING_DC [2025/04/09 06:59:49.396356, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:49.399019, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:49.399109, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2341585):PING_DC]: NT_STATUS_OK [2025/04/09 06:59:49.399161, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341585):PING_DC]: delivered response to client [2025/04/09 06:59:49.399771, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 06:59:49.801286, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 06:59:49.801379, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:59:49.801409, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 06:59:49.801433, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:59:49.801451, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 06:59:49.801473, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:00:01.022014, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:00:01.022173, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:01.022209, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341832)]: request interface version (version = 32) [2025/04/09 07:00:01.022271, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341832):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:01.026073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:00:01.026115, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2341832)]: ping [2025/04/09 07:00:01.026163, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341832):PING]: delivered response to client [2025/04/09 07:00:01.028985, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:00:01.048681, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:00:01.048786, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:01.048812, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341839)]: request interface version (version = 32) [2025/04/09 07:00:01.048858, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341839):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:01.049029, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:01.049064, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2341839)]: request interface version (version = 32) [2025/04/09 07:00:01.049106, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341839):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:01.049200, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:00:01.049225, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2341839)]: request misc info [2025/04/09 07:00:01.049264, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341839):INFO]: delivered response to client [2025/04/09 07:00:01.049357, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:00:01.049381, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2341839)]: request netbios name [2025/04/09 07:00:01.049435, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341839):NETBIOS_NAME]: delivered response to client [2025/04/09 07:00:01.049541, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:00:01.049565, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2341839)]: request domain name [2025/04/09 07:00:01.049604, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341839):DOMAIN_NAME]: delivered response to client [2025/04/09 07:00:01.049708, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2341839)] Handling async request: DOMAIN_INFO [2025/04/09 07:00:01.049746, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2341839]: domain_info [ADPROTOCOLX] [2025/04/09 07:00:01.049777, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2341839):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:00:01.049836, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341839):DOMAIN_INFO]: delivered response to client [2025/04/09 07:00:01.049950, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2341839)] Handling async request: PING_DC [2025/04/09 07:00:01.050027, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:00:01.052661, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:00:01.052727, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2341839):PING_DC]: NT_STATUS_OK [2025/04/09 07:00:01.052772, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2341839):PING_DC]: delivered response to client [2025/04/09 07:00:01.054158, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:00:15.996604, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:00:15.997591, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:15.997641, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342286)]: request interface version (version = 32) [2025/04/09 07:00:15.997694, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342286):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:15.997828, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:00:15.997861, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2342286)]: ping [2025/04/09 07:00:15.997905, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342286):PING]: delivered response to client [2025/04/09 07:00:16.009380, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:00:16.018818, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:00:16.018902, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:16.018929, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342296)]: request interface version (version = 32) [2025/04/09 07:00:16.019017, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342296):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:16.019543, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:16.019573, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342296)]: request interface version (version = 32) [2025/04/09 07:00:16.019619, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342296):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:16.019722, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:00:16.019748, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2342296)]: request misc info [2025/04/09 07:00:16.019805, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342296):INFO]: delivered response to client [2025/04/09 07:00:16.019947, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:00:16.019995, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2342296)]: request netbios name [2025/04/09 07:00:16.020044, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342296):NETBIOS_NAME]: delivered response to client [2025/04/09 07:00:16.020143, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:00:16.020295, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2342296)]: request domain name [2025/04/09 07:00:16.020349, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342296):DOMAIN_NAME]: delivered response to client [2025/04/09 07:00:16.020774, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2342296)] Handling async request: DOMAIN_INFO [2025/04/09 07:00:16.020805, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2342296]: domain_info [ADPROTOCOLX] [2025/04/09 07:00:16.020839, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2342296):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:00:16.020900, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342296):DOMAIN_INFO]: delivered response to client [2025/04/09 07:00:16.021027, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2342296)] Handling async request: PING_DC [2025/04/09 07:00:16.021098, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:00:16.024499, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:00:16.024583, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2342296):PING_DC]: NT_STATUS_OK [2025/04/09 07:00:16.024635, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342296):PING_DC]: delivered response to client [2025/04/09 07:00:16.025825, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:00:19.805832, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:00:19.806070, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:00:19.806108, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:00:19.806134, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:00:19.806159, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:00:19.806191, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:00:30.984982, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:00:30.985180, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:30.985207, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342572)]: request interface version (version = 32) [2025/04/09 07:00:30.985266, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342572):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:30.986492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:00:30.986523, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2342572)]: ping [2025/04/09 07:00:30.986569, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342572):PING]: delivered response to client [2025/04/09 07:00:30.991348, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:00:31.040540, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:00:31.041260, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:31.041299, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342592)]: request interface version (version = 32) [2025/04/09 07:00:31.041346, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342592):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:31.041466, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:31.041495, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342592)]: request interface version (version = 32) [2025/04/09 07:00:31.041535, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342592):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:31.041626, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:00:31.041658, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2342592)]: request misc info [2025/04/09 07:00:31.041696, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342592):INFO]: delivered response to client [2025/04/09 07:00:31.041791, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:00:31.041821, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2342592)]: request netbios name [2025/04/09 07:00:31.041870, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342592):NETBIOS_NAME]: delivered response to client [2025/04/09 07:00:31.041976, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:00:31.042005, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2342592)]: request domain name [2025/04/09 07:00:31.042044, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342592):DOMAIN_NAME]: delivered response to client [2025/04/09 07:00:31.042134, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2342592)] Handling async request: DOMAIN_INFO [2025/04/09 07:00:31.042164, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2342592]: domain_info [ADPROTOCOLX] [2025/04/09 07:00:31.042210, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2342592):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:00:31.042255, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342592):DOMAIN_INFO]: delivered response to client [2025/04/09 07:00:31.042354, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2342592)] Handling async request: PING_DC [2025/04/09 07:00:31.042403, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:00:31.045506, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:00:31.045586, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2342592):PING_DC]: NT_STATUS_OK [2025/04/09 07:00:31.045633, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342592):PING_DC]: delivered response to client [2025/04/09 07:00:31.047367, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:00:45.999434, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:00:45.999632, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:45.999659, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342887)]: request interface version (version = 32) [2025/04/09 07:00:45.999742, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342887):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:45.999864, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:00:45.999888, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2342887)]: ping [2025/04/09 07:00:45.999926, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342887):PING]: delivered response to client [2025/04/09 07:00:46.002060, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:00:46.018883, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:00:46.018988, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:46.019018, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342900)]: request interface version (version = 32) [2025/04/09 07:00:46.019061, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342900):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:46.019154, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:00:46.019179, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2342900)]: request interface version (version = 32) [2025/04/09 07:00:46.019217, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342900):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:00:46.019307, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:00:46.019330, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2342900)]: request misc info [2025/04/09 07:00:46.019385, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342900):INFO]: delivered response to client [2025/04/09 07:00:46.019483, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:00:46.019507, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2342900)]: request netbios name [2025/04/09 07:00:46.019549, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342900):NETBIOS_NAME]: delivered response to client [2025/04/09 07:00:46.019643, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:00:46.019666, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2342900)]: request domain name [2025/04/09 07:00:46.019716, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342900):DOMAIN_NAME]: delivered response to client [2025/04/09 07:00:46.019806, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2342900)] Handling async request: DOMAIN_INFO [2025/04/09 07:00:46.019831, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2342900]: domain_info [ADPROTOCOLX] [2025/04/09 07:00:46.019883, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2342900):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:00:46.019927, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342900):DOMAIN_INFO]: delivered response to client [2025/04/09 07:00:46.020036, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2342900)] Handling async request: PING_DC [2025/04/09 07:00:46.020084, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:00:46.025844, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:00:46.025931, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2342900):PING_DC]: NT_STATUS_OK [2025/04/09 07:00:46.025994, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2342900):PING_DC]: delivered response to client [2025/04/09 07:00:46.027518, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:00:49.809792, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:00:49.809970, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:00:49.810010, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:00:49.810036, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:00:49.810055, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:00:49.810098, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:01:01.008376, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:01:01.008510, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:01.008549, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343188)]: request interface version (version = 32) [2025/04/09 07:01:01.008614, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343188):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:01.011049, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:01:01.011082, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2343188)]: ping [2025/04/09 07:01:01.011136, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343188):PING]: delivered response to client [2025/04/09 07:01:01.016894, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:01:01.038880, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:01:01.039038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:01.039081, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343200)]: request interface version (version = 32) [2025/04/09 07:01:01.039145, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343200):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:01.040095, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:01.040127, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343200)]: request interface version (version = 32) [2025/04/09 07:01:01.040175, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343200):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:01.042940, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:01:01.043008, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2343200)]: request misc info [2025/04/09 07:01:01.043072, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343200):INFO]: delivered response to client [2025/04/09 07:01:01.043688, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:01:01.043715, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2343200)]: request netbios name [2025/04/09 07:01:01.043757, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343200):NETBIOS_NAME]: delivered response to client [2025/04/09 07:01:01.043896, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:01:01.043921, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2343200)]: request domain name [2025/04/09 07:01:01.043997, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343200):DOMAIN_NAME]: delivered response to client [2025/04/09 07:01:01.044110, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2343200)] Handling async request: DOMAIN_INFO [2025/04/09 07:01:01.044137, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2343200]: domain_info [ADPROTOCOLX] [2025/04/09 07:01:01.044178, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2343200):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:01:01.044233, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343200):DOMAIN_INFO]: delivered response to client [2025/04/09 07:01:01.044376, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2343200)] Handling async request: PING_DC [2025/04/09 07:01:01.044444, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:01:01.049524, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:01:01.049598, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2343200):PING_DC]: NT_STATUS_OK [2025/04/09 07:01:01.049648, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343200):PING_DC]: delivered response to client [2025/04/09 07:01:01.052817, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:01:16.019160, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:01:16.020314, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:16.020348, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343581)]: request interface version (version = 32) [2025/04/09 07:01:16.020412, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343581):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:16.020511, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:01:16.020535, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2343581)]: ping [2025/04/09 07:01:16.020573, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343581):PING]: delivered response to client [2025/04/09 07:01:16.021825, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:01:16.055665, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:01:16.055752, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:16.055776, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343593)]: request interface version (version = 32) [2025/04/09 07:01:16.055822, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343593):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:16.056984, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:16.057016, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343593)]: request interface version (version = 32) [2025/04/09 07:01:16.057072, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343593):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:16.057564, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:01:16.057591, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2343593)]: request misc info [2025/04/09 07:01:16.057638, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343593):INFO]: delivered response to client [2025/04/09 07:01:16.059743, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:01:16.059780, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2343593)]: request netbios name [2025/04/09 07:01:16.059835, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343593):NETBIOS_NAME]: delivered response to client [2025/04/09 07:01:16.061442, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:01:16.061474, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2343593)]: request domain name [2025/04/09 07:01:16.061522, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343593):DOMAIN_NAME]: delivered response to client [2025/04/09 07:01:16.064142, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2343593)] Handling async request: DOMAIN_INFO [2025/04/09 07:01:16.064208, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2343593]: domain_info [ADPROTOCOLX] [2025/04/09 07:01:16.064257, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2343593):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:01:16.064310, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343593):DOMAIN_INFO]: delivered response to client [2025/04/09 07:01:16.066370, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2343593)] Handling async request: PING_DC [2025/04/09 07:01:16.066478, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:01:16.069055, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:01:16.069134, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2343593):PING_DC]: NT_STATUS_OK [2025/04/09 07:01:16.069196, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343593):PING_DC]: delivered response to client [2025/04/09 07:01:16.070506, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:01:19.812649, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:01:19.813050, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:01:19.813096, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:01:19.813143, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:01:19.813163, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:01:19.813185, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:01:31.027064, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:01:31.027243, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:31.027271, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343793)]: request interface version (version = 32) [2025/04/09 07:01:31.027327, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343793):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:31.033580, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:01:31.033623, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2343793)]: ping [2025/04/09 07:01:31.033671, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343793):PING]: delivered response to client [2025/04/09 07:01:31.037187, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:01:31.060501, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:01:31.060600, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:31.060625, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343804)]: request interface version (version = 32) [2025/04/09 07:01:31.060669, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343804):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:31.060768, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:31.060792, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2343804)]: request interface version (version = 32) [2025/04/09 07:01:31.060835, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343804):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:31.060932, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:01:31.061003, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2343804)]: request misc info [2025/04/09 07:01:31.061070, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343804):INFO]: delivered response to client [2025/04/09 07:01:31.061165, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:01:31.061189, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2343804)]: request netbios name [2025/04/09 07:01:31.061238, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343804):NETBIOS_NAME]: delivered response to client [2025/04/09 07:01:31.061326, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:01:31.061350, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2343804)]: request domain name [2025/04/09 07:01:31.061387, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343804):DOMAIN_NAME]: delivered response to client [2025/04/09 07:01:31.061486, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2343804)] Handling async request: DOMAIN_INFO [2025/04/09 07:01:31.061512, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2343804]: domain_info [ADPROTOCOLX] [2025/04/09 07:01:31.061557, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2343804):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:01:31.061616, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343804):DOMAIN_INFO]: delivered response to client [2025/04/09 07:01:31.061727, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2343804)] Handling async request: PING_DC [2025/04/09 07:01:31.061788, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:01:31.081269, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:01:31.081351, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2343804):PING_DC]: NT_STATUS_OK [2025/04/09 07:01:31.081400, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2343804):PING_DC]: delivered response to client [2025/04/09 07:01:31.082799, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:01:46.000431, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:01:46.000652, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:46.000694, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2344092)]: request interface version (version = 32) [2025/04/09 07:01:46.000743, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344092):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:46.000861, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:01:46.000886, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2344092)]: ping [2025/04/09 07:01:46.000932, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344092):PING]: delivered response to client [2025/04/09 07:01:46.002072, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:01:46.021041, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:01:46.021886, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:46.021920, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2344098)]: request interface version (version = 32) [2025/04/09 07:01:46.022021, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344098):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:46.022121, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:01:46.022146, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2344098)]: request interface version (version = 32) [2025/04/09 07:01:46.022185, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344098):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:01:46.022274, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:01:46.022298, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2344098)]: request misc info [2025/04/09 07:01:46.022336, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344098):INFO]: delivered response to client [2025/04/09 07:01:46.022430, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:01:46.022453, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2344098)]: request netbios name [2025/04/09 07:01:46.022498, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344098):NETBIOS_NAME]: delivered response to client [2025/04/09 07:01:46.022585, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:01:46.022608, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2344098)]: request domain name [2025/04/09 07:01:46.022646, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344098):DOMAIN_NAME]: delivered response to client [2025/04/09 07:01:46.022770, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2344098)] Handling async request: DOMAIN_INFO [2025/04/09 07:01:46.022796, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2344098]: domain_info [ADPROTOCOLX] [2025/04/09 07:01:46.022826, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2344098):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:01:46.022878, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344098):DOMAIN_INFO]: delivered response to client [2025/04/09 07:01:46.022991, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2344098)] Handling async request: PING_DC [2025/04/09 07:01:46.023044, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:01:46.025887, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:01:46.025986, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2344098):PING_DC]: NT_STATUS_OK [2025/04/09 07:01:46.026038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344098):PING_DC]: delivered response to client [2025/04/09 07:01:46.029272, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:01:49.817251, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:01:49.817439, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:01:49.817471, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:01:49.817494, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:01:49.817512, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:01:49.817542, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:02:00.993848, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:02:00.994076, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:00.994108, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2344382)]: request interface version (version = 32) [2025/04/09 07:02:00.994178, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344382):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:00.994944, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:02:00.994988, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2344382)]: ping [2025/04/09 07:02:00.995032, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344382):PING]: delivered response to client [2025/04/09 07:02:00.996256, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:02:01.033511, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:02:01.033615, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:01.033640, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2344392)]: request interface version (version = 32) [2025/04/09 07:02:01.033685, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344392):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:01.033942, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:01.034022, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2344392)]: request interface version (version = 32) [2025/04/09 07:02:01.034072, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344392):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:01.034164, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:02:01.034187, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2344392)]: request misc info [2025/04/09 07:02:01.034235, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344392):INFO]: delivered response to client [2025/04/09 07:02:01.034340, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:02:01.034368, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2344392)]: request netbios name [2025/04/09 07:02:01.034414, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344392):NETBIOS_NAME]: delivered response to client [2025/04/09 07:02:01.034511, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:02:01.034534, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2344392)]: request domain name [2025/04/09 07:02:01.034571, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344392):DOMAIN_NAME]: delivered response to client [2025/04/09 07:02:01.034659, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2344392)] Handling async request: DOMAIN_INFO [2025/04/09 07:02:01.034684, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2344392]: domain_info [ADPROTOCOLX] [2025/04/09 07:02:01.034738, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2344392):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:02:01.034782, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344392):DOMAIN_INFO]: delivered response to client [2025/04/09 07:02:01.034875, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2344392)] Handling async request: PING_DC [2025/04/09 07:02:01.034945, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:02:01.045531, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:02:01.045628, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2344392):PING_DC]: NT_STATUS_OK [2025/04/09 07:02:01.045683, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2344392):PING_DC]: delivered response to client [2025/04/09 07:02:01.047061, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:02:19.403105, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:02:19.403299, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:19.403344, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345131)]: request interface version (version = 32) [2025/04/09 07:02:19.403411, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345131):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:19.403544, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:02:19.403570, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2345131)]: ping [2025/04/09 07:02:19.403612, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345131):PING]: delivered response to client [2025/04/09 07:02:19.404275, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:02:19.422169, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:02:19.422254, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:19.422279, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345133)]: request interface version (version = 32) [2025/04/09 07:02:19.422327, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345133):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:19.422426, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:19.422455, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345133)]: request interface version (version = 32) [2025/04/09 07:02:19.422492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345133):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:19.422589, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:02:19.422612, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2345133)]: request misc info [2025/04/09 07:02:19.422662, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345133):INFO]: delivered response to client [2025/04/09 07:02:19.422751, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:02:19.422775, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2345133)]: request netbios name [2025/04/09 07:02:19.422813, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345133):NETBIOS_NAME]: delivered response to client [2025/04/09 07:02:19.422901, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:02:19.422924, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2345133)]: request domain name [2025/04/09 07:02:19.422978, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345133):DOMAIN_NAME]: delivered response to client [2025/04/09 07:02:19.423074, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2345133)] Handling async request: DOMAIN_INFO [2025/04/09 07:02:19.423100, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2345133]: domain_info [ADPROTOCOLX] [2025/04/09 07:02:19.423143, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2345133):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:02:19.423195, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345133):DOMAIN_INFO]: delivered response to client [2025/04/09 07:02:19.423310, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2345133)] Handling async request: PING_DC [2025/04/09 07:02:19.423362, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:02:19.426015, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:02:19.426096, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2345133):PING_DC]: NT_STATUS_OK [2025/04/09 07:02:19.426145, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345133):PING_DC]: delivered response to client [2025/04/09 07:02:19.426778, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:02:19.818313, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:02:19.818421, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:02:19.818445, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:02:19.818474, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:02:19.818492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:02:19.818514, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:02:31.012970, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:02:31.013132, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:31.013165, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345184)]: request interface version (version = 32) [2025/04/09 07:02:31.013234, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345184):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:31.013342, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:02:31.013366, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2345184)]: ping [2025/04/09 07:02:31.013411, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345184):PING]: delivered response to client [2025/04/09 07:02:31.017261, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:02:31.047502, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:02:31.047620, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:31.047647, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345196)]: request interface version (version = 32) [2025/04/09 07:02:31.047703, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345196):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:31.054113, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:31.054148, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345196)]: request interface version (version = 32) [2025/04/09 07:02:31.054197, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345196):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:31.057071, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:02:31.057110, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2345196)]: request misc info [2025/04/09 07:02:31.057161, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345196):INFO]: delivered response to client [2025/04/09 07:02:31.058383, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:02:31.058437, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2345196)]: request netbios name [2025/04/09 07:02:31.058487, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345196):NETBIOS_NAME]: delivered response to client [2025/04/09 07:02:31.058585, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:02:31.058609, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2345196)]: request domain name [2025/04/09 07:02:31.058649, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345196):DOMAIN_NAME]: delivered response to client [2025/04/09 07:02:31.058742, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2345196)] Handling async request: DOMAIN_INFO [2025/04/09 07:02:31.058775, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2345196]: domain_info [ADPROTOCOLX] [2025/04/09 07:02:31.058825, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2345196):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:02:31.058871, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345196):DOMAIN_INFO]: delivered response to client [2025/04/09 07:02:31.059011, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2345196)] Handling async request: PING_DC [2025/04/09 07:02:31.059105, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:02:31.061833, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:02:31.061922, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2345196):PING_DC]: NT_STATUS_OK [2025/04/09 07:02:31.061990, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345196):PING_DC]: delivered response to client [2025/04/09 07:02:31.064268, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:02:46.004485, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:02:46.009358, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:46.009392, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345498)]: request interface version (version = 32) [2025/04/09 07:02:46.009448, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345498):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:46.009560, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:02:46.009585, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2345498)]: ping [2025/04/09 07:02:46.009625, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345498):PING]: delivered response to client [2025/04/09 07:02:46.010853, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:02:46.037081, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:02:46.037196, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:46.037232, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345509)]: request interface version (version = 32) [2025/04/09 07:02:46.037280, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345509):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:46.039721, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:02:46.039757, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345509)]: request interface version (version = 32) [2025/04/09 07:02:46.039807, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345509):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:02:46.040026, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:02:46.040056, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2345509)]: request misc info [2025/04/09 07:02:46.040099, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345509):INFO]: delivered response to client [2025/04/09 07:02:46.040203, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:02:46.040231, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2345509)]: request netbios name [2025/04/09 07:02:46.040289, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345509):NETBIOS_NAME]: delivered response to client [2025/04/09 07:02:46.040707, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:02:46.040733, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2345509)]: request domain name [2025/04/09 07:02:46.040773, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345509):DOMAIN_NAME]: delivered response to client [2025/04/09 07:02:46.040865, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2345509)] Handling async request: DOMAIN_INFO [2025/04/09 07:02:46.040891, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2345509]: domain_info [ADPROTOCOLX] [2025/04/09 07:02:46.040921, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2345509):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:02:46.041005, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345509):DOMAIN_INFO]: delivered response to client [2025/04/09 07:02:46.041111, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2345509)] Handling async request: PING_DC [2025/04/09 07:02:46.041154, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:02:46.043486, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:02:46.043562, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2345509):PING_DC]: NT_STATUS_OK [2025/04/09 07:02:46.043607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345509):PING_DC]: delivered response to client [2025/04/09 07:02:46.044360, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:02:49.819160, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:02:49.819276, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:02:49.819310, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:02:49.819335, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:02:49.819353, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:02:49.819376, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:03:01.019135, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:03:01.019369, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:01.019405, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345797)]: request interface version (version = 32) [2025/04/09 07:03:01.019462, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345797):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:01.019676, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:03:01.019703, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2345797)]: ping [2025/04/09 07:03:01.019745, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345797):PING]: delivered response to client [2025/04/09 07:03:01.020949, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:03:01.063597, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:03:01.063759, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:01.063799, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345810)]: request interface version (version = 32) [2025/04/09 07:03:01.063845, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345810):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:01.064001, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:01.064031, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2345810)]: request interface version (version = 32) [2025/04/09 07:03:01.064073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345810):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:01.064184, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:03:01.064209, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2345810)]: request misc info [2025/04/09 07:03:01.064275, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345810):INFO]: delivered response to client [2025/04/09 07:03:01.064399, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:03:01.064437, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2345810)]: request netbios name [2025/04/09 07:03:01.064478, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345810):NETBIOS_NAME]: delivered response to client [2025/04/09 07:03:01.064595, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:03:01.064618, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2345810)]: request domain name [2025/04/09 07:03:01.064656, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345810):DOMAIN_NAME]: delivered response to client [2025/04/09 07:03:01.064753, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2345810)] Handling async request: DOMAIN_INFO [2025/04/09 07:03:01.064778, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2345810]: domain_info [ADPROTOCOLX] [2025/04/09 07:03:01.064808, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2345810):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:03:01.064865, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345810):DOMAIN_INFO]: delivered response to client [2025/04/09 07:03:01.064991, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2345810)] Handling async request: PING_DC [2025/04/09 07:03:01.065053, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:03:01.067566, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:03:01.067638, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2345810):PING_DC]: NT_STATUS_OK [2025/04/09 07:03:01.067691, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2345810):PING_DC]: delivered response to client [2025/04/09 07:03:01.070723, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:03:16.023170, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:03:16.023332, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:16.023359, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346115)]: request interface version (version = 32) [2025/04/09 07:03:16.023420, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346115):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:16.025455, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:03:16.025488, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2346115)]: ping [2025/04/09 07:03:16.025555, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346115):PING]: delivered response to client [2025/04/09 07:03:16.027004, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:03:16.045299, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:03:16.045771, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:16.045836, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346125)]: request interface version (version = 32) [2025/04/09 07:03:16.045901, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346125):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:16.047331, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:16.047376, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346125)]: request interface version (version = 32) [2025/04/09 07:03:16.047433, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346125):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:16.047530, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:03:16.047555, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2346125)]: request misc info [2025/04/09 07:03:16.047595, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346125):INFO]: delivered response to client [2025/04/09 07:03:16.047688, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:03:16.047713, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2346125)]: request netbios name [2025/04/09 07:03:16.047764, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346125):NETBIOS_NAME]: delivered response to client [2025/04/09 07:03:16.047858, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:03:16.047882, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2346125)]: request domain name [2025/04/09 07:03:16.047928, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346125):DOMAIN_NAME]: delivered response to client [2025/04/09 07:03:16.048036, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2346125)] Handling async request: DOMAIN_INFO [2025/04/09 07:03:16.048075, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2346125]: domain_info [ADPROTOCOLX] [2025/04/09 07:03:16.048126, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2346125):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:03:16.048172, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346125):DOMAIN_INFO]: delivered response to client [2025/04/09 07:03:16.048305, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2346125)] Handling async request: PING_DC [2025/04/09 07:03:16.048345, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:03:16.050857, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:03:16.050936, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2346125):PING_DC]: NT_STATUS_OK [2025/04/09 07:03:16.051013, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346125):PING_DC]: delivered response to client [2025/04/09 07:03:16.052242, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:03:19.824201, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:03:19.824571, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:03:19.824606, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:03:19.824638, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:03:19.824657, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:03:19.824680, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:03:31.036343, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:03:31.036588, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:31.036625, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346558)]: request interface version (version = 32) [2025/04/09 07:03:31.036688, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346558):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:31.039635, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:03:31.039669, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2346558)]: ping [2025/04/09 07:03:31.039719, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346558):PING]: delivered response to client [2025/04/09 07:03:31.047634, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:03:31.073228, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:03:31.073341, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:31.073368, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346571)]: request interface version (version = 32) [2025/04/09 07:03:31.073421, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346571):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:31.083751, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:31.083788, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346571)]: request interface version (version = 32) [2025/04/09 07:03:31.083837, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346571):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:31.087407, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:03:31.087454, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2346571)]: request misc info [2025/04/09 07:03:31.087537, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346571):INFO]: delivered response to client [2025/04/09 07:03:31.088631, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:03:31.088679, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2346571)]: request netbios name [2025/04/09 07:03:31.088727, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346571):NETBIOS_NAME]: delivered response to client [2025/04/09 07:03:31.089224, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:03:31.089256, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2346571)]: request domain name [2025/04/09 07:03:31.089302, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346571):DOMAIN_NAME]: delivered response to client [2025/04/09 07:03:31.089403, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2346571)] Handling async request: DOMAIN_INFO [2025/04/09 07:03:31.089443, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2346571]: domain_info [ADPROTOCOLX] [2025/04/09 07:03:31.089522, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2346571):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:03:31.089583, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346571):DOMAIN_INFO]: delivered response to client [2025/04/09 07:03:31.089705, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2346571)] Handling async request: PING_DC [2025/04/09 07:03:31.089765, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:03:31.095900, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:03:31.096034, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2346571):PING_DC]: NT_STATUS_OK [2025/04/09 07:03:31.096089, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346571):PING_DC]: delivered response to client [2025/04/09 07:03:31.098284, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:03:46.039282, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:03:46.039443, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:46.039482, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346870)]: request interface version (version = 32) [2025/04/09 07:03:46.039543, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346870):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:46.040172, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:03:46.040203, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2346870)]: ping [2025/04/09 07:03:46.040245, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346870):PING]: delivered response to client [2025/04/09 07:03:46.041572, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:03:46.062044, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:03:46.062148, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:46.062180, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346881)]: request interface version (version = 32) [2025/04/09 07:03:46.062224, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346881):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:46.062319, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:03:46.062343, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2346881)]: request interface version (version = 32) [2025/04/09 07:03:46.062381, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346881):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:03:46.062527, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:03:46.062551, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2346881)]: request misc info [2025/04/09 07:03:46.062598, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346881):INFO]: delivered response to client [2025/04/09 07:03:46.062715, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:03:46.062758, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2346881)]: request netbios name [2025/04/09 07:03:46.062808, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346881):NETBIOS_NAME]: delivered response to client [2025/04/09 07:03:46.062922, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:03:46.062947, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2346881)]: request domain name [2025/04/09 07:03:46.063035, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346881):DOMAIN_NAME]: delivered response to client [2025/04/09 07:03:46.063150, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2346881)] Handling async request: DOMAIN_INFO [2025/04/09 07:03:46.063183, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2346881]: domain_info [ADPROTOCOLX] [2025/04/09 07:03:46.063233, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2346881):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:03:46.063302, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346881):DOMAIN_INFO]: delivered response to client [2025/04/09 07:03:46.063424, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2346881)] Handling async request: PING_DC [2025/04/09 07:03:46.063494, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:03:46.068141, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:03:46.068217, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2346881):PING_DC]: NT_STATUS_OK [2025/04/09 07:03:46.068266, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2346881):PING_DC]: delivered response to client [2025/04/09 07:03:46.069874, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:03:49.828775, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:03:49.829014, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:03:49.829053, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:03:49.829080, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:03:49.829098, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:03:49.829121, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:04:01.036649, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:04:01.036783, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:01.036820, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347163)]: request interface version (version = 32) [2025/04/09 07:04:01.036883, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347163):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:01.037137, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:04:01.037183, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2347163)]: ping [2025/04/09 07:04:01.037226, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347163):PING]: delivered response to client [2025/04/09 07:04:01.042439, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:04:01.077092, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:04:01.077201, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:01.077227, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347181)]: request interface version (version = 32) [2025/04/09 07:04:01.077274, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347181):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:01.077993, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:01.078028, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347181)]: request interface version (version = 32) [2025/04/09 07:04:01.078077, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347181):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:01.078175, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:04:01.078199, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2347181)]: request misc info [2025/04/09 07:04:01.078239, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347181):INFO]: delivered response to client [2025/04/09 07:04:01.078330, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:04:01.078362, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2347181)]: request netbios name [2025/04/09 07:04:01.078412, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347181):NETBIOS_NAME]: delivered response to client [2025/04/09 07:04:01.078512, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:04:01.078542, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2347181)]: request domain name [2025/04/09 07:04:01.078581, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347181):DOMAIN_NAME]: delivered response to client [2025/04/09 07:04:01.079803, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2347181)] Handling async request: DOMAIN_INFO [2025/04/09 07:04:01.079842, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2347181]: domain_info [ADPROTOCOLX] [2025/04/09 07:04:01.079874, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2347181):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:04:01.079969, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347181):DOMAIN_INFO]: delivered response to client [2025/04/09 07:04:01.081620, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2347181)] Handling async request: PING_DC [2025/04/09 07:04:01.081695, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:04:01.084297, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:04:01.084361, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2347181):PING_DC]: NT_STATUS_OK [2025/04/09 07:04:01.084408, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347181):PING_DC]: delivered response to client [2025/04/09 07:04:01.088890, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:04:16.039820, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:04:16.040039, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:16.040077, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347480)]: request interface version (version = 32) [2025/04/09 07:04:16.040135, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347480):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:16.040288, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:04:16.040314, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2347480)]: ping [2025/04/09 07:04:16.040354, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347480):PING]: delivered response to client [2025/04/09 07:04:16.041584, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:04:16.060626, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:04:16.060704, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:16.060731, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347490)]: request interface version (version = 32) [2025/04/09 07:04:16.060775, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347490):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:16.060871, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:16.060897, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347490)]: request interface version (version = 32) [2025/04/09 07:04:16.060939, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347490):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:16.062108, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:04:16.062138, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2347490)]: request misc info [2025/04/09 07:04:16.062212, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347490):INFO]: delivered response to client [2025/04/09 07:04:16.062311, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:04:16.062336, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2347490)]: request netbios name [2025/04/09 07:04:16.062376, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347490):NETBIOS_NAME]: delivered response to client [2025/04/09 07:04:16.062467, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:04:16.062503, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2347490)]: request domain name [2025/04/09 07:04:16.062543, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347490):DOMAIN_NAME]: delivered response to client [2025/04/09 07:04:16.062646, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2347490)] Handling async request: DOMAIN_INFO [2025/04/09 07:04:16.062673, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2347490]: domain_info [ADPROTOCOLX] [2025/04/09 07:04:16.062712, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2347490):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:04:16.062769, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347490):DOMAIN_INFO]: delivered response to client [2025/04/09 07:04:16.062867, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2347490)] Handling async request: PING_DC [2025/04/09 07:04:16.062926, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:04:16.066001, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:04:16.066081, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2347490):PING_DC]: NT_STATUS_OK [2025/04/09 07:04:16.066128, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347490):PING_DC]: delivered response to client [2025/04/09 07:04:16.068515, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:04:19.831560, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:04:19.831696, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:04:19.831726, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:04:19.831749, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:04:19.831766, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:04:19.831796, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:04:31.057450, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:04:31.057607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:31.057644, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347933)]: request interface version (version = 32) [2025/04/09 07:04:31.057724, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347933):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:31.058057, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:04:31.058090, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2347933)]: ping [2025/04/09 07:04:31.058136, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347933):PING]: delivered response to client [2025/04/09 07:04:31.059514, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:04:31.080485, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:04:31.080588, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:31.080616, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347943)]: request interface version (version = 32) [2025/04/09 07:04:31.080664, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347943):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:31.081174, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:31.081208, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2347943)]: request interface version (version = 32) [2025/04/09 07:04:31.081254, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347943):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:31.082914, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:04:31.082950, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2347943)]: request misc info [2025/04/09 07:04:31.083026, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347943):INFO]: delivered response to client [2025/04/09 07:04:31.083132, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:04:31.083158, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2347943)]: request netbios name [2025/04/09 07:04:31.083211, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347943):NETBIOS_NAME]: delivered response to client [2025/04/09 07:04:31.083312, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:04:31.083343, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2347943)]: request domain name [2025/04/09 07:04:31.083386, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347943):DOMAIN_NAME]: delivered response to client [2025/04/09 07:04:31.083504, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2347943)] Handling async request: DOMAIN_INFO [2025/04/09 07:04:31.083532, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2347943]: domain_info [ADPROTOCOLX] [2025/04/09 07:04:31.083576, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2347943):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:04:31.083625, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347943):DOMAIN_INFO]: delivered response to client [2025/04/09 07:04:31.083728, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2347943)] Handling async request: PING_DC [2025/04/09 07:04:31.083766, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:04:31.086285, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:04:31.086371, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2347943):PING_DC]: NT_STATUS_OK [2025/04/09 07:04:31.086423, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2347943):PING_DC]: delivered response to client [2025/04/09 07:04:31.087840, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:04:49.405905, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:04:49.406118, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:49.406145, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348339)]: request interface version (version = 32) [2025/04/09 07:04:49.406206, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348339):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:49.406340, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:04:49.406410, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2348339)]: ping [2025/04/09 07:04:49.406472, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348339):PING]: delivered response to client [2025/04/09 07:04:49.406553, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:04:49.424930, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:04:49.425037, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:49.425062, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348341)]: request interface version (version = 32) [2025/04/09 07:04:49.425111, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348341):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:49.425174, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:04:49.425196, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348341)]: request interface version (version = 32) [2025/04/09 07:04:49.425263, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348341):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:04:49.425328, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:04:49.425368, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2348341)]: request misc info [2025/04/09 07:04:49.425427, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348341):INFO]: delivered response to client [2025/04/09 07:04:49.425492, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:04:49.425514, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2348341)]: request netbios name [2025/04/09 07:04:49.425558, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348341):NETBIOS_NAME]: delivered response to client [2025/04/09 07:04:49.425616, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:04:49.425638, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2348341)]: request domain name [2025/04/09 07:04:49.425678, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348341):DOMAIN_NAME]: delivered response to client [2025/04/09 07:04:49.425770, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2348341)] Handling async request: DOMAIN_INFO [2025/04/09 07:04:49.425796, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2348341]: domain_info [ADPROTOCOLX] [2025/04/09 07:04:49.425870, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2348341):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:04:49.425925, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348341):DOMAIN_INFO]: delivered response to client [2025/04/09 07:04:49.426006, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2348341)] Handling async request: PING_DC [2025/04/09 07:04:49.426064, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:04:49.428632, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:04:49.428703, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2348341):PING_DC]: NT_STATUS_OK [2025/04/09 07:04:49.428762, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348341):PING_DC]: delivered response to client [2025/04/09 07:04:49.428879, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:04:49.832413, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:04:49.832499, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:04:49.832523, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:04:49.832547, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:04:49.832565, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:04:49.832594, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:05:01.074062, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:05:01.074357, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:01.074412, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348585)]: request interface version (version = 32) [2025/04/09 07:05:01.074481, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348585):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:01.074579, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:05:01.074607, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2348585)]: ping [2025/04/09 07:05:01.074646, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348585):PING]: delivered response to client [2025/04/09 07:05:01.076195, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:05:01.105066, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:05:01.105220, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:01.105253, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348595)]: request interface version (version = 32) [2025/04/09 07:05:01.105312, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348595):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:01.107700, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:01.107739, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348595)]: request interface version (version = 32) [2025/04/09 07:05:01.107792, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348595):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:01.111691, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:05:01.111728, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2348595)]: request misc info [2025/04/09 07:05:01.111781, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348595):INFO]: delivered response to client [2025/04/09 07:05:01.112717, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:05:01.112775, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2348595)]: request netbios name [2025/04/09 07:05:01.112834, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348595):NETBIOS_NAME]: delivered response to client [2025/04/09 07:05:01.115299, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:05:01.115341, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2348595)]: request domain name [2025/04/09 07:05:01.115398, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348595):DOMAIN_NAME]: delivered response to client [2025/04/09 07:05:01.116091, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2348595)] Handling async request: DOMAIN_INFO [2025/04/09 07:05:01.116133, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2348595]: domain_info [ADPROTOCOLX] [2025/04/09 07:05:01.116181, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2348595):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:05:01.116237, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348595):DOMAIN_INFO]: delivered response to client [2025/04/09 07:05:01.117489, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2348595)] Handling async request: PING_DC [2025/04/09 07:05:01.117600, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:05:01.122851, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:05:01.122947, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2348595):PING_DC]: NT_STATUS_OK [2025/04/09 07:05:01.123028, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348595):PING_DC]: delivered response to client [2025/04/09 07:05:01.126409, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:05:16.044578, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:05:16.044783, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:16.044811, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348887)]: request interface version (version = 32) [2025/04/09 07:05:16.044869, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348887):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:16.045010, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:05:16.045039, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2348887)]: ping [2025/04/09 07:05:16.045080, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348887):PING]: delivered response to client [2025/04/09 07:05:16.047999, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:05:16.066791, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:05:16.066875, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:16.066901, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348896)]: request interface version (version = 32) [2025/04/09 07:05:16.066949, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348896):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:16.067433, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:16.067461, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2348896)]: request interface version (version = 32) [2025/04/09 07:05:16.067508, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348896):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:16.067603, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:05:16.067627, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2348896)]: request misc info [2025/04/09 07:05:16.067667, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348896):INFO]: delivered response to client [2025/04/09 07:05:16.067759, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:05:16.067784, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2348896)]: request netbios name [2025/04/09 07:05:16.067836, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348896):NETBIOS_NAME]: delivered response to client [2025/04/09 07:05:16.067930, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:05:16.067981, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2348896)]: request domain name [2025/04/09 07:05:16.068030, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348896):DOMAIN_NAME]: delivered response to client [2025/04/09 07:05:16.068125, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2348896)] Handling async request: DOMAIN_INFO [2025/04/09 07:05:16.068152, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2348896]: domain_info [ADPROTOCOLX] [2025/04/09 07:05:16.068193, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2348896):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:05:16.068250, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348896):DOMAIN_INFO]: delivered response to client [2025/04/09 07:05:16.068349, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2348896)] Handling async request: PING_DC [2025/04/09 07:05:16.068401, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:05:16.070869, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:05:16.070934, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2348896):PING_DC]: NT_STATUS_OK [2025/04/09 07:05:16.070991, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2348896):PING_DC]: delivered response to client [2025/04/09 07:05:16.072218, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:05:19.837119, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:05:19.837330, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:05:19.837376, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:05:19.837401, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:05:19.837418, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:05:19.837456, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:05:31.048535, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:05:31.048705, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:31.048738, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349332)]: request interface version (version = 32) [2025/04/09 07:05:31.048794, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349332):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:31.048944, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:05:31.049002, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2349332)]: ping [2025/04/09 07:05:31.049046, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349332):PING]: delivered response to client [2025/04/09 07:05:31.050266, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:05:31.087720, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:05:31.087851, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:31.087877, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349339)]: request interface version (version = 32) [2025/04/09 07:05:31.087926, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349339):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:31.089721, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:31.089755, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349339)]: request interface version (version = 32) [2025/04/09 07:05:31.089815, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349339):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:31.093455, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:05:31.093501, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2349339)]: request misc info [2025/04/09 07:05:31.093566, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349339):INFO]: delivered response to client [2025/04/09 07:05:31.095198, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:05:31.095231, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2349339)]: request netbios name [2025/04/09 07:05:31.095287, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349339):NETBIOS_NAME]: delivered response to client [2025/04/09 07:05:31.096137, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:05:31.096169, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2349339)]: request domain name [2025/04/09 07:05:31.096215, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349339):DOMAIN_NAME]: delivered response to client [2025/04/09 07:05:31.100074, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2349339)] Handling async request: DOMAIN_INFO [2025/04/09 07:05:31.100116, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2349339]: domain_info [ADPROTOCOLX] [2025/04/09 07:05:31.100158, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2349339):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:05:31.100226, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349339):DOMAIN_INFO]: delivered response to client [2025/04/09 07:05:31.103302, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2349339)] Handling async request: PING_DC [2025/04/09 07:05:31.103379, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:05:31.112221, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:05:31.112295, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2349339):PING_DC]: NT_STATUS_OK [2025/04/09 07:05:31.112347, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349339):PING_DC]: delivered response to client [2025/04/09 07:05:31.115305, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:05:46.057154, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:05:46.058353, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:46.058396, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349637)]: request interface version (version = 32) [2025/04/09 07:05:46.058463, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349637):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:46.058607, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:05:46.058637, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2349637)]: ping [2025/04/09 07:05:46.058676, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349637):PING]: delivered response to client [2025/04/09 07:05:46.060422, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:05:46.080211, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:05:46.080304, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:46.080329, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349652)]: request interface version (version = 32) [2025/04/09 07:05:46.080372, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349652):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:46.080478, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:05:46.080502, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349652)]: request interface version (version = 32) [2025/04/09 07:05:46.080541, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349652):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:05:46.080636, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:05:46.080663, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2349652)]: request misc info [2025/04/09 07:05:46.080712, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349652):INFO]: delivered response to client [2025/04/09 07:05:46.080808, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:05:46.080831, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2349652)]: request netbios name [2025/04/09 07:05:46.080874, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349652):NETBIOS_NAME]: delivered response to client [2025/04/09 07:05:46.080986, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:05:46.081014, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2349652)]: request domain name [2025/04/09 07:05:46.081053, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349652):DOMAIN_NAME]: delivered response to client [2025/04/09 07:05:46.081143, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2349652)] Handling async request: DOMAIN_INFO [2025/04/09 07:05:46.081177, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2349652]: domain_info [ADPROTOCOLX] [2025/04/09 07:05:46.081223, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2349652):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:05:46.081268, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349652):DOMAIN_INFO]: delivered response to client [2025/04/09 07:05:46.081373, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2349652)] Handling async request: PING_DC [2025/04/09 07:05:46.081422, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:05:46.084320, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:05:46.084394, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2349652):PING_DC]: NT_STATUS_OK [2025/04/09 07:05:46.084450, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349652):PING_DC]: delivered response to client [2025/04/09 07:05:46.085605, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:05:49.837685, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:05:49.837873, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:05:49.837898, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:05:49.837933, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:05:49.837987, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:05:49.838038, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:06:01.074363, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:06:01.074538, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:06:01.074565, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349936)]: request interface version (version = 32) [2025/04/09 07:06:01.074615, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349936):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:06:01.075135, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:06:01.075170, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2349936)]: ping [2025/04/09 07:06:01.075219, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349936):PING]: delivered response to client [2025/04/09 07:06:01.078007, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:06:01.095392, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:06:01.095476, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:06:01.095504, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349945)]: request interface version (version = 32) [2025/04/09 07:06:01.095557, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349945):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:06:01.096428, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:06:01.096457, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2349945)]: request interface version (version = 32) [2025/04/09 07:06:01.096506, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349945):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:06:01.100029, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:06:01.100068, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2349945)]: request misc info [2025/04/09 07:06:01.100129, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349945):INFO]: delivered response to client [2025/04/09 07:06:01.103782, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:06:01.103815, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2349945)]: request netbios name [2025/04/09 07:06:01.103860, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349945):NETBIOS_NAME]: delivered response to client [2025/04/09 07:06:01.104001, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:06:01.104031, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2349945)]: request domain name [2025/04/09 07:06:01.104073, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349945):DOMAIN_NAME]: delivered response to client [2025/04/09 07:06:01.104178, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2349945)] Handling async request: DOMAIN_INFO [2025/04/09 07:06:01.104204, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2349945]: domain_info [ADPROTOCOLX] [2025/04/09 07:06:01.104257, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2349945):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:06:01.104306, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349945):DOMAIN_INFO]: delivered response to client [2025/04/09 07:06:01.104402, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2349945)] Handling async request: PING_DC [2025/04/09 07:06:01.104467, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:06:01.109778, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:06:01.109875, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2349945):PING_DC]: NT_STATUS_OK [2025/04/09 07:06:01.109940, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2349945):PING_DC]: delivered response to client [2025/04/09 07:06:01.110509, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:06:16.064338, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:06:16.064479, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:06:16.064519, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2350257)]: request interface version (version = 32) [2025/04/09 07:06:16.064566, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350257):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:06:16.064673, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:06:16.064697, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2350257)]: ping [2025/04/09 07:06:16.064735, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350257):PING]: delivered response to client [2025/04/09 07:06:16.068927, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:06:16.086258, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:06:16.086344, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:06:16.086370, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2350268)]: request interface version (version = 32) [2025/04/09 07:06:16.086414, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350268):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:06:16.086511, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:06:16.086536, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2350268)]: request interface version (version = 32) [2025/04/09 07:06:16.086584, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350268):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:06:16.086676, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:06:16.086700, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2350268)]: request misc info [2025/04/09 07:06:16.086741, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350268):INFO]: delivered response to client [2025/04/09 07:06:16.086840, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:06:16.086864, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2350268)]: request netbios name [2025/04/09 07:06:16.086903, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350268):NETBIOS_NAME]: delivered response to client [2025/04/09 07:06:16.087022, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:06:16.087053, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2350268)]: request domain name [2025/04/09 07:06:16.087093, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350268):DOMAIN_NAME]: delivered response to client [2025/04/09 07:06:16.087196, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2350268)] Handling async request: DOMAIN_INFO [2025/04/09 07:06:16.087223, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2350268]: domain_info [ADPROTOCOLX] [2025/04/09 07:06:16.087269, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2350268):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:06:16.087323, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350268):DOMAIN_INFO]: delivered response to client [2025/04/09 07:06:16.087432, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2350268)] Handling async request: PING_DC [2025/04/09 07:06:16.087493, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:06:16.090725, 1, pid=2329712, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:06:16.090797, 3, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2350268):PING_DC]: NT_STATUS_OK [2025/04/09 07:06:16.090845, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2350268):PING_DC]: delivered response to client [2025/04/09 07:06:16.093726, 6, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:06:19.757605, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) msg_ctdb_ref_destructor: refs=(nil) [2025/04/09 07:06:19.757870, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) msg_dgm_ref_destructor: refs=0x56144d5eb480 [2025/04/09 07:06:19.758739, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) messaging_dgm_ref: messaging_dgm_init returned Success [2025/04/09 07:06:19.758851, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) messaging_dgm_ref: unique = 12563169457903413366 [2025/04/09 07:06:19.758996, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 07:06:19.759229, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 07:06:19.759477, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=6817993607967696722 [2025/04/09 07:06:19.759757, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2350317 [2025/04/09 07:06:19.760006, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 [2025/04/09 07:06:19.760196, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=12563169457903413366 [2025/04/09 07:06:19.760330, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) vnn pid 2350317 = 1 [2025/04/09 07:06:19.760363, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) messaging_ctdb_ref: messaging_ctdb_init returned Success [2025/04/09 07:06:19.760458, 5, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE [2025/04/09 07:06:19.760576, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 07:06:19.760775, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 07:06:19.760986, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=14545731037082040223 [2025/04/09 07:06:19.761333, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.761542, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1835402) returned ok [2025/04/09 07:06:19.761600, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.761752, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1835459) returned ok [2025/04/09 07:06:19.761788, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.761882, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1835461) returned ok [2025/04/09 07:06:19.761934, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.762075, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1878741) returned ok [2025/04/09 07:06:19.762122, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.762261, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1881876) returned ok [2025/04/09 07:06:19.762311, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.762437, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162289) returned ok [2025/04/09 07:06:19.762484, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.762598, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162323) returned ok [2025/04/09 07:06:19.762640, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.762768, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174496) returned ok [2025/04/09 07:06:19.762802, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.762890, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174501) returned ok [2025/04/09 07:06:19.762936, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.763041, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174507) returned ok [2025/04/09 07:06:19.763087, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.763183, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174506) returned ok [2025/04/09 07:06:19.763226, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.763339, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174504) returned ok [2025/04/09 07:06:19.763380, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.763471, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184838) returned ok [2025/04/09 07:06:19.763506, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.763628, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184863) returned ok [2025/04/09 07:06:19.763669, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.763765, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184862) returned ok [2025/04/09 07:06:19.763804, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.763912, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184857) returned ok [2025/04/09 07:06:19.763969, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.764094, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184926) returned ok [2025/04/09 07:06:19.764138, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329712) returned Resource temporarily unavailable [2025/04/09 07:06:19.764181, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329718) returned Resource temporarily unavailable [2025/04/09 07:06:19.764223, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.764353, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329746) returned ok [2025/04/09 07:06:19.764402, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.764475, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329744) returned ok [2025/04/09 07:06:19.764508, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.764592, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329748) returned ok [2025/04/09 07:06:19.764628, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329757) returned Resource temporarily unavailable [2025/04/09 07:06:19.764673, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329766) returned Resource temporarily unavailable [2025/04/09 07:06:19.764707, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329769) returned Resource temporarily unavailable [2025/04/09 07:06:19.764751, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329771) returned Resource temporarily unavailable [2025/04/09 07:06:19.764783, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.764864, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1835405) returned ok [2025/04/09 07:06:19.764898, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765017, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1835458) returned ok [2025/04/09 07:06:19.765060, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765131, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1835460) returned ok [2025/04/09 07:06:19.765179, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765299, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1881016) returned ok [2025/04/09 07:06:19.765333, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765409, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162247) returned ok [2025/04/09 07:06:19.765442, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765526, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162266) returned ok [2025/04/09 07:06:19.765560, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765629, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162283) returned ok [2025/04/09 07:06:19.765662, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765729, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162287) returned ok [2025/04/09 07:06:19.765764, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765838, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162288) returned ok [2025/04/09 07:06:19.765872, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.765943, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162284) returned ok [2025/04/09 07:06:19.766004, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766066, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162286) returned ok [2025/04/09 07:06:19.766097, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766181, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162282) returned ok [2025/04/09 07:06:19.766214, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766317, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162285) returned ok [2025/04/09 07:06:19.766357, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766435, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2162316) returned ok [2025/04/09 07:06:19.766474, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766563, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174486) returned ok [2025/04/09 07:06:19.766603, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766672, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174508) returned ok [2025/04/09 07:06:19.766705, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766770, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174502) returned ok [2025/04/09 07:06:19.766810, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766871, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174503) returned ok [2025/04/09 07:06:19.766911, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.766994, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174505) returned ok [2025/04/09 07:06:19.767038, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.767157, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174542) returned ok [2025/04/09 07:06:19.767199, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.767285, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184854) returned ok [2025/04/09 07:06:19.767318, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.767400, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184864) returned ok [2025/04/09 07:06:19.767434, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.767511, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184858) returned ok [2025/04/09 07:06:19.767544, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.767610, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184861) returned ok [2025/04/09 07:06:19.767649, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.767728, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184856) returned ok [2025/04/09 07:06:19.767761, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.767836, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184902) returned ok [2025/04/09 07:06:19.767881, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329715) returned Resource temporarily unavailable [2025/04/09 07:06:19.767914, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.768015, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329720) returned ok [2025/04/09 07:06:19.768051, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.768122, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329743) returned ok [2025/04/09 07:06:19.768155, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.768216, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329745) returned ok [2025/04/09 07:06:19.768266, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.768357, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329747) returned ok [2025/04/09 07:06:19.768391, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.768470, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329742) returned ok [2025/04/09 07:06:19.768507, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329767) returned Resource temporarily unavailable [2025/04/09 07:06:19.768549, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.768618, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329768) returned ok [2025/04/09 07:06:19.768653, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2340366) returned Resource temporarily unavailable [2025/04/09 07:06:19.768684, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.768791, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1835408) returned ok [2025/04/09 07:06:19.768832, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.768905, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(1835700) returned ok [2025/04/09 07:06:19.768939, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.769104, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2174557) returned ok [2025/04/09 07:06:19.769138, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.769198, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2184860) returned ok [2025/04/09 07:06:19.769383, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.769556, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2185109) returned ok [2025/04/09 07:06:19.769639, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.769710, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329735) returned ok [2025/04/09 07:06:19.769744, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1605(messaging_dgm_cleanup) messaging_dgm_cleanup: Cleaning up : Success [2025/04/09 07:06:19.769802, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1628(messaging_dgm_wipe_fn) messaging_dgm_cleanup(2329764) returned ok [2025/04/09 07:06:19.769832, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:1428(mess_parent_dgm_cleanup) messaging_dgm_wipe returned ok [2025/04/09 07:06:19.769927, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) msg_ctdb_ref_destructor: refs=(nil) [2025/04/09 07:06:19.769989, 10, pid=2350317, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) msg_dgm_ref_destructor: refs=0x56144d5eb480 [2025/04/09 07:06:19.771283, 5, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:851(winbind_child_died) Already reaped child 2350317 died [2025/04/09 07:06:19.838537, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:06:19.838634, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:06:19.838671, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:06:19.838696, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:06:19.838714, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:06:19.838736, 10, pid=2329712, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. Logs name: log.wb-ADPROTOCOLX.scenario1 ======================== [2025/04/09 06:57:16.574947, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:57:16.575108, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:57:16.575399, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:57:16.575667, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:57:16.575836, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000040 (64) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:57:16.576087, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:57:16.576254, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:57:16.576296, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:57:16.577124, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:57:16.577222, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000040 (64) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] A2 0E 4F A7 39 DD 67 8E F9 F7 FD D2 94 38 C2 25 ..O.9.g. .....8.% [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] DB CE 0E 42 3D 65 96 66 67 E7 61 7D FF AF 1F 11 ...B=e.f g.a}.... [0030] 6D 69 66 65 69 72 69 67 85 D7 13 E6 80 AD 67 53 mifeirig ......gS [0040] F3 C2 25 52 C4 89 CA 6C D0 B7 65 FA 52 92 72 2E ..%R...l ..e.R.r. [2025/04/09 06:57:16.577511, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:57:16.577542, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:57:16.577560, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:57:16.577592, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:57:16.577621, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:57:16.577670, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:57:16.577707, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:57:16.577846, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:57:16.577884, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:57:16.578004, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:57:16.578034, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:57:31.033937, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:57:31.033998, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:57:31.034101, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:57:31.034202, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:57:31.034317, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000041 (65) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:57:31.034539, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:57:31.034703, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:57:31.034748, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:57:31.035581, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:57:31.035649, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000041 (65) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 09 A8 E4 18 60 E5 60 A6 F0 28 A9 AF 1A F1 9A 39 ....`.`. .(.....9 [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] AD 5A AB 80 63 C3 76 15 0D D0 47 B6 0C CC F7 0E .Z..c.v. ..G..... [0030] 41 85 1D 68 32 83 09 A5 00 00 00 00 00 00 00 00 A..h2... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:57:31.035957, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:57:31.035998, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:57:31.036031, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:57:31.036065, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:57:31.036103, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:57:31.036126, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:57:31.036154, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:57:31.036231, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:57:31.036262, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:57:31.036335, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:57:31.036355, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:57:45.982717, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:57:45.982855, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:57:45.983016, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:57:45.983167, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:57:45.983277, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000042 (66) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:57:45.983469, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:57:45.983587, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:57:45.983624, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:57:46.001647, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:57:46.001750, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000042 (66) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 13 2D A7 D8 C8 38 93 3D FA 92 4A 01 FF 96 78 1C .-...8.= ..J...x. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] CC 8A C2 4A 8C 5D BA E9 E6 9D 91 FA 96 84 FC E4 ...J.].. ........ [0030] 8B 3E 80 24 61 A8 87 7F 00 00 00 00 00 00 00 00 .>.$a... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:57:46.002074, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:57:46.002101, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:57:46.002121, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:57:46.002172, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:57:46.002194, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:57:46.002215, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:57:46.002261, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:57:46.002359, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:57:46.002385, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:57:46.002453, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:57:46.002474, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:57:58.086024, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:57:58.086083, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:57:58.086193, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:57:58.086313, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:57:58.086403, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000043 (67) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:57:58.086602, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:57:58.086718, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:57:58.086758, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:57:58.087429, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:57:58.087503, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000043 (67) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 45 B7 59 6B C2 78 0E 56 BD 26 38 6F 25 11 17 25 E.Yk.x.V .&8o%..% [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 60 25 06 63 66 3D 08 FA D5 4D FB 69 4A B4 72 0C `%.cf=.. .M.iJ.r. [0030] 61 65 A7 B7 B4 AA 6D 3D 00 00 00 00 00 00 00 00 ae....m= ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:57:58.087793, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:57:58.087815, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:57:58.087834, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:57:58.087866, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:57:58.087904, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:57:58.087946, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:57:58.088010, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:57:58.088103, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:57:58.088125, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:57:58.088184, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:57:58.088203, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:57:58.099718, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 06:57:58.099755, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:57:58.099776, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 06:57:58.099843, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:57:58.099974, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:57:58.100033, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 06:57:58.100064, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 06:57:58.100083, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 06:57:58.100120, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 06:57:58.100154, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 06:57:58.100206, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 06:57:58.100284, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 06:57:58.100557, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000044 (68) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:57:58.100756, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:57:58.100844, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:57:58.100899, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:57:58.101656, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 06:57:58.101756, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x00000044 (68) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] 69 81 7A CB 7C 7B DA 51 FA D5 1E 2D 8D D4 AD 64 i.z.|{.Q ...-...d [0010] 8B 58 F6 6A 91 15 1A B3 BD FC CB 5F 59 00 A8 DC .X.j.... ..._Y... [0020] 4D BB 14 CD 77 79 36 46 2A 6D 05 DD EF C8 8D 4A M...wy6F *m.....J [0030] 9D 75 27 E7 4E 39 D0 37 68 32 E2 BE AF 75 53 1E .u'.N9.7 h2...uS. [0040] 05 EF DF 86 99 11 B7 9E 21 E5 C1 7C F0 B0 59 9D ........ !..|..Y. [0050] C6 00 89 94 E2 0E 22 4F 51 54 3C 2E C2 08 0B 43 ......"O QT<....C [0060] DC 97 89 2C 25 40 C3 62 A1 0B 39 82 5C C7 85 D4 ...,%@.b ..9.\... [0070] DA 09 D7 5C C2 B8 39 04 92 EA BC 83 1F 48 46 0C ...\..9. .....HF. [0080] 71 D6 F2 12 E8 F8 E0 7A 1B FA DC B6 80 F0 70 E5 q......z ......p. [0090] 38 D7 B4 FD 3E 20 9F 22 64 E5 9F 90 AC 18 7A 67 8...> ." d.....zg [00A0] 37 FD 90 22 6C 1D 6A AF EB 15 07 2F 74 35 21 3F 7.."l.j. .../t5!? [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] 19 97 22 DA 02 C5 1B 4F 84 71 DD 8A 5A 7B 6F D7 .."....O .q..Z{o. [00D0] AC 80 E5 7A 94 D7 00 DA 00 00 00 00 00 00 00 00 ...z.... ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:57:58.102255, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:57:58.102279, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 06:57:58.102298, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:57:58.102331, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 06:57:58.102352, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 06:57:58.102371, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. [2025/04/09 06:57:58.102442, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 06:57:58.102742, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 06:57:58.102768, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 06:57:58.102821, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:02:58 AM 2025 EDT] (300 seconds ahead) [2025/04/09 06:57:58.102909, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:02:58 AM 2025 EDT] (300 seconds ahead) [2025/04/09 06:57:58.102958, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 06:57:58.103110, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:57:58.103132, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 06:58:01.031736, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:01.031796, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:58:01.031917, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:01.032048, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:58:01.032175, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000045 (69) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:01.032391, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:01.032498, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:01.032526, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:58:01.034187, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:58:01.034281, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000045 (69) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 66 E5 7C 75 42 50 7E CB 0B 5A D0 BC A9 07 09 64 f.|uBP~. .Z.....d [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] FE B1 42 87 CB 71 E9 28 41 C2 2A 8C 3B 5C 3F 9F ..B..q.( A.*.;\?. [0030] 25 AE 6A B1 CE EB 0E 7C 1B 83 59 AA 26 64 DD 6F %.j....| ..Y.&d.o [0040] BA 85 47 BF BF AB FD BC 95 7D DF 90 E6 50 B5 D4 ..G..... .}...P.. [2025/04/09 06:58:01.034570, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:58:01.034595, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:58:01.034615, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:58:01.034649, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:58:01.034679, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:58:01.034702, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:58:01.034732, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:58:01.034809, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:58:01.034832, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:01.034892, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:58:01.034913, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:58:03.537580, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:03.537650, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:58:03.537781, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:03.537899, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:58:03.538027, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000046 (70) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:03.538399, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:03.538511, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:03.538550, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:58:03.539548, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:58:03.539624, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000046 (70) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] DD E1 99 23 22 96 C0 12 00 54 35 61 FB 2F B3 8D ...#"... .T5a./.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] BA A6 60 96 4D DA 5F D7 87 65 0C A5 0E 0D B2 C7 ..`.M._. .e...... [0030] DD 93 ED A7 EC F5 24 41 EA E2 52 5E 69 EB 30 A9 ......$A ..R^i.0. [0040] 7F DA AD 9B 2B 68 6E 25 5A FC D5 0F 5E 89 CF CD ....+hn% Z...^... [2025/04/09 06:58:03.540046, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:58:03.540133, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:58:03.540172, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:58:03.540206, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:58:03.540241, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:58:03.540261, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:58:03.540290, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:58:03.540367, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:58:03.540390, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:03.540472, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:58:03.540496, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:58:03.548639, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 06:58:03.548680, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:03.548701, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 06:58:03.548739, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:03.548807, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:03.548865, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 06:58:03.548890, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 06:58:03.548908, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 06:58:03.548927, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 06:58:03.548946, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 06:58:03.549033, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 06:58:03.549085, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 06:58:03.549275, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000047 (71) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:03.549467, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:03.549544, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:03.549570, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:58:03.550237, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 06:58:03.550300, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x00000047 (71) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] 3E A4 FB 95 EF 6C 2C 4C 88 BF F7 B6 7E 53 6A CA >....l,L ....~Sj. [0010] 2A C5 2F D7 95 CA 6D 07 74 6C C8 D1 17 BC 2E 16 *./...m. tl...... [0020] FF A7 FA 15 77 5E 03 D4 D6 7B B2 B1 7B 7A B5 48 ....w^.. .{..{z.H [0030] B5 AA 36 60 0B E7 0A 77 37 66 14 BD 6B D7 8F 24 ..6`...w 7f..k..$ [0040] 5C 1A A6 A1 07 88 7B 02 5A DF F1 0A F3 5E 1C B3 \.....{. Z....^.. [0050] 50 B4 CC 70 39 1C 7F 84 02 68 65 F9 2B D4 AB AE P..p9... .he.+... [0060] 8E E8 58 4D DA 24 CA 01 59 41 5E 93 28 6E E3 DF ..XM.$.. YA^.(n.. [0070] A7 8A 57 BF 82 61 48 10 98 84 2A 38 FF 42 DF 91 ..W..aH. ..*8.B.. [0080] 04 E9 A1 58 0C 2A FC 01 68 D9 04 30 15 FB F1 05 ...X.*.. h..0.... [0090] 69 05 41 13 47 71 8F A1 A7 6D B1 54 33 C9 B3 F1 i.A.Gq.. .m.T3... [00A0] DE 3C FD D0 81 49 DB 22 AE EC 75 B9 6C 34 1A EB .<...I." ..u.l4.. [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] C0 87 87 DD 89 80 91 58 46 EF 6B 27 24 49 D2 FE .......X F.k'$I.. [00D0] DE CF 0D 1E 9E 8C F4 14 00 00 00 00 00 00 00 00 ........ ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:58:03.550716, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:58:03.550739, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 06:58:03.550757, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:58:03.550790, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 06:58:03.550812, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 06:58:03.550831, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. [2025/04/09 06:58:03.550908, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 06:58:03.551246, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 06:58:03.551272, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 06:58:03.551298, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:03:03 AM 2025 EDT] (300 seconds ahead) [2025/04/09 06:58:03.551338, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:03:03 AM 2025 EDT] (300 seconds ahead) [2025/04/09 06:58:03.551372, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 06:58:03.551476, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:58:03.551497, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 06:58:09.014566, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:09.014645, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:58:09.014755, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:09.014876, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:58:09.015008, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000048 (72) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:09.015236, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:09.015351, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:09.015389, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:58:09.016785, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:58:09.016882, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000048 (72) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 77 5C A4 2F F4 DE 5D 39 07 8F 2D EA FC 6F EF 4B w\./..]9 ..-..o.K [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] C2 9C 67 8E 0E 7D ED DC A2 C4 EF 73 0E C1 72 34 ..g..}.. ...s..r4 [0030] C0 62 CC FD D0 C4 DB 91 00 00 00 00 00 00 00 00 .b...... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:58:09.017200, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:58:09.017226, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:58:09.017251, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:58:09.017287, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:58:09.017322, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:58:09.017343, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:58:09.017385, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:58:09.017505, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:58:09.017529, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:09.017600, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:58:09.017621, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:58:09.028229, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 06:58:09.028282, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:09.028314, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 06:58:09.028370, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 06:58:09.028447, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:09.028476, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 06:58:09.028497, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 06:58:09.028522, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 06:58:09.028543, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 06:58:09.028565, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 06:58:09.028589, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 06:58:09.028630, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 06:58:09.028821, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000049 (73) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:09.029046, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:09.029144, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:09.029181, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:58:09.030385, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 06:58:09.030447, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x00000049 (73) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] FC 37 37 3F 09 CD 75 92 4D FC E3 2E FB 01 73 D9 .77?..u. M.....s. [0010] E6 8A 53 29 B8 55 36 5E 1E 30 D0 E1 B3 0A 22 61 ..S).U6^ .0...."a [0020] 5B 4B C8 73 A4 D5 33 80 BF C7 E1 FF F4 12 A3 DA [K.s..3. ........ [0030] FC 7A 1F 17 D3 B2 E5 8C 29 8A 44 3D 38 BE CA 97 .z...... ).D=8... [0040] 9F 58 9D 49 D7 B5 9E 86 E4 0B 46 B6 61 4F 8A F3 .X.I.... ..F.aO.. [0050] 9F E0 B0 83 18 96 4F 71 AD DD 48 B7 AB 33 41 EA ......Oq ..H..3A. [0060] 01 8B 9E 51 50 9B BA 73 49 B5 48 B0 4E FF 84 3F ...QP..s I.H.N..? [0070] 78 AC E2 AF 4B 2C 05 6F 44 A9 87 E1 95 B6 88 F3 x...K,.o D....... [0080] 1B 98 76 BD 4F 35 BE 06 AC 4B 1D 09 95 9B 26 BC ..v.O5.. .K....&. [0090] 5E 55 24 F4 AE FB 5C C9 FE EF BD B5 C8 7D 66 40 ^U$...\. .....}f@ [00A0] 36 E1 DF E9 50 E9 39 FC 73 C9 1E D6 14 9A 98 64 6...P.9. s......d [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] 94 88 25 D9 70 52 A6 D8 42 A1 4A F5 D2 18 C8 21 ..%.pR.. B.J....! [00D0] AA BB 5E D9 C0 B5 A3 6C 00 00 00 00 00 00 00 00 ..^....l ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:58:09.030876, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:58:09.030899, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 06:58:09.030923, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:58:09.030981, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 06:58:09.031011, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 06:58:09.031039, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. [2025/04/09 06:58:09.031107, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 06:58:09.031380, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 06:58:09.031413, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 06:58:09.031441, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:03:09 AM 2025 EDT] (300 seconds ahead) [2025/04/09 06:58:09.031505, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:03:09 AM 2025 EDT] (300 seconds ahead) [2025/04/09 06:58:09.031547, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 06:58:09.031655, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:58:09.031678, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 06:58:14.517859, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:14.517912, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:58:14.518028, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:14.518112, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:58:14.518228, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000004a (74) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:14.518429, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:14.518555, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:14.518594, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:58:14.519329, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:58:14.519410, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000004a (74) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] F6 21 3D 34 BC 03 E4 45 A3 92 34 E1 05 31 BD EC .!=4...E ..4..1.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 36 41 A1 56 E5 B0 A2 AB 52 C3 E8 3E 8C 78 C2 D9 6A.V.... R..>.x.. [0030] 11 75 EC 6C 07 A1 6E 2E 83 19 B5 DB EF 9C CC 36 .u.l..n. .......6 [0040] 01 00 00 00 03 00 03 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:58:14.519674, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:58:14.519698, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:58:14.519717, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:58:14.519750, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:58:14.519773, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:58:14.519802, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:58:14.519835, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:58:14.519916, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:58:14.519950, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:14.520078, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:58:14.520101, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:58:16.012779, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:16.012828, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:58:16.012907, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:16.013028, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:58:16.013115, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000004b (75) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:16.013314, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:16.013424, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:16.013463, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:58:16.014007, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:58:16.014085, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000004b (75) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] AF 6B D4 AF F1 78 78 0A 07 C3 48 8E ED 95 5A 1D .k...xx. ..H...Z. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 06 5E B7 D8 5E D4 A9 38 F1 89 9F BD 05 64 44 E1 .^..^..8 .....dD. [0030] CF A9 B9 C0 6A F8 39 8C 83 19 B5 DB EF 9C CC 36 ....j.9. .......6 [0040] 01 00 00 00 03 00 03 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:58:16.014362, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:58:16.014388, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:58:16.014407, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:58:16.014440, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:58:16.014461, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:58:16.014481, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 06:58:16.014508, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:58:16.014578, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:58:16.014614, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:16.014685, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:58:16.014707, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:58:31.010122, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:31.010168, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:58:31.010251, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:31.010358, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:58:31.010470, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000004c (76) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:31.010677, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:31.010898, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:31.010933, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:58:34.734924, 4, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:58:34.735145, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:58:34.735344, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:58:34.735588, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:58:34.735696, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 06:58:34.735925, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000008 (8) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000088 (136) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:34.736150, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:34.736252, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 06:58:34.736308, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 232 [2025/04/09 06:58:41.021121, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) cli_api_pipe failed: NT_STATUS_IO_TIMEOUT [2025/04/09 06:58:41.021304, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 10000 (ms) to 1000 (ms). [2025/04/09 06:58:41.021445, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 1000 (ms) to 500 (ms). [2025/04/09 06:58:41.021510, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 500 (ms) to 500 (ms). [2025/04/09 06:58:41.021720, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 06:58:41.522545, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1946(connection_ok) connection_ok: Connection to windc1.adprotocolx.com for domain ADPROTOCOLX is not connected [2025/04/09 06:58:41.522655, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1760(cm_open_connection) Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. [2025/04/09 06:58:41.522694, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1767(cm_open_connection) Attempt 0/3: DC 'windc1.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 06:58:41.522716, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1528(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 06:58:41.522778, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc1.adprotocolx.com" for "ADPROTOCOLX" domain [2025/04/09 06:58:41.522824, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com [2025/04/09 06:58:41.522859, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1439(connect_preferred_dc) connect_preferred_dc: saf_servername is 'windc1.adprotocolx.com' for domain ADPROTOCOLX [2025/04/09 06:58:41.522905, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 06:58:41.522942, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 06:58:41.523014, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc1.adprotocolx.com#20 found. [2025/04/09 06:58:41.523054, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:41.523087, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. [2025/04/09 06:58:41.523149, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.92'. [2025/04/09 06:58:41.523191, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: adprotocolx.com) [2025/04/09 06:58:44.746703, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) cli_api_pipe failed: NT_STATUS_IO_TIMEOUT [2025/04/09 06:58:44.746904, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 10000 (ms) to 1000 (ms). [2025/04/09 06:58:44.747040, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 1000 (ms) to 500 (ms). [2025/04/09 06:58:44.747136, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 500 (ms) to 500 (ms). [2025/04/09 06:58:44.747788, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 06:58:45.248606, 3, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1946(connection_ok) connection_ok: Connection to windc1.adprotocolx.com for domain ADPROTOCOLX is not connected [2025/04/09 06:58:45.248690, 3, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1760(cm_open_connection) Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. [2025/04/09 06:58:45.248717, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1767(cm_open_connection) Attempt 0/3: DC 'windc1.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 06:58:45.248746, 3, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1528(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 06:58:45.248810, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc1.adprotocolx.com" for "ADPROTOCOLX" domain [2025/04/09 06:58:45.248847, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com [2025/04/09 06:58:45.248867, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1439(connect_preferred_dc) connect_preferred_dc: saf_servername is 'windc1.adprotocolx.com' for domain ADPROTOCOLX [2025/04/09 06:58:45.248905, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 06:58:45.248929, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 06:58:45.248987, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc1.adprotocolx.com#20 found. [2025/04/09 06:58:45.249030, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:45.249060, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. [2025/04/09 06:58:45.249094, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.92'. [2025/04/09 06:58:45.249119, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: adprotocolx.com) [2025/04/09 06:58:47.525918, 2, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/cldap.c:417(ads_cldap_netlogon) ads_cldap_netlogon: did not get a reply [2025/04/09 06:58:47.526022, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:387(ads_try_connect) ads_try_connect: ads_cldap_netlogon_5(10.28.1.92, adprotocolx.com) failed. [2025/04/09 06:58:47.526076, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com] and timeout=[Wed Apr 9 06:59:47 AM 2025 EDT] (60 seconds ahead) [2025/04/09 06:58:47.526149, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX (windc1.adprotocolx.com) to failed conn cache [2025/04/09 06:58:47.526179, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) [2025/04/09 06:58:47.526204, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) [2025/04/09 06:58:47.526229, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [ADPROTOCOLX] [2025/04/09 06:58:47.526251, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com] and timeout=[Wed Apr 9 06:59:47 AM 2025 EDT] (60 seconds ahead) [2025/04/09 06:58:47.526286, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain adprotocolx.com (windc1.adprotocolx.com) to failed conn cache [2025/04/09 06:58:47.526326, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 06:58:47.526351, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 06:58:47.526377, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [adprotocolx.com] [2025/04/09 06:58:47.526399, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1539(find_dc) Retrieving a list of IP addresses for DCs. [2025/04/09 06:58:47.526446, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 06:58:47.526470, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) ads_dc_name: domain=ADPROTOCOLX [2025/04/09 06:58:47.526501, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 06:58:47.526526, 6, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'adprotocolx.com' [2025/04/09 06:58:47.526551, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) [2025/04/09 06:58:47.526584, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:47.526610, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:47.526630, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) [2025/04/09 06:58:47.526655, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 06:58:47.526714, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:47.526740, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:47.526776, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:47.526799, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:47.526821, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:47.526843, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:47.526865, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:47.526892, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:47.526912, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:47.526931, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:47.526948, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:47.527003, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:47.527032, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:47.527056, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:47.527080, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:47.527104, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:47.527129, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:47.527151, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) cldap_ping_list: Try to create 6 netlogon connections for domain 'adprotocolx.com' (provided count of addresses was 6). [2025/04/09 06:58:47.729092, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:47.729609, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 06:58:47.729640, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480472 seconds ahead) [2025/04/09 06:58:47.729693, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 06:58:47.729727, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480472 seconds ahead) [2025/04/09 06:58:47.729774, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) cldap_ping_list: realm[adprotocolx.com]: selected 10.28.1.93 => windc2.adprotocolx.com [2025/04/09 06:58:47.729795, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:47.730175, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 06:58:47.730217, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 06:58:47.730243, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 06:58:47.730299, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX [2025/04/09 06:58:47.730347, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:47.730374, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:47.730406, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) [2025/04/09 06:58:47.730429, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 06:58:47.730474, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 06:58:47.730579, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 06:58:47.730605, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:47.730701, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 98 0E 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 06:58:48.731892, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 06:58:48.732056, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 06:58:48.732086, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:48.732210, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] CD 71 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .q...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 06:58:48.732338, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 06:58:48.732757, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] CD 71 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .q...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. [0120] D7 81 C8 0F 00 ..... [2025/04/09 06:58:48.733188, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 06:58:48.733220, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 06:58:48.733240, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:48.733261, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 06:58:48.733281, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 06:58:48.733300, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:48.733331, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:48.733381, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:48.733416, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:48.733441, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:48.733465, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:48.733488, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:48.733511, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:48.733534, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:48.733554, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:48.733574, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:48.733593, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:48.733617, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 06:58:48.733643, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:48.733666, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:48.733686, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) [2025/04/09 06:58:48.733709, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 06:58:48.733740, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 06:58:48.733810, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 06:58:48.733833, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:48.733898, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] BF 5B 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .[...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 06:58:49.735121, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 06:58:49.735197, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 06:58:49.735222, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:49.735330, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 21 F3 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 !....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 06:58:49.735427, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 06:58:49.735985, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 21 F3 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 !....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s [0100] D0 D7 81 C8 0F 00 ...... [2025/04/09 06:58:49.736334, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 06:58:49.736364, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 06:58:49.736384, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:49.736404, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 06:58:49.736422, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 06:58:49.736451, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:49.736474, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:49.736521, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:49.736554, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:49.736578, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:49.736600, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:49.736622, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:49.736643, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:49.736665, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:49.736684, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:49.736703, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:49.736720, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:49.736763, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 06:58:49.736790, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 06:58:49.938692, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:51.251783, 2, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/cldap.c:417(ads_cldap_netlogon) ads_cldap_netlogon: did not get a reply [2025/04/09 06:58:51.251862, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:387(ads_try_connect) ads_try_connect: ads_cldap_netlogon_5(10.28.1.92, adprotocolx.com) failed. [2025/04/09 06:58:51.251912, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com] and timeout=[Wed Apr 9 06:59:51 AM 2025 EDT] (60 seconds ahead) [2025/04/09 06:58:51.252016, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX (windc1.adprotocolx.com) to failed conn cache [2025/04/09 06:58:51.252055, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) [2025/04/09 06:58:51.252082, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) [2025/04/09 06:58:51.252105, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/adprotocolx.com,windc1.adprotocolx.com] and timeout=[Wed Apr 9 06:59:51 AM 2025 EDT] (60 seconds ahead) [2025/04/09 06:58:51.252138, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain adprotocolx.com (windc1.adprotocolx.com) to failed conn cache [2025/04/09 06:58:51.252161, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 06:58:51.252182, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 06:58:51.252217, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1539(find_dc) Retrieving a list of IP addresses for DCs. [2025/04/09 06:58:51.252251, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 06:58:51.252280, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) ads_dc_name: domain=ADPROTOCOLX [2025/04/09 06:58:51.252305, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 06:58:51.252326, 6, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'adprotocolx.com' [2025/04/09 06:58:51.252344, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) [2025/04/09 06:58:51.252369, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:51.252410, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:51.252432, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) [2025/04/09 06:58:51.252458, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 06:58:51.252504, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:51.252527, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:51.252553, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:51.252577, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:51.252601, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:51.252623, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:51.252645, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:51.252668, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:51.252687, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:51.252706, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:51.252730, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:51.252764, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:51.252806, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:51.252832, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:51.252857, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:51.252883, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:51.252909, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:51.252932, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) cldap_ping_list: Try to create 6 netlogon connections for domain 'adprotocolx.com' (provided count of addresses was 6). [2025/04/09 06:58:51.454618, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:51.455145, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 06:58:51.455173, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480468 seconds ahead) [2025/04/09 06:58:51.455216, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 06:58:51.455243, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480468 seconds ahead) [2025/04/09 06:58:51.455277, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) cldap_ping_list: realm[adprotocolx.com]: selected 10.28.1.93 => windc2.adprotocolx.com [2025/04/09 06:58:51.455298, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:51.455617, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 06:58:51.455655, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 06:58:51.455690, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 06:58:51.455743, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX [2025/04/09 06:58:51.455788, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:51.455814, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:51.455833, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) [2025/04/09 06:58:51.455855, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 06:58:51.455889, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 06:58:51.455990, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 06:58:51.456023, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:51.456094, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 9C 07 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 06:58:52.457344, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 06:58:52.457459, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 06:58:52.457501, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:52.457671, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 37 6B 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 7k...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 06:58:52.457816, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 06:58:52.459087, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 37 6B 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 7k...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 06:58:52.459502, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 06:58:52.459531, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 06:58:52.459551, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:52.459574, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 06:58:52.459604, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 06:58:52.459623, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:52.459656, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:52.459701, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:52.459736, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:52.459765, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:52.459801, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:52.459826, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:52.459847, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:52.459923, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:52.459988, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:52.460030, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:52.460050, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:52.460081, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 06:58:52.460111, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:52.460146, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:52.460168, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) [2025/04/09 06:58:52.460190, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 06:58:52.460209, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 06:58:52.460309, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 06:58:52.460333, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:52.460401, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] E4 CB 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 06:58:52.738440, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 06:58:52.738608, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 06:58:52.738658, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 [2025/04/09 06:58:52.738705, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 06:58:52.738729, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) [2025/04/09 06:58:52.738753, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:52.738776, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:52.738809, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) [2025/04/09 06:58:52.738836, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 06:58:52.738868, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:52.738888, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:52.738911, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:52.738934, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:52.738983, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:52.739027, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:52.739064, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:52.739088, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:52.739108, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:52.739139, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:52.739162, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:52.739195, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 06:58:52.739229, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 06:58:52.739252, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 06:58:52.739287, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 06:58:52.739315, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:52.739354, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:52.739376, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename NULL) [2025/04/09 06:58:52.739410, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:52.739431, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:52.739449, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename (null)) [2025/04/09 06:58:52.739472, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 06:58:52.739500, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:52.739520, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:52.739542, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:52.739564, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:52.739585, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:52.739606, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:52.739627, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:52.739653, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:52.739673, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:52.739691, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:52.739709, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:52.739735, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 06:58:52.739757, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 06:58:52.739779, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 06:58:52.739810, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 06:58:52.739834, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:52.739856, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:52.739876, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1543(find_dc) Retrieved IP addresses for 6 DCs. [2025/04/09 06:58:52.739898, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1564(find_dc) Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). [2025/04/09 06:58:52.739981, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 445 [2025/04/09 06:58:52.750415, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 192.168.122.133 at port 445 [2025/04/09 06:58:52.750514, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 445 [2025/04/09 06:58:52.750600, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 192.168.122.206 at port 445 [2025/04/09 06:58:52.750723, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 2001:192::656a:348:28e1:d1 at port 445 [2025/04/09 06:58:52.750834, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 2001:192::c973:d0d7:81c8:f00 at port 445 [2025/04/09 06:58:52.751244, 3, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1579(find_dc) Successfully connected to DC '10.28.1.93'. [2025/04/09 06:58:52.751290, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. [2025/04/09 06:58:52.751316, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.93'. [2025/04/09 06:58:52.751340, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: adprotocolx.com) [2025/04/09 06:58:52.752339, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:52.752713, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 06:58:52.752738, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480467 seconds ahead) [2025/04/09 06:58:52.752785, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 06:58:52.752826, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480467 seconds ahead) [2025/04/09 06:58:52.752868, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 06:58:52.752900, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 [2025/04/09 06:58:52.752924, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:09:52 AM 2025 EDT] (660 seconds ahead) [2025/04/09 06:58:52.752987, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1134(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f1fc [2025/04/09 06:58:52.753020, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 06:58:52.753044, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 06:58:52.753097, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX [2025/04/09 06:58:52.753122, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:52.753144, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:52.753162, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) [2025/04/09 06:58:52.753183, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 06:58:52.753209, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 06:58:52.753268, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 06:58:52.753291, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:52.753349, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] FB C1 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 06:58:53.461170, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 06:58:53.461231, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 06:58:53.461266, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:53.461365, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 52 86 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 R....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 06:58:53.461464, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 06:58:53.462909, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 52 86 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 R....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej [0100] 03 48 28 E1 00 D1 .H(... [2025/04/09 06:58:53.463278, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 06:58:53.463308, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 06:58:53.463334, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:53.463354, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 06:58:53.463373, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 06:58:53.463392, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:53.463414, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:53.463460, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:53.463509, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:53.463535, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:53.463558, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:53.463580, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:53.463602, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:53.463624, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:53.463643, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:53.463663, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:53.463681, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:53.463704, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 06:58:53.463728, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 06:58:53.565094, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:53.754043, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 06:58:53.754113, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 06:58:53.754152, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:53.754294, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 80 B1 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 06:58:53.754430, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 06:58:53.755161, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 80 B1 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. [0120] D7 81 C8 0F 00 ..... [2025/04/09 06:58:53.755618, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 06:58:53.755652, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 06:58:53.755673, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:53.755695, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 06:58:53.755715, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 06:58:53.755735, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:53.755759, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:53.755823, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:53.755871, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:53.755898, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:53.755922, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:53.755947, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:53.756004, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:53.756032, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:53.756053, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:53.756074, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:53.756094, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:53.756123, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 06:58:53.756152, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:53.756191, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:53.756212, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) [2025/04/09 06:58:53.756237, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 06:58:53.756258, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 06:58:53.756451, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 06:58:53.756476, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:53.756538, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] DA 56 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .V...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 06:58:54.757754, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 06:58:54.757929, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 06:58:54.757986, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:54.758217, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 94 73 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .s...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 06:58:54.758328, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 06:58:54.758847, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 94 73 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .s...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s [0100] D0 D7 81 C8 0F 00 ...... [2025/04/09 06:58:54.759294, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 06:58:54.759323, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 06:58:54.759343, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:54.759363, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 06:58:54.759382, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 06:58:54.759400, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:54.759422, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:54.759475, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:54.759524, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:54.759551, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:54.759574, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:54.759597, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:54.759618, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:54.759640, 9, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:54.759658, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:54.759677, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:54.759695, 4, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:54.759717, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 06:58:54.759746, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 06:58:54.961494, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:56.464991, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 06:58:56.465138, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 06:58:56.465191, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 [2025/04/09 06:58:56.465232, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 06:58:56.465260, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) [2025/04/09 06:58:56.465285, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:56.465308, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:56.465327, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) [2025/04/09 06:58:56.465351, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 06:58:56.465389, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:56.465409, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:56.465432, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:56.465460, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:56.465482, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:56.465514, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:56.465536, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:56.465558, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:56.465576, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:56.465595, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:56.465613, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:56.465640, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 06:58:56.465662, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 06:58:56.465687, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 06:58:56.465729, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 06:58:56.465757, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:56.465780, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:56.465801, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename NULL) [2025/04/09 06:58:56.465823, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:56.465844, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:56.465880, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename (null)) [2025/04/09 06:58:56.465904, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 06:58:56.465932, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:56.465974, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:56.466006, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:56.466030, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:56.466051, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:56.466072, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:56.466093, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:56.466114, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:56.466132, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:56.466151, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:56.466168, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:56.466200, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 06:58:56.466223, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 06:58:56.466249, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 06:58:56.466275, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 06:58:56.466296, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:56.466318, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:56.466337, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1543(find_dc) Retrieved IP addresses for 6 DCs. [2025/04/09 06:58:56.466360, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1564(find_dc) Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). [2025/04/09 06:58:56.466429, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 445 [2025/04/09 06:58:56.476753, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 192.168.122.133 at port 445 [2025/04/09 06:58:56.476841, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 445 [2025/04/09 06:58:56.476938, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 192.168.122.206 at port 445 [2025/04/09 06:58:56.477068, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 2001:192::656a:348:28e1:d1 at port 445 [2025/04/09 06:58:56.477187, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 2001:192::c973:d0d7:81c8:f00 at port 445 [2025/04/09 06:58:56.477677, 3, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1579(find_dc) Successfully connected to DC '10.28.1.93'. [2025/04/09 06:58:56.477713, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. [2025/04/09 06:58:56.477751, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.93'. [2025/04/09 06:58:56.477776, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: adprotocolx.com) [2025/04/09 06:58:56.478534, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:58:56.478897, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 06:58:56.478923, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480463 seconds ahead) [2025/04/09 06:58:56.478993, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 06:58:56.479016, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447480463 seconds ahead) [2025/04/09 06:58:56.479055, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 06:58:56.479078, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 [2025/04/09 06:58:56.479102, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:09:56 AM 2025 EDT] (660 seconds ahead) [2025/04/09 06:58:56.479146, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1134(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f1fc [2025/04/09 06:58:56.479167, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 06:58:56.479188, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 06:58:56.479230, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX [2025/04/09 06:58:56.479255, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:56.479277, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:56.479296, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) [2025/04/09 06:58:56.479316, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 06:58:56.479334, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 06:58:56.479386, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 06:58:56.479408, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:56.479467, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 05 D9 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 06:58:57.480678, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 06:58:57.480729, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 06:58:57.480752, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:57.480818, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] D1 FC 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 06:58:57.480943, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 06:58:57.481381, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] D1 FC 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 06:58:57.481709, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 06:58:57.481736, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 06:58:57.481756, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:57.481775, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 06:58:57.481793, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 06:58:57.481811, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:57.481831, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:57.481887, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:57.481914, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:57.481938, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:57.481993, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:57.482025, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:57.482047, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:57.482074, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:57.482092, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:57.482112, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:57.482129, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:57.482152, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 06:58:57.482174, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 06:58:57.482195, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 06:58:57.482213, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) [2025/04/09 06:58:57.482233, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 06:58:57.482252, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 06:58:57.482304, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 06:58:57.482326, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:57.482382, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] A3 AB 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 06:58:57.761165, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 06:58:57.761328, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 06:58:57.761431, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744197237] [2025/04/09 06:58:57.761462, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:13:57 AM 2025 EDT] (900 seconds ahead) [2025/04/09 06:58:57.761505, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [adprotocolx.com], server = [windc2.adprotocolx.com], expire = [1744197237] [2025/04/09 06:58:57.761526, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:13:57 AM 2025 EDT] (900 seconds ahead) [2025/04/09 06:58:57.761555, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1168(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' [2025/04/09 06:58:57.761582, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 06:58:57.761821, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). [2025/04/09 06:58:57.761948, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 06:58:57.763470, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:857(cm_prepare_connection) connecting to windc2.adprotocolx.com (ADPROTOCOLX, adprotocolx.com) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] [2025/04/09 06:58:57.763530, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com [2025/04/09 06:58:57.763683, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] [2025/04/09 06:58:57.763772, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763669: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 06:58:57.764964, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763671: Sending unauthenticated request [2025/04/09 06:58:57.765023, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763672: Sending request (182 bytes) to ADPROTOCOLX.COM [2025/04/09 06:58:57.765433, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763673: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 06:58:57.766760, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763674: Received answer (219 bytes) from dgram 10.28.1.93:88 [2025/04/09 06:58:57.766824, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763675: Response was from master KDC [2025/04/09 06:58:57.766862, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763676: Received error from KDC: -1765328359/Additional pre-authentication required [2025/04/09 06:58:57.766925, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763679: Preauthenticating using KDC method data [2025/04/09 06:58:57.766980, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763680: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) [2025/04/09 06:58:57.767025, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763681: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 06:58:57.770788, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763682: AS key obtained for encrypted timestamp: aes256-cts/C8D8 [2025/04/09 06:58:57.770890, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763684: Encrypted timestamp (for 1744207136.378782): plain 301AA011180F32303235303430393133353835365AA105020305C79E, encrypted D7CD39E93E3FB8AE451F7A4F243301386C5E0FD84D4B4A8FD826AA68D0DA78EB2E3FE8ECBA5D8E4B6387C211BC6C80E3828BF6D782249E5B [2025/04/09 06:58:57.770926, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763685: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [2025/04/09 06:58:57.770949, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763686: Produced preauth for next request: PA-ENC-TIMESTAMP (2) [2025/04/09 06:58:57.771009, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763687: Sending request (261 bytes) to ADPROTOCOLX.COM [2025/04/09 06:58:57.771079, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763688: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 06:58:57.772514, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763689: Received answer (102 bytes) from dgram 10.28.1.93:88 [2025/04/09 06:58:57.772581, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763690: Response was from master KDC [2025/04/09 06:58:57.772617, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763691: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP [2025/04/09 06:58:57.772657, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763692: Request or response is too big for UDP; retrying with TCP [2025/04/09 06:58:57.772682, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763693: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) [2025/04/09 06:58:57.772754, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763694: Initiating TCP connection to stream 10.28.1.93:88 [2025/04/09 06:58:57.773343, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763695: Sending TCP request to stream 10.28.1.93:88 [2025/04/09 06:58:57.774621, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763696: Received answer (1596 bytes) from stream 10.28.1.93:88 [2025/04/09 06:58:57.774672, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763697: Terminating TCP connection to stream 10.28.1.93:88 [2025/04/09 06:58:57.774751, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763698: Response was from master KDC [2025/04/09 06:58:57.774802, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763699: Processing preauth types: PA-ETYPE-INFO2 (19) [2025/04/09 06:58:57.774831, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763700: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 06:58:57.774855, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763701: Produced preauth for next request: (empty) [2025/04/09 06:58:57.774898, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763702: AS key determined by preauth: aes256-cts/C8D8 [2025/04/09 06:58:57.775009, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763703: Decrypted AS reply; session key is: aes256-cts/7838 [2025/04/09 06:58:57.775073, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763704: FAST negotiation: unavailable [2025/04/09 06:58:57.775150, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 06:58:57.775182, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763705: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 06:58:57.775225, 10, pid=2329718, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329718] 1744196337.763706: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect [2025/04/09 06:58:57.775270, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos [2025/04/09 06:58:57.775295, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO [2025/04/09 06:58:57.775524, 5, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 06:58:57.775607, 5, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 06:58:57.779824, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x56144d5de100]: subreq: 0x56144d5d2cb0 [2025/04/09 06:58:57.779867, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x56144d5c60d0]: subreq: 0x56144d5daa10 [2025/04/09 06:58:57.779928, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x56144d5de100]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5d2cb0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x56144d5d2e90)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906] [2025/04/09 06:58:57.780042, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x56144d5c60d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5daa10/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x56144d5dabf0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] [2025/04/09 06:58:57.781971, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x56144d5de100]: subreq: 0x56144d5bfcd0 [2025/04/09 06:58:57.782006, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x56144d5c60d0]: subreq: 0x56144d5daa10 [2025/04/09 06:58:57.782033, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x56144d5de100]: NT_STATUS_OK tevent_req[0x56144d5bfcd0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x56144d5bfeb0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913] [2025/04/09 06:58:57.782091, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x56144d5c60d0]: NT_STATUS_OK tevent_req[0x56144d5daa10/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x56144d5dabf0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] [2025/04/09 06:58:57.782302, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 06:58:57.782758, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744197237] [2025/04/09 06:58:57.782786, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:13:57 AM 2025 EDT] (900 seconds ahead) [2025/04/09 06:58:57.782831, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [adprotocolx.com], server = [windc2.adprotocolx.com], expire = [1744197237] [2025/04/09 06:58:57.782853, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:13:57 AM 2025 EDT] (900 seconds ahead) [2025/04/09 06:58:57.782942, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) set_domain_online: called for domain ADPROTOCOLX [2025/04/09 06:58:57.782994, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:58:57.783113, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) messaging_dgm_send: Sending message to 2329712 [2025/04/09 06:58:57.783157, 10, pid=2329718, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403287310 seconds ahead) ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 06:58:57.783378, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=18, srvid=0 [2025/04/09 06:58:57.783633, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=17, vnn=4026531841, opcode=4, srvid=0 [2025/04/09 06:58:57.783754, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=18, vnn=4026531841, opcode=149, srvid=0 [2025/04/09 06:58:57.784013, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b [2025/04/09 06:58:57.785268, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 388c08c2e02314e8df7ed8fcdf0514ac sequence : 0x67f652e8 (1744196328) seed: struct netr_Credential data : e500ac10ed03fb68 client: struct netr_Credential data : 733e20303d222770 server: struct netr_Credential data : 722081f976cb7ee8 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 06:58:57.785668, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 06:58:57.785701, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 06:58:57.785736, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:58:57.785802, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 [2025/04/09 06:58:57.785832, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) ctdbd_migrate: Sending ctdb packet [2025/04/09 06:58:57.786398, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:58:57.786477, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:58:57.786511, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 06:58:57.786543, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 06:58:57.786562, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 06:58:57.786641, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 135 [2025/04/09 06:58:57.787079, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 06:58:57.787261, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 0, auth_level 1 [2025/04/09 06:58:57.787301, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x0000004d (77) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 06:58:57.787555, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:58:57.787578, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 72 [2025/04/09 06:58:57.787833, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 44 [2025/04/09 06:58:57.787933, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x0000004d (77) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00001094 (4244) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] AA 12 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 06:58:57.788248, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK [2025/04/09 06:58:57.788286, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 60 bytes. [2025/04/09 06:58:57.788311, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 06:58:57.788384, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : NULL map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2025/04/09 06:58:57.788929, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000004e (78) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:57.789150, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:58:57.789174, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 140 [2025/04/09 06:58:57.789698, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 136 [2025/04/09 06:58:57.789748, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x0000004e (78) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 0C 91 D0 17 86 34 09 4E B9 12 18 6B ........ .4.N...k [0010] 1A B9 1D AA 01 00 00 00 01 00 00 00 00 00 00 00 ........ ........ [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C2 0C 01 00 09 04 00 0A 1C 01 5D 00 00 00 00 00 ........ ..]..... [2025/04/09 06:58:57.790100, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128 [2025/04/09 06:58:57.790123, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK [2025/04/09 06:58:57.790142, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 128 bytes. [2025/04/09 06:58:57.790192, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 17d0910c-3486-4e09-b912-186b1ab91daa num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc20c (49676) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 10.28.1.93 result : 0x00000000 (0) [2025/04/09 06:58:57.790755, 3, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 49676 [2025/04/09 06:58:57.791368, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 06:58:57.791418, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 388c08c2e02314e8df7ed8fcdf0514ac sequence : 0x67f652e8 (1744196328) seed: struct netr_Credential data : e500ac10ed03fb68 client: struct netr_Credential data : 733e20303d222770 server: struct netr_Credential data : 722081f976cb7ee8 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 06:58:57.791824, 5, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 06:58:57.791867, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 06:58:57.791904, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 06:58:57.791968, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x56144d5c60d0]: subreq: 0x56144d5bfcd0 [2025/04/09 06:58:57.792004, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x56144d5c60d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5bfcd0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x56144d5bfeb0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 06:58:57.792038, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 06:58:57.792132, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x0000004f (79) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 06:58:57.792425, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:58:57.792448, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 111 [2025/04/09 06:58:57.792902, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 64 [2025/04/09 06:58:57.792989, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0050 (80) auth_length : 0x000c (12) call_id : 0x0000004f (79) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b5c (2908) secondary_address_size : 0x0006 (6) secondary_address : '49676' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 06:58:57.793297, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK [2025/04/09 06:58:57.793320, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 80 bytes. [2025/04/09 06:58:57.793342, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 06:58:57.793364, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 06:58:57.793400, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x56144d5c60d0]: subreq: 0x56144d5bfcd0 [2025/04/09 06:58:57.793427, 10, pid=2329718, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x56144d5c60d0]: NT_STATUS_OK tevent_req[0x56144d5bfcd0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x56144d5bfeb0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 06:58:57.793466, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 06:58:57.793487, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 06:58:57.793514, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:58:57.793538, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 06:58:57.793561, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=21, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 06:58:57.793597, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:58:57.793644, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 06:58:57.793663, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 06:58:57.793681, 5, pid=2329718, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 06:58:57.793726, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:58:57.793812, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 06:58:57.794051, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000050 (80) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000088 (136) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:58:57.794233, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:58:57.794323, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:58:57.794348, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 232 [2025/04/09 06:58:57.794938, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:58:57.795033, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000050 (80) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 9E C9 A3 FF 6C 04 78 86 0F A1 6A 2E 9E DD 06 84 ....l.x. ..j..... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 7A A1 07 91 8A 6E EC A0 A9 22 F3 82 2D B0 17 D2 z....n.. ."..-... [0030] 9C 9B 9E 3D E5 D3 27 1D 7C 3A 93 EA E8 67 33 5D ...=..'. |:...g3] [0040] F5 AA 5E DD 6A 03 2C 90 00 00 00 00 00 00 00 00 ..^.j.,. ........ [2025/04/09 06:58:57.795305, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:58:57.795329, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:58:57.795348, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:58:57.795381, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:58:57.795403, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:58:57.795422, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 06:58:57.795463, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:58:57.795562, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:58:57.795594, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:58:57.795681, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:58:57.795704, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:58:58.483029, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 06:58:58.483135, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 06:58:58.483159, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 06:58:58.483296, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 5D 37 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ]7...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 06:58:58.483396, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 06:58:58.483926, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 5D 37 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ]7...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej [0100] 03 48 28 E1 00 D1 .H(... [2025/04/09 06:58:58.484312, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 06:58:58.484342, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 06:58:58.484366, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:58.484385, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 06:58:58.484403, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 06:58:58.484421, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:58.484442, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:58.484486, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 06:58:58.484521, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 06:58:58.484553, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 06:58:58.484581, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 06:58:58.484604, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 06:58:58.484627, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 06:58:58.484649, 9, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:58.484667, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 06:58:58.484686, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 06:58:58.484703, 4, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 06:58:58.484726, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 06:58:58.484749, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 06:58:58.585861, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 06:59:01.485911, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 06:59:01.486132, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 06:59:01.486204, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744197241] [2025/04/09 06:59:01.486237, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:14:01 AM 2025 EDT] (900 seconds ahead) [2025/04/09 06:59:01.486290, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [adprotocolx.com], server = [windc2.adprotocolx.com], expire = [1744197241] [2025/04/09 06:59:01.486313, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:14:01 AM 2025 EDT] (900 seconds ahead) [2025/04/09 06:59:01.486344, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1168(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' [2025/04/09 06:59:01.486376, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 06:59:01.486608, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). [2025/04/09 06:59:01.486711, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 06:59:01.488023, 5, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:857(cm_prepare_connection) connecting to windc2.adprotocolx.com (ADPROTOCOLX, adprotocolx.com) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] [2025/04/09 06:59:01.488073, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com [2025/04/09 06:59:01.488251, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] [2025/04/09 06:59:01.488296, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488243: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 06:59:01.488772, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488245: Sending unauthenticated request [2025/04/09 06:59:01.488810, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488246: Sending request (182 bytes) to ADPROTOCOLX.COM [2025/04/09 06:59:01.489071, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488247: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 06:59:01.490175, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488248: Received answer (219 bytes) from dgram 10.28.1.93:88 [2025/04/09 06:59:01.490240, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488249: Response was from master KDC [2025/04/09 06:59:01.490277, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488250: Received error from KDC: -1765328359/Additional pre-authentication required [2025/04/09 06:59:01.490319, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488253: Preauthenticating using KDC method data [2025/04/09 06:59:01.490346, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488254: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) [2025/04/09 06:59:01.490374, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488255: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 06:59:01.494106, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488256: AS key obtained for encrypted timestamp: aes256-cts/C8D8 [2025/04/09 06:59:01.494182, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488258: Encrypted timestamp (for 1744207140.120786): plain 301AA011180F32303235303430393133353930305AA105020301D7D2, encrypted DF630BA951B598F94E572B1F4BEFD06FD421EE65E54FB9EA7269F70B56E9B6A81FE23853EF801DB0DE7F3F34EFC0975B6953983015F28C5A [2025/04/09 06:59:01.494231, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488259: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [2025/04/09 06:59:01.494256, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488260: Produced preauth for next request: PA-ENC-TIMESTAMP (2) [2025/04/09 06:59:01.494305, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488261: Sending request (261 bytes) to ADPROTOCOLX.COM [2025/04/09 06:59:01.494374, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488262: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 06:59:01.495656, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488263: Received answer (102 bytes) from dgram 10.28.1.93:88 [2025/04/09 06:59:01.495719, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488264: Response was from master KDC [2025/04/09 06:59:01.495755, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488265: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP [2025/04/09 06:59:01.495780, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488266: Request or response is too big for UDP; retrying with TCP [2025/04/09 06:59:01.495803, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488267: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) [2025/04/09 06:59:01.495874, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488268: Initiating TCP connection to stream 10.28.1.93:88 [2025/04/09 06:59:01.496329, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488269: Sending TCP request to stream 10.28.1.93:88 [2025/04/09 06:59:01.497557, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488270: Received answer (1596 bytes) from stream 10.28.1.93:88 [2025/04/09 06:59:01.497593, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488271: Terminating TCP connection to stream 10.28.1.93:88 [2025/04/09 06:59:01.497658, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488272: Response was from master KDC [2025/04/09 06:59:01.497715, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488273: Processing preauth types: PA-ETYPE-INFO2 (19) [2025/04/09 06:59:01.497744, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488274: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 06:59:01.497788, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488275: Produced preauth for next request: (empty) [2025/04/09 06:59:01.497816, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488276: AS key determined by preauth: aes256-cts/C8D8 [2025/04/09 06:59:01.497914, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488277: Decrypted AS reply; session key is: aes256-cts/B679 [2025/04/09 06:59:01.498005, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488278: FAST negotiation: unavailable [2025/04/09 06:59:01.498065, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 06:59:01.498096, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488279: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 06:59:01.498136, 10, pid=2329769, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2329769] 1744196341.488280: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect [2025/04/09 06:59:01.498179, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos [2025/04/09 06:59:01.498208, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO [2025/04/09 06:59:01.498409, 5, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 06:59:01.498479, 5, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 06:59:01.502859, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x56144d5c66d0]: subreq: 0x56144d5bd4e0 [2025/04/09 06:59:01.502894, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x56144d5c7490]: subreq: 0x56144d5d8220 [2025/04/09 06:59:01.502926, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x56144d5c66d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5bd4e0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x56144d5bd6c0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906] [2025/04/09 06:59:01.503039, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x56144d5c7490]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5d8220/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x56144d5d8400)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] [2025/04/09 06:59:01.504444, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x56144d5c66d0]: subreq: 0x56144d5c3ec0 [2025/04/09 06:59:01.504479, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x56144d5c7490]: subreq: 0x56144d5d8220 [2025/04/09 06:59:01.504506, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x56144d5c66d0]: NT_STATUS_OK tevent_req[0x56144d5c3ec0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x56144d5c40a0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913] [2025/04/09 06:59:01.504546, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x56144d5c7490]: NT_STATUS_OK tevent_req[0x56144d5d8220/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x56144d5d8400)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] [2025/04/09 06:59:01.504716, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 06:59:01.505039, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744197241] [2025/04/09 06:59:01.505072, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:14:01 AM 2025 EDT] (900 seconds ahead) [2025/04/09 06:59:01.505112, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [adprotocolx.com], server = [windc2.adprotocolx.com], expire = [1744197241] [2025/04/09 06:59:01.505134, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:14:01 AM 2025 EDT] (900 seconds ahead) [2025/04/09 06:59:01.505201, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) set_domain_online: called for domain ADPROTOCOLX [2025/04/09 06:59:01.505236, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 06:59:01.505344, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) messaging_dgm_send: Sending message to 2329712 [2025/04/09 06:59:01.505394, 10, pid=2329769, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403287306 seconds ahead) ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 06:59:01.505593, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=12, vnn=4026531841, opcode=18, srvid=0 [2025/04/09 06:59:01.505727, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=13, vnn=4026531841, opcode=4, srvid=0 [2025/04/09 06:59:01.505813, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=14, vnn=4026531841, opcode=149, srvid=0 [2025/04/09 06:59:01.505910, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b [2025/04/09 06:59:01.506024, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 388c08c2e02314e8df7ed8fcdf0514ac sequence : 0x67f652e8 (1744196328) seed: struct netr_Credential data : e500ac10ed03fb68 client: struct netr_Credential data : 733e20303d222770 server: struct netr_Credential data : 722081f976cb7ee8 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 06:59:01.506357, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 06:59:01.506382, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 06:59:01.506410, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:59:01.506457, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 [2025/04/09 06:59:01.506491, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) ctdbd_migrate: Sending ctdb packet [2025/04/09 06:59:01.507083, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:59:01.507123, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:59:01.507153, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 06:59:01.507173, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 06:59:01.507192, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 06:59:01.507250, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 135 [2025/04/09 06:59:01.507642, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 06:59:01.507804, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 0, auth_level 1 [2025/04/09 06:59:01.507840, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000009 (9) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 06:59:01.508130, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:01.508155, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 72 [2025/04/09 06:59:01.508439, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 44 [2025/04/09 06:59:01.508524, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x00000009 (9) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00001096 (4246) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] A0 B4 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 06:59:01.508792, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK [2025/04/09 06:59:01.508815, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 60 bytes. [2025/04/09 06:59:01.508838, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 06:59:01.508912, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : NULL map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2025/04/09 06:59:01.509421, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000000a (10) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:59:01.509612, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:01.509635, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 140 [2025/04/09 06:59:01.510035, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 136 [2025/04/09 06:59:01.510088, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x0000000a (10) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 7E 22 F2 60 41 07 C4 40 82 FF 06 E3 ....~".` A..@.... [0010] C0 C3 CE E1 01 00 00 00 01 00 00 00 00 00 00 00 ........ ........ [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C2 0C 01 00 09 04 00 0A 1C 01 5D 00 00 00 00 00 ........ ..]..... [2025/04/09 06:59:01.510408, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128 [2025/04/09 06:59:01.510430, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK [2025/04/09 06:59:01.510449, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 128 bytes. [2025/04/09 06:59:01.510484, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 60f2227e-0741-40c4-82ff-06e3c0c3cee1 num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc20c (49676) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 10.28.1.93 result : 0x00000000 (0) [2025/04/09 06:59:01.511058, 3, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 49676 [2025/04/09 06:59:01.511509, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 06:59:01.511561, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 388c08c2e02314e8df7ed8fcdf0514ac sequence : 0x67f652e8 (1744196328) seed: struct netr_Credential data : e500ac10ed03fb68 client: struct netr_Credential data : 733e20303d222770 server: struct netr_Credential data : 722081f976cb7ee8 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 06:59:01.511998, 5, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 06:59:01.512048, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 06:59:01.512072, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 06:59:01.512121, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x56144d5c7490]: subreq: 0x56144d5c3ec0 [2025/04/09 06:59:01.512152, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x56144d5c7490]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x56144d5c3ec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x56144d5c40a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 06:59:01.512186, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 06:59:01.512281, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x0000000b (11) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 06:59:01.512576, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:01.512599, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 111 [2025/04/09 06:59:01.512883, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 64 [2025/04/09 06:59:01.512934, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0050 (80) auth_length : 0x000c (12) call_id : 0x0000000b (11) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b5e (2910) secondary_address_size : 0x0006 (6) secondary_address : '49676' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 06:59:01.513262, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK [2025/04/09 06:59:01.513286, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 80 bytes. [2025/04/09 06:59:01.513309, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 06:59:01.513331, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 06:59:01.513360, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x56144d5c7490]: subreq: 0x56144d5c3ec0 [2025/04/09 06:59:01.513386, 10, pid=2329769, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x56144d5c7490]: NT_STATUS_OK tevent_req[0x56144d5c3ec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x56144d5c40a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 06:59:01.513425, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 06:59:01.513446, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 06:59:01.513473, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:59:01.513503, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 06:59:01.513525, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 06:59:01.513604, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 06:59:01.513637, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 06:59:01.513657, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 06:59:01.513675, 5, pid=2329769, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 06:59:01.513710, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:59:01.513799, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 06:59:01.514025, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000c (12) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000088 (136) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:59:01.514211, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:59:01.514294, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:01.514325, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 232 [2025/04/09 06:59:01.514683, 5, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:59:01.514731, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000000c (12) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 65 DB 51 A6 0D 45 A6 A6 92 54 98 74 33 9D 1A 19 e.Q..E.. .T.t3... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 14 6A 28 FE F0 22 33 F6 70 19 A7 FC 96 4A E0 EC .j(.."3. p....J.. [0030] 4A CD B7 16 7A 88 46 91 7C 3A 93 EA E8 67 33 5D J...z.F. |:...g3] [0040] F5 AA 5E DD 6A 03 2C 90 00 00 00 00 00 00 00 00 ..^.j.,. ........ [2025/04/09 06:59:01.515057, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:59:01.515080, 10, pid=2329769, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:59:01.515100, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:59:01.515132, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:59:01.515154, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:59:01.515174, 10, pid=2329769, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 06:59:01.515202, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:59:01.515295, 5, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:59:01.515324, 1, pid=2329769, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:01.515427, 4, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:59:01.515450, 10, pid=2329769, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 06:59:06.429590, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:59:06.429647, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:59:06.429736, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:06.429873, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:59:06.429991, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000051 (81) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:59:06.430190, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:59:06.430288, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:06.430315, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:59:06.430894, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:59:06.431002, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000051 (81) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] DD E5 C0 A7 34 D5 73 88 E9 53 90 5D A8 F9 4C 8E ....4.s. .S.]..L. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 3B 63 7A D6 D4 6D 0F 5E 67 F3 79 F3 EE 40 1C 18 ;cz..m.^ g.y..@.. [0030] E6 5D 2F 21 44 01 DF 5F F0 B7 5A 7A 00 02 00 00 .]/!D.._ ..Zz.... [0040] 0A 00 00 00 99 00 00 00 30 C7 7F A2 99 00 00 00 ........ 0....... [2025/04/09 06:59:06.431313, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:59:06.431336, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:59:06.431359, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:59:06.431390, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:59:06.431419, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:59:06.431447, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 06:59:06.431480, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:59:06.431554, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:59:06.431576, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:06.431633, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:59:06.431653, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:59:13.094643, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:59:13.094730, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:59:13.094847, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:13.094948, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:59:13.095080, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000052 (82) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:59:13.095301, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:59:13.095407, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:13.095454, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:59:13.096388, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:59:13.096452, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000052 (82) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 54 8A F4 F0 2E 8B AB F0 B8 91 12 00 04 C2 4D 85 T....... ......M. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 8D EC 4D CE 20 6E 60 9D 84 2F D8 E3 13 5E 85 16 ..M. n`. ./...^.. [0030] 30 27 7C D2 99 54 32 02 7C 3A 93 EA E8 67 33 5D 0'|..T2. |:...g3] [0040] F5 AA 5E DD 6A 03 2C 90 00 00 00 00 00 00 00 00 ..^.j.,. ........ [2025/04/09 06:59:13.096718, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:59:13.096740, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:59:13.096758, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:59:13.096789, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:59:13.096820, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:59:13.096848, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 06:59:13.096883, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:59:13.097001, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:59:13.097024, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:13.097083, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:59:13.097103, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:59:16.006175, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:59:16.006231, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:59:16.006284, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:16.006351, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:59:16.006426, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000053 (83) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:59:16.006618, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:59:16.006714, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:16.006741, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:59:16.007365, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:59:16.007438, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000053 (83) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 67 F5 97 48 98 2F D8 D9 A2 EC A4 D8 CC 1E 2F 9C g..H./.. ....../. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] BA 74 EE 4F E9 D7 04 FE AB 05 B7 24 54 24 BE 69 .t.O.... ...$T$.i [0030] 9B 91 B3 C6 9B 20 A3 04 7C 3A 93 EA E8 67 33 5D ..... .. |:...g3] [0040] F5 AA 5E DD 6A 03 2C 90 00 00 00 00 00 00 00 00 ..^.j.,. ........ [2025/04/09 06:59:16.007719, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:59:16.007753, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:59:16.007776, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:59:16.007809, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:59:16.007837, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:59:16.007856, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 06:59:16.007883, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:59:16.007998, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:59:16.008022, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:16.008081, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:59:16.008101, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:59:26.032915, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:59:26.033000, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:59:26.033118, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:26.033214, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:59:26.033323, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000054 (84) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:59:26.033528, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:59:26.033654, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:26.033691, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:59:26.034312, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:59:26.034403, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000054 (84) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] B1 11 67 80 67 D7 88 89 A6 D6 56 44 B8 0A 9C 3C ..g.g... ..VD...< [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] CD 51 4C 70 FA 2A C4 C1 68 66 55 2D 22 D5 58 FC .QLp.*.. hfU-".X. [0030] 03 E3 32 4E 33 74 8D 97 00 00 00 00 00 00 00 00 ..2N3t.. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:59:26.034690, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:59:26.034719, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:59:26.034739, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:59:26.034800, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:59:26.034825, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:59:26.034845, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 06:59:26.034874, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:59:26.034993, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:59:26.035020, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:26.035083, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:59:26.035104, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:59:31.044254, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:59:31.044305, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:59:31.044386, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:31.044469, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:59:31.044574, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000055 (85) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:59:31.044772, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:59:31.044896, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:31.044926, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:59:31.050237, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:59:31.050294, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000055 (85) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] FA 4B 66 F6 4D 9E 7D 72 F9 44 BE EF 09 4E 1D 4C .Kf.M.}r .D...N.L [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 02 BC D3 8C 6A A7 92 17 AF 6B 92 A8 54 25 56 25 ....j... .k..T%V% [0030] F8 32 21 2F 3A DF 10 58 B5 5E 4C 6E 14 B7 01 08 .2!/:..X .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:59:31.050577, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:59:31.050603, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:59:31.050630, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:59:31.050666, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:59:31.050690, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:59:31.050719, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 06:59:31.050757, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:59:31.050829, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:59:31.050858, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:31.050944, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:59:31.050985, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 06:59:49.396501, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 06:59:49.396577, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 06:59:49.396712, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 06:59:49.396882, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 06:59:49.397037, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000056 (86) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 06:59:49.397265, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 06:59:49.397431, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 06:59:49.397468, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 06:59:49.398130, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 06:59:49.398194, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000056 (86) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 92 1F 22 4D CF 88 73 7F 35 1C 06 DF 3E 5A 3A B3 .."M..s. 5...>Z:. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 1B 31 C6 79 A2 B9 F5 F7 AD 15 2C B8 50 D2 B2 3E .1.y.... ..,.P..> [0030] 2F 4C BD 7E 6A 40 F6 C0 B5 5E 4C 6E 14 B7 01 08 /L.~j@.. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 06:59:49.398469, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 06:59:49.398507, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 06:59:49.398525, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 06:59:49.398557, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 06:59:49.398584, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 06:59:49.398604, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 06:59:49.398636, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 06:59:49.398702, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 06:59:49.398732, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 06:59:49.398816, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 06:59:49.398838, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:00:01.050180, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:00:01.050268, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:00:01.050351, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:00:01.050447, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:00:01.050547, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000057 (87) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:00:01.050742, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:00:01.050853, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:00:01.050882, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:00:01.051800, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:00:01.051868, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000057 (87) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] E1 90 82 0C 76 AB EA 2D 20 76 E7 02 C8 1E BC 01 ....v..- v...... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] D7 D5 65 72 B2 8F 1F 61 FE 73 EC 49 C7 A8 E6 B0 ..er...a .s.I.... [0030] 87 6B 98 35 E6 6D E7 E1 B5 5E 4C 6E 14 B7 01 08 .k.5.m.. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:00:01.052244, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:00:01.052268, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:00:01.052287, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:00:01.052320, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:00:01.052342, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:00:01.052361, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:00:01.052403, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:00:01.052480, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:00:01.052502, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:00:01.052562, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:00:01.052582, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:00:16.021291, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:00:16.021370, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:00:16.021496, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:00:16.021618, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:00:16.021742, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000058 (88) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:00:16.022007, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:00:16.022138, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:00:16.022171, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:00:16.023028, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:00:16.023095, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000058 (88) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] A9 B8 AF A6 D8 35 3C 06 BD BC 34 13 2B 65 B3 9C .....5<. ..4.+e.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 6D 1E 5A 15 A4 57 72 61 0F 31 52 5D 63 BE 53 5E m.Z..Wra .1R]c.S^ [0030] 33 7C 61 64 3F 13 75 AA B5 5E 4C 6E 14 B7 01 08 3|ad?.u. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:00:16.023391, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:00:16.023416, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:00:16.023442, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:00:16.023480, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:00:16.023503, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:00:16.023569, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:00:16.023615, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:00:16.023725, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:00:16.023750, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:00:16.023816, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:00:16.023843, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:00:31.042611, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:00:31.042692, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:00:31.042869, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:00:31.043064, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:00:31.043184, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000059 (89) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:00:31.043392, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:00:31.043510, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:00:31.043554, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:00:31.044576, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:00:31.044646, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000059 (89) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 3A 0A 01 3E A5 C0 2E 96 5E 23 81 4B AE AA B2 6B :..>.... ^#.K...k [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 18 2A 19 5B C3 8F 6B B0 6E 3E 41 C8 80 5B 8F B9 .*.[..k. n>A..[.. [0030] EB EE AE 65 9B E3 B4 91 B5 5E 4C 6E 14 B7 01 08 ...e.... .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:00:31.044997, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:00:31.045033, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:00:31.045056, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:00:31.045100, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:00:31.045134, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:00:31.045171, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:00:31.045202, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:00:31.045278, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:00:31.045302, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:00:31.045362, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:00:31.045382, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:00:46.020541, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:00:46.020609, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:00:46.020720, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:00:46.020817, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:00:46.020926, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000005a (90) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:00:46.021166, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:00:46.021358, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:00:46.021415, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:00:46.024981, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:00:46.025046, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000005a (90) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 2F 86 70 0F B4 4A BC AE D8 AB C9 8A 19 3D 46 8F /.p..J.. .....=F. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] A9 23 CB 1C 1D 99 E0 49 40 4B 73 4E 3A D4 83 DE .#.....I @KsN:... [0030] 1E 6E 49 A6 E0 FB 7C B7 B5 5E 4C 6E 14 B7 01 08 .nI...|. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:00:46.025331, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:00:46.025353, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:00:46.025376, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:00:46.025417, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:00:46.025448, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:00:46.025468, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:00:46.025510, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:00:46.025604, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:00:46.025627, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:00:46.025715, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:00:46.025744, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:01:01.044583, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:01:01.044655, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:01:01.044743, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:01:01.044818, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:01:01.044909, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000005b (91) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:01:01.045190, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:01:01.045293, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:01:01.045321, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:01:01.048144, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:01:01.048202, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000005b (91) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 38 65 BB 29 ED 9E 33 CC 1C 54 AB 41 81 27 A6 3B 8e.)..3. .T.A.'.; [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 7E 6E 38 9D 93 36 F5 08 33 67 53 09 F7 AD B9 25 ~n8..6.. 3gS....% [0030] 14 33 54 A1 F9 A3 47 C1 B5 5E 4C 6E 14 B7 01 08 .3T...G. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:01:01.048459, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:01:01.048480, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:01:01.048505, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:01:01.048539, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:01:01.048576, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:01:01.048614, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:01:01.048654, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:01:01.048721, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:01:01.048743, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:01:01.048810, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:01:01.048831, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:01:16.066640, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:01:16.066698, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:01:16.066834, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:01:16.066998, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:01:16.067127, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000005c (92) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:01:16.067359, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:01:16.067531, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:01:16.067570, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:01:16.068177, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:01:16.068266, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000005c (92) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 3F 51 02 54 1B 66 C1 F1 DB 14 CD 2A 93 97 4E 5D ?Q.T.f.. ...*..N] [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 08 01 CB D0 4F 94 18 37 2A B1 CD 12 7D 6A F9 7D ....O..7 *...}j.} [0030] 1B 29 9E C4 B7 18 64 1B B5 5E 4C 6E 14 B7 01 08 .)....d. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:01:16.068546, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:01:16.068571, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:01:16.068591, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:01:16.068632, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:01:16.068663, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:01:16.068685, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:01:16.068715, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:01:16.068785, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:01:16.068824, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:01:16.068897, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:01:16.068920, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:01:31.062008, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:01:31.062106, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:01:31.062226, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:01:31.062341, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:01:31.062474, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000005d (93) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:01:31.062680, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:01:31.062792, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:01:31.062821, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:01:31.079077, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:01:31.079145, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000005d (93) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] ED DE 56 83 AB 66 FA B8 72 90 47 66 05 A6 6D 58 ..V..f.. r.Gf..mX [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] E2 13 C0 6F 97 AA E1 9E 5F 82 33 14 79 1E DA 6D ...o.... _.3.y..m [0030] 91 7D DA B3 3E 88 AB B3 B5 5E 4C 6E 14 B7 01 08 .}..>... .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:01:31.079413, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:01:31.079457, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:01:31.079479, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:01:31.079537, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:01:31.079560, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:01:31.079579, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:01:31.079620, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:01:31.079700, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:01:31.079722, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:01:31.079792, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:01:31.079823, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:01:46.023203, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:01:46.023269, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:01:46.023376, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:01:46.023466, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:01:46.023587, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000005e (94) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:01:46.023819, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:01:46.023924, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:01:46.023973, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:01:46.025036, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:01:46.025088, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000005e (94) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] AC F6 98 66 95 4C 51 0D 2C C5 48 61 36 AB 66 55 ...f.LQ. ,.Ha6.fU [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] F3 4D 06 A9 1F 02 C8 32 11 00 66 D3 2C 9C D6 42 .M.....2 ..f.,..B [0030] 31 B0 C3 AC 9D DC 12 9E 8C 7A 36 8B 1D 20 81 83 1....... .z6.. .. [0040] 55 C5 CB 05 E9 46 A6 B4 1A D1 EF EF 1E D5 AF 86 U....F.. ........ [2025/04/09 07:01:46.025452, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:01:46.025475, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:01:46.025500, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:01:46.025533, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:01:46.025554, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:01:46.025584, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:01:46.025613, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:01:46.025701, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:01:46.025724, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:01:46.025783, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:01:46.025803, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:02:01.035175, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:02:01.035258, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:02:01.035436, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:02:01.035588, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:02:01.035724, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000005f (95) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:02:01.035987, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:02:01.036114, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:02:01.036149, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:02:01.044692, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:02:01.044749, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000005f (95) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 96 78 70 B9 A8 09 67 3A E6 58 D2 71 6A D5 58 54 .xp...g: .X.qj.XT [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] F2 D5 99 EF CA A4 10 0C 89 83 DA 4E 33 18 61 79 ........ ...N3.ay [0030] B3 FC 1B 85 2C 4F 21 E1 8C 7A 36 8B 1D 20 81 83 ....,O!. .z6.. .. [0040] 55 C5 CB 05 E9 46 A6 B4 1A D1 EF EF 1E D5 AF 86 U....F.. ........ [2025/04/09 07:02:01.045053, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:02:01.045078, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:02:01.045102, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:02:01.045143, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:02:01.045172, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:02:01.045199, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:02:01.045234, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:02:01.045318, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:02:01.045340, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:02:01.045399, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:02:01.045419, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:02:19.423563, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:02:19.423634, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:02:19.423741, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:02:19.423841, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:02:19.423992, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000060 (96) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:02:19.424215, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:02:19.424352, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:02:19.424387, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:02:19.425046, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:02:19.425127, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000060 (96) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 06 4D ED D1 C1 5C DE 4D 92 B1 A1 8E 87 31 D9 23 .M...\.M .....1.# [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 9D 05 B5 B3 98 18 F5 98 E8 85 83 ED A6 92 26 38 ........ ......&8 [0030] 5A 73 2B 89 E1 FA 8E 90 83 B1 4D 7A 5B 50 D6 E1 Zs+..... ..Mz[P.. [0040] 5B 9C 55 60 4F E0 34 84 F2 5D 0D A6 E7 80 31 B8 [.U`O.4. .]....1. [2025/04/09 07:02:19.425503, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:02:19.425527, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:02:19.425550, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:02:19.425584, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:02:19.425605, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:02:19.425632, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:02:19.425660, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:02:19.425742, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:02:19.425765, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:02:19.425837, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:02:19.425858, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:02:31.059269, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:02:31.059328, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:02:31.059463, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:02:31.059607, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:02:31.059726, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000061 (97) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:02:31.059984, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:02:31.060150, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:02:31.060188, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:02:31.060943, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:02:31.061055, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000061 (97) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] A1 C0 83 3D 44 C2 FF E4 40 D0 AA CB 65 52 11 3D ...=D... @...eR.= [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 58 ED 17 DC A0 37 CD 5F 29 C1 05 45 7E 00 4C 31 X....7._ )..E~.L1 [0030] 22 E1 43 CC 06 74 69 6A 00 00 00 00 00 00 00 00 ".C..tij ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:02:31.061336, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:02:31.061367, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:02:31.061387, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:02:31.061420, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:02:31.061471, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:02:31.061493, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:02:31.061533, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:02:31.061601, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:02:31.061639, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:02:31.061711, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:02:31.061733, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:02:46.041281, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:02:46.041343, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:02:46.041413, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:02:46.041499, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:02:46.041576, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000062 (98) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:02:46.041808, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:02:46.041910, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:02:46.041939, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:02:46.042646, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:02:46.042738, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000062 (98) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 1E BA 26 D6 2D D8 CA 48 99 AB 59 81 74 1E F5 F6 ..&.-..H ..Y.t... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 4B 0A 52 EC FE 1E BD B4 5F 1E A3 D7 B0 25 6B 7A K.R..... _....%kz [0030] 54 77 A4 44 31 B0 C5 62 00 00 00 00 00 00 00 00 Tw.D1..b ........ [0040] 90 2C 5C 7A 00 02 00 00 00 00 00 00 00 00 00 00 .,\z.... ........ [2025/04/09 07:02:46.043084, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:02:46.043114, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:02:46.043134, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:02:46.043167, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:02:46.043189, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:02:46.043208, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:02:46.043235, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:02:46.043302, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:02:46.043323, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:02:46.043386, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:02:46.043406, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:03:01.065228, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:03:01.065328, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:03:01.065455, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:03:01.065567, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:03:01.065699, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000063 (99) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:03:01.065917, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:03:01.066053, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:03:01.066082, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:03:01.066719, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:03:01.066783, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000063 (99) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 19 EE 6C BD 74 ED 10 B2 71 71 B8 BD 57 80 54 1B ..l.t... qq..W.T. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 04 E6 27 93 5C 00 DF DE 8F E9 34 A6 1B 5D AA 22 ..'.\... ..4..]." [0030] 4C A5 DE 97 8A 8C 3F E9 B5 5E 4C 6E 14 B7 01 08 L.....?. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:03:01.067126, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:03:01.067150, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:03:01.067169, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:03:01.067207, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:03:01.067228, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:03:01.067256, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:03:01.067295, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:03:01.067380, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:03:01.067403, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:03:01.067462, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:03:01.067482, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:03:16.048530, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:03:16.048587, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:03:16.048710, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:03:16.048853, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:03:16.048980, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000064 (100) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:03:16.049228, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:03:16.049351, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:03:16.049380, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:03:16.050010, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:03:16.050085, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000064 (100) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] F2 DA F0 EC 4F 67 E2 7C 41 EF 69 CA 7B 9A AE BA ....Og.| A.i.{... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 92 B4 AC 9F 18 45 EB 46 1E 17 79 D2 AF 9E D9 FD .....E.F ..y..... [0030] 4D C0 EE 63 53 07 9E 36 B5 5E 4C 6E 14 B7 01 08 M..cS..6 .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:03:16.050406, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:03:16.050431, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:03:16.050451, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:03:16.050486, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:03:16.050509, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:03:16.050539, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:03:16.050569, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:03:16.050638, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:03:16.050661, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:03:16.050723, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:03:16.050744, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:03:31.090214, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:03:31.090313, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:03:31.090541, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:03:31.090709, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:03:31.090850, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000065 (101) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:03:31.091142, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:03:31.091299, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:03:31.091343, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:03:31.094417, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:03:31.094489, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000065 (101) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] C2 40 61 E5 AE 6E CF F3 7D 1A 9F 29 0A C8 B2 26 .@a..n.. }..)...& [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] EE E3 2F 1F E0 BD 72 71 51 4C 88 CD 2B 06 A3 64 ../...rq QL..+..d [0030] 20 F4 DC 27 0C AA 6C BD 00 00 00 00 00 00 00 00 ..'..l. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:03:31.094826, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:03:31.094852, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:03:31.094872, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:03:31.094908, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:03:31.094931, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:03:31.094990, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:03:31.095038, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:03:31.095153, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:03:31.095177, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:03:31.095261, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:03:31.095284, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:03:46.064374, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:03:46.064439, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:03:46.064569, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:03:46.064704, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:03:46.064841, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000066 (102) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:03:46.065077, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:03:46.065231, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:03:46.065268, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:03:46.067245, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:03:46.067319, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000066 (102) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 84 9C 15 00 6D 32 9A A2 1B C3 27 E4 27 CD 8B 09 ....m2.. ..'.'... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 37 3E 76 62 2F 95 2D 2D 41 56 6A 01 95 7C D5 52 7>vb/.-- AVj..|.R [0030] 99 57 6C 16 A8 FD F2 0E B5 5E 4C 6E 14 B7 01 08 .Wl..... .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:03:46.067612, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:03:46.067637, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:03:46.067656, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:03:46.067711, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:03:46.067743, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:03:46.067781, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:03:46.067809, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:03:46.067884, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:03:46.067913, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:03:46.068024, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:03:46.068048, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:04:01.081838, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:04:01.081903, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:04:01.082040, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:04:01.082136, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:04:01.082230, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000067 (103) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:04:01.082425, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:04:01.082536, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:04:01.082565, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:04:01.083532, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:04:01.083586, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000067 (103) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 65 2E DF FF 8A 08 CB 9A 0A FB B0 79 F1 1B 2D 1F e....... ...y..-. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 9B DC A4 D1 89 68 82 93 52 3F A2 50 FA 64 C6 54 .....h.. R?.P.d.T [0030] 24 A6 98 F1 EA EB 26 0B D8 EA 16 74 00 02 00 00 $.....&. ...t.... [0040] F8 EA 16 74 00 02 00 00 04 00 00 00 B1 FA 99 13 ...t.... ........ [2025/04/09 07:04:01.083852, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:04:01.083875, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:04:01.083893, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:04:01.083925, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:04:01.083985, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:04:01.084006, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:04:01.084034, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:04:01.084101, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:04:01.084132, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:04:01.084192, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:04:01.084212, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:04:16.063561, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:04:16.063663, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:04:16.063795, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:04:16.063929, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:04:16.064115, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000068 (104) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:04:16.064357, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:04:16.064478, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:04:16.064508, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:04:16.065150, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:04:16.065223, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000068 (104) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] A1 28 6F C3 F3 76 F4 15 E4 20 92 FE DA 16 DB 86 .(o..v.. . ...... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 9A 25 44 70 1C F9 20 6A C0 AF D2 DE D7 F8 99 C6 .%Dp.. j ........ [0030] 03 E3 7A 4D 31 6F 6A 0E 00 00 00 00 00 00 00 00 ..zM1oj. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:04:16.065518, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:04:16.065542, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:04:16.065562, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:04:16.065595, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:04:16.065617, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:04:16.065645, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:04:16.065686, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:04:16.065774, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:04:16.065797, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:04:16.065864, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:04:16.065884, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:04:31.083950, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:04:31.084026, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:04:31.084175, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:04:31.084317, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:04:31.084424, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000069 (105) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:04:31.084689, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:04:31.084819, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:04:31.084853, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:04:31.085401, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:04:31.085472, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000069 (105) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] F0 3C 89 7D 0A A5 99 31 47 29 3C 3E 3F 15 10 00 .<.}...1 G)<>?... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 54 13 0F 53 B9 9A ED CC CE 9B C6 11 1D AE 10 0A T..S.... ........ [0030] 89 7A 37 CF F3 7B 84 DC 00 00 00 00 00 00 00 00 .z7..{.. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:04:31.085768, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:04:31.085797, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:04:31.085818, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:04:31.085852, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:04:31.085876, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:04:31.085905, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:04:31.085936, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:04:31.086054, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:04:31.086079, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:04:31.086144, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:04:31.086166, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:04:49.426249, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:04:49.426393, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:04:49.426567, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:04:49.426687, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:04:49.426831, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000006a (106) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:04:49.427045, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:04:49.427157, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:04:49.427200, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:04:49.427790, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:04:49.427847, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000006a (106) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] D9 D6 3B 9D 15 C4 5F DC F8 AB DC DB 1A 4C 32 38 ..;..._. .....L28 [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 15 96 F9 99 43 64 72 28 AF 50 98 F1 BE 83 E7 BE ....Cdr( .P...... [0030] 11 5C DE 60 C2 47 63 5F 00 00 00 00 00 00 00 00 .\.`.Gc_ ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:04:49.428169, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:04:49.428192, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:04:49.428211, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:04:49.428243, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:04:49.428264, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:04:49.428287, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:04:49.428321, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:04:49.428421, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:04:49.428444, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:04:49.428512, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:04:49.428532, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:05:01.119646, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:05:01.119714, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:05:01.119855, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:05:01.120041, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:05:01.120184, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000006b (107) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:05:01.120419, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:05:01.120614, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:05:01.120653, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:05:01.121926, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:05:01.122037, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000006b (107) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 7F 17 53 E6 3B 0A A8 EF EE 25 0B BC 64 3F 59 C7 ..S.;... .%..d?Y. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 72 A0 A0 4A C4 E1 A3 7A 4B F7 0B 27 9F 7E 82 2A r..J...z K..'.~.* [0030] 22 BA C2 91 5A 2A 40 B5 00 00 00 00 00 00 00 00 "...Z*@. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:05:01.122337, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:05:01.122363, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:05:01.122382, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:05:01.122416, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:05:01.122445, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:05:01.122473, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:05:01.122510, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:05:01.122579, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:05:01.122618, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:05:01.122696, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:05:01.122718, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:05:16.068552, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:05:16.068625, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:05:16.068697, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:05:16.068786, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:05:16.068880, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000006c (108) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:05:16.069122, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:05:16.069238, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:05:16.069268, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:05:16.069999, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:05:16.070068, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000006c (108) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] C4 19 18 DC 31 76 F7 4B E4 3B 64 19 44 A4 45 BD ....1v.K .;d.D.E. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] DE E1 1D 7D 72 74 32 01 EF BF E9 41 D9 1D DA 11 ...}rt2. ...A.... [0030] 4E 26 EF 7E AA 6D A5 9E 00 00 00 00 00 00 00 00 N&.~.m.. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:05:16.070481, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:05:16.070505, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:05:16.070524, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:05:16.070555, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:05:16.070577, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:05:16.070596, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:05:16.070623, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:05:16.070689, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:05:16.070711, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:05:16.070769, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:05:16.070789, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:05:31.103641, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:05:31.103735, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:05:31.103900, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:05:31.104080, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:05:31.104240, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000006d (109) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:05:31.104444, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:05:31.104564, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:05:31.104592, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:05:31.111013, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:05:31.111076, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000006d (109) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] B3 C4 9C E0 3A 51 19 8B 77 67 8A 79 99 1B 0F 5D ....:Q.. wg.y...] [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 1E 3B A6 CB EA C2 EF 5A 24 70 C9 FB EB 94 BB 2F .;.....Z $p...../ [0030] 09 28 31 E1 7E 01 DB 87 D8 EA 16 74 00 02 00 00 .(1.~... ...t.... [0040] F8 EA 16 74 00 02 00 00 04 00 00 00 B1 FA 99 13 ...t.... ........ [2025/04/09 07:05:31.111500, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:05:31.111537, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:05:31.111557, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:05:31.111612, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:05:31.111634, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:05:31.111668, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:05:31.111715, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:05:31.111804, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:05:31.111827, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:05:31.111890, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:05:31.111911, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:05:46.081765, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:05:46.081834, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:05:46.081982, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:05:46.082119, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:05:46.082240, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000006e (110) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:05:46.082436, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:05:46.082540, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:05:46.082578, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:05:46.083438, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:05:46.083513, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000006e (110) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 0B 7D 24 5B 26 5D 1C 00 50 1B 7B EF 23 9F E5 EE .}$[&].. P.{.#... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 3A 1B A6 35 26 F9 36 4D BC F6 9F 9F 4A CB A2 9D :..5&.6M ....J... [0030] 39 07 82 5C 2D 64 22 2D D8 EA 16 74 00 02 00 00 9..\-d"- ...t.... [0040] F8 EA 16 74 00 02 00 00 04 00 00 00 B1 FA 99 13 ...t.... ........ [2025/04/09 07:05:46.083848, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:05:46.083872, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:05:46.083891, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:05:46.083925, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:05:46.083947, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:05:46.083994, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:05:46.084032, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:05:46.084109, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:05:46.084131, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:05:46.084191, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:05:46.084212, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:06:01.106897, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:06:01.106998, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:06:01.107115, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:06:01.107219, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:06:01.107334, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000006f (111) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:06:01.107525, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:06:01.107632, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:06:01.107671, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:06:01.108511, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:06:01.108591, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000006f (111) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 70 0B A2 9C E6 DA B2 71 FE 6C F2 51 13 37 E4 5E p......q .l.Q.7.^ [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 4D 19 26 6C 79 6A C8 2E E8 1E F9 53 FA 48 91 75 M.&lyj.. ...S.H.u [0030] E9 F7 D1 4E 37 DB 9C E4 00 00 00 00 00 00 00 00 ...N7... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:06:01.108890, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:06:01.108914, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:06:01.108945, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:06:01.109006, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:06:01.109029, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:06:01.109049, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:06:01.109084, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:06:01.109184, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:06:01.109206, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:06:01.109279, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:06:01.109300, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:06:16.088313, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:06:16.088380, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:06:16.088491, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:06:16.088607, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:06:16.088706, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000070 (112) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:06:16.088902, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:06:16.089042, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:06:16.089077, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:06:16.089716, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:06:16.089784, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000070 (112) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 21 06 FA 6F 58 4F C1 56 3E 1A B9 E4 F6 3C 8E 4F !..oXO.V >....<.O [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] A8 78 4E A3 D9 50 A1 A4 2F 44 E0 25 D5 B3 91 36 .xN..P.. /D.%...6 [0030] B7 C0 A5 57 2E 70 AC 7B B5 5E 4C 6E 14 B7 01 08 ...W.p.{ .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:06:16.090228, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:06:16.090255, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:06:16.090274, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:06:16.090308, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:06:16.090330, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:06:16.090358, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:06:16.090398, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:06:16.090479, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:06:16.090521, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:06:16.090610, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:06:16.090632, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:06:31.093469, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:06:31.093536, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:06:31.093657, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:06:31.093773, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:06:31.093882, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000071 (113) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:06:31.094126, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:06:31.094286, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:06:31.094321, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:06:31.095496, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:06:31.095551, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000071 (113) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] BC AC 86 38 2D 73 76 81 AB 97 B1 2B A9 9F F2 43 ...8-sv. ...+...C [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 8E 9C C6 BF 15 FB 40 B3 12 E6 00 86 7F ED E8 9C ......@. ........ [0030] 0A AC 50 9A 8E CF 31 7A B5 5E 4C 6E 14 B7 01 08 ..P...1z .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:06:31.095831, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:06:31.095854, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:06:31.095872, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:06:31.095904, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:06:31.095933, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:06:31.095988, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:06:31.096024, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:06:31.096100, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:06:31.096131, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:06:31.096195, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:06:31.096217, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:06:46.097965, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:06:46.098076, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:06:46.098213, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:06:46.098328, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:06:46.098463, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000072 (114) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:06:46.098668, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:06:46.098798, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:06:46.098830, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:06:46.099535, 5, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:06:46.099594, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000072 (114) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 86 95 28 05 38 54 24 8B 07 52 20 50 DB 76 60 9A ..(.8T$. .R P.v`. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] EC C5 57 4A 68 37 6B C6 8F 23 4F 45 CC C3 7C EE ..WJh7k. .#OE..|. [0030] 08 F7 BB 61 5A 1B 34 47 7B 6F 64 A6 60 3E DB D8 ...aZ.4G {od.`>.. [0040] 6E EA 43 B1 38 A4 BB C1 15 A3 80 03 91 75 E1 B8 n.C.8... .....u.. [2025/04/09 07:06:46.099880, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:06:46.099905, 10, pid=2329718, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:06:46.099925, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:06:46.100000, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:06:46.100032, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:06:46.100053, 10, pid=2329718, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:06:46.100097, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:06:46.100181, 5, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:06:46.100206, 1, pid=2329718, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:06:46.100276, 4, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:06:46.100298, 10, pid=2329718, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent Logs name: log.winbindd.scenario2 ======================== [2025/04/09 07:30:31.351116, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:31.351326, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:31.351355, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2382516)]: request interface version (version = 32) [2025/04/09 07:30:31.351584, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382516):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:31.352386, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:30:31.352418, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2382516)]: ping [2025/04/09 07:30:31.352488, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382516):PING]: delivered response to client [2025/04/09 07:30:31.355382, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:31.373905, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:31.374032, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:31.374062, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2382523)]: request interface version (version = 32) [2025/04/09 07:30:31.374110, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382523):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:31.374247, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:31.374275, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2382523)]: request interface version (version = 32) [2025/04/09 07:30:31.374317, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382523):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:31.374436, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:30:31.374472, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2382523)]: request misc info [2025/04/09 07:30:31.374516, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382523):INFO]: delivered response to client [2025/04/09 07:30:31.374622, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:30:31.374653, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2382523)]: request netbios name [2025/04/09 07:30:31.374694, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382523):NETBIOS_NAME]: delivered response to client [2025/04/09 07:30:31.374786, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:30:31.374810, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2382523)]: request domain name [2025/04/09 07:30:31.374848, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382523):DOMAIN_NAME]: delivered response to client [2025/04/09 07:30:31.374941, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2382523)] Handling async request: DOMAIN_INFO [2025/04/09 07:30:31.374995, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2382523]: domain_info [ADPROTOCOLX] [2025/04/09 07:30:31.375041, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2382523):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:30:31.375089, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382523):DOMAIN_INFO]: delivered response to client [2025/04/09 07:30:31.375188, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2382523)] Handling async request: PING_DC [2025/04/09 07:30:31.375243, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:31.377834, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:31.377911, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2382523):PING_DC]: NT_STATUS_OK [2025/04/09 07:30:31.377978, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382523):PING_DC]: delivered response to client [2025/04/09 07:30:31.381566, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:36.890938, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:36.891130, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:36.891165, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2382630)]: request interface version (version = 32) [2025/04/09 07:30:36.891226, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382630):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:36.891434, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:36.891459, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2382630)]: request interface version (version = 32) [2025/04/09 07:30:36.891506, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382630):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:36.891719, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:30:36.891753, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2382630)]: request misc info [2025/04/09 07:30:36.891802, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382630):INFO]: delivered response to client [2025/04/09 07:30:36.891925, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:30:36.891950, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2382630)]: request netbios name [2025/04/09 07:30:36.892029, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382630):NETBIOS_NAME]: delivered response to client [2025/04/09 07:30:36.892104, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:30:36.892147, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2382630)]: request domain name [2025/04/09 07:30:36.892190, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382630):DOMAIN_NAME]: delivered response to client [2025/04/09 07:30:36.892408, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2382630)] Handling async request: DOMAIN_INFO [2025/04/09 07:30:36.892435, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2382630]: domain_info [ADPROTOCOLX] [2025/04/09 07:30:36.892463, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2382630):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:30:36.892512, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382630):DOMAIN_INFO]: delivered response to client [2025/04/09 07:30:36.892654, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2382630)] Handling async request: PING_DC [2025/04/09 07:30:36.892718, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:36.894968, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:36.895041, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2382630):PING_DC]: NT_STATUS_OK [2025/04/09 07:30:36.895090, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382630):PING_DC]: delivered response to client [2025/04/09 07:30:36.895343, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:36.899020, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:36.899099, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:36.899122, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2382631)]: request interface version (version = 32) [2025/04/09 07:30:36.899177, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2382631):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:36.899390, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2382631)] Handling async request: GETPWUID [2025/04/09 07:30:36.899425, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2382631)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:30:36.899476, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:30:36.899569, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:30:36.899596, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:36.899629, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:36.905096, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:30:36.905180, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:36.905204, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:30:36.905225, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:30:36.905243, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:36.905265, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:36.909484, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:30:36.909578, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:36.909599, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:36.909621, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:30:36.909639, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:30:36.909676, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:30:36 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:30:36.909726, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:30:36 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:30:36.909766, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:30:36.909786, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:36.909813, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:36.909848, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:36.909881, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:30:36.909914, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:30:36.909939, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:36.909989, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:30:36.910011, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:30:36.910029, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:30:36.910049, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:30:36.910067, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:36.910087, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:36.910106, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:36.910126, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:30:36.910147, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:30:36.910196, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:30:36.910256, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:30:36.910282, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:36.910380, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:30:36.910405, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:30:36.910433, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:30:36.910496, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:30:36.910519, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:30:36.910557, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:36.922846, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:30:36.922887, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:30:36.923010, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:30:36.923031, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:30:36.923066, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:36.923179, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:30:36.923209, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:36.925496, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:30:36.925658, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:36.925773, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:30:36.925791, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:36.925937, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:30:36.926048, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:30:36.926079, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2382631):GETPWUID]: NT_STATUS_OK [2025/04/09 07:30:36.926138, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2382631):GETPWUID]: delivered response to client [2025/04/09 07:30:36.926330, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:42.361053, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:42.361267, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:42.361294, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2382653)]: request interface version (version = 32) [2025/04/09 07:30:42.361345, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382653):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:42.361441, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:42.361464, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2382653)]: request interface version (version = 32) [2025/04/09 07:30:42.361509, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382653):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:42.361576, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:30:42.361598, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2382653)]: request misc info [2025/04/09 07:30:42.361651, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382653):INFO]: delivered response to client [2025/04/09 07:30:42.361711, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:30:42.361733, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2382653)]: request netbios name [2025/04/09 07:30:42.361775, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382653):NETBIOS_NAME]: delivered response to client [2025/04/09 07:30:42.361833, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:30:42.361855, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2382653)]: request domain name [2025/04/09 07:30:42.361903, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382653):DOMAIN_NAME]: delivered response to client [2025/04/09 07:30:42.361985, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2382653)] Handling async request: DOMAIN_INFO [2025/04/09 07:30:42.362015, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2382653]: domain_info [ADPROTOCOLX] [2025/04/09 07:30:42.362045, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2382653):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:30:42.362114, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382653):DOMAIN_INFO]: delivered response to client [2025/04/09 07:30:42.362200, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2382653)] Handling async request: PING_DC [2025/04/09 07:30:42.362250, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:42.364613, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:42.364706, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2382653):PING_DC]: NT_STATUS_OK [2025/04/09 07:30:42.364762, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2382653):PING_DC]: delivered response to client [2025/04/09 07:30:42.364830, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:42.367912, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:42.368032, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:42.368060, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2382654)]: request interface version (version = 32) [2025/04/09 07:30:42.368102, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2382654):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:42.368217, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2382654)] Handling async request: GETPWUID [2025/04/09 07:30:42.368253, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2382654)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:30:42.368277, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:30:42.368325, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:30:42.368350, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:42.368380, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:42.369525, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:30:42.369619, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:42.369656, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:30:42.369679, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:30:42.369709, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:42.369734, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:42.372296, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:30:42.372391, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:42.372414, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:42.372436, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:30:42.372455, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:30:42.372483, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:30:42 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:30:42.372539, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:30:42 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:30:42.372574, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:30:42.372594, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:42.372616, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:42.372656, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:42.372685, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:30:42.372722, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:30:42.372746, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:42.372772, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:30:42.372793, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:30:42.372811, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:30:42.372832, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:30:42.372851, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:42.372871, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:42.372890, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:42.372910, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:30:42.372929, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:30:42.372949, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:30:42.373003, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:30:42.373034, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:42.373125, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:30:42.373145, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:30:42.373167, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:30:42.373200, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:30:42.373222, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:30:42.373248, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:42.376264, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:30:42.376307, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:30:42.376391, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:30:42.376412, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:30:42.376432, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:42.376530, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:30:42.376554, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:42.378643, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:30:42.378802, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:42.378908, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:30:42.378927, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:42.379123, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:30:42.379153, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:30:42.379191, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2382654):GETPWUID]: NT_STATUS_OK [2025/04/09 07:30:42.379245, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2382654):GETPWUID]: delivered response to client [2025/04/09 07:30:42.379855, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:43.548286, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:30:43.548363, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:30:43.548385, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:30:43.548418, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:30:43.548441, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:30:43.548463, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:30:46.356308, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:46.356629, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:46.356664, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383027)]: request interface version (version = 32) [2025/04/09 07:30:46.356723, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383027):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:46.356889, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:30:46.356923, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2383027)]: ping [2025/04/09 07:30:46.356978, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383027):PING]: delivered response to client [2025/04/09 07:30:46.358117, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:46.377284, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:46.377378, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:46.377403, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383032)]: request interface version (version = 32) [2025/04/09 07:30:46.377450, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383032):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:46.378639, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:46.378669, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383032)]: request interface version (version = 32) [2025/04/09 07:30:46.378725, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383032):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:46.380870, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:30:46.380901, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2383032)]: request misc info [2025/04/09 07:30:46.380948, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383032):INFO]: delivered response to client [2025/04/09 07:30:46.382394, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:30:46.382430, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2383032)]: request netbios name [2025/04/09 07:30:46.382481, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383032):NETBIOS_NAME]: delivered response to client [2025/04/09 07:30:46.382621, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:30:46.382646, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2383032)]: request domain name [2025/04/09 07:30:46.382709, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383032):DOMAIN_NAME]: delivered response to client [2025/04/09 07:30:46.382780, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383032)] Handling async request: DOMAIN_INFO [2025/04/09 07:30:46.382821, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2383032]: domain_info [ADPROTOCOLX] [2025/04/09 07:30:46.382851, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383032):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:30:46.382898, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383032):DOMAIN_INFO]: delivered response to client [2025/04/09 07:30:46.382978, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383032)] Handling async request: PING_DC [2025/04/09 07:30:46.383036, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:46.385540, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:46.385603, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383032):PING_DC]: NT_STATUS_OK [2025/04/09 07:30:46.385659, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383032):PING_DC]: delivered response to client [2025/04/09 07:30:46.388028, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:47.831481, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:47.831609, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:47.831643, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383105)]: request interface version (version = 32) [2025/04/09 07:30:47.831690, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383105):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:47.831811, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:47.831836, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383105)]: request interface version (version = 32) [2025/04/09 07:30:47.831874, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383105):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:47.831996, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:30:47.832036, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2383105)]: request misc info [2025/04/09 07:30:47.832084, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383105):INFO]: delivered response to client [2025/04/09 07:30:47.832204, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:30:47.832228, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2383105)]: request netbios name [2025/04/09 07:30:47.832275, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383105):NETBIOS_NAME]: delivered response to client [2025/04/09 07:30:47.832366, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:30:47.832389, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2383105)]: request domain name [2025/04/09 07:30:47.832426, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383105):DOMAIN_NAME]: delivered response to client [2025/04/09 07:30:47.832513, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383105)] Handling async request: DOMAIN_INFO [2025/04/09 07:30:47.832538, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2383105]: domain_info [ADPROTOCOLX] [2025/04/09 07:30:47.832575, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383105):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:30:47.832619, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383105):DOMAIN_INFO]: delivered response to client [2025/04/09 07:30:47.832716, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383105)] Handling async request: PING_DC [2025/04/09 07:30:47.832767, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:47.835128, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:47.835198, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383105):PING_DC]: NT_STATUS_OK [2025/04/09 07:30:47.835242, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383105):PING_DC]: delivered response to client [2025/04/09 07:30:47.836020, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:47.838515, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:47.838599, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:47.838628, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2383106)]: request interface version (version = 32) [2025/04/09 07:30:47.838676, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2383106):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:47.839001, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2383106)] Handling async request: GETPWUID [2025/04/09 07:30:47.839065, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2383106)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:30:47.839110, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:30:47.839148, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:30:47.839189, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:47.839215, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:47.840112, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:30:47.840203, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:47.840225, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:30:47.840247, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:30:47.840266, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:47.840289, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:47.842709, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:30:47.842805, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:47.842830, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:47.842852, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:30:47.842871, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:30:47.842899, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:30:47 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:30:47.842986, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:30:47 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:30:47.843045, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:30:47.843066, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:47.843087, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:47.843111, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:47.843138, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:30:47.843159, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:30:47.843182, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:47.843211, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:30:47.843233, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:30:47.843251, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:30:47.843272, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:30:47.843290, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:47.843309, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:47.843328, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:47.843348, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:30:47.843366, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:30:47.843395, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:30:47.843435, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:30:47.843453, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:47.843546, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:30:47.843565, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:30:47.843583, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:30:47.843623, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:30:47.843645, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:30:47.843671, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:47.846574, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:30:47.846612, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:30:47.846698, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:30:47.846718, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:30:47.846753, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:47.846856, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:30:47.846880, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:47.848976, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:30:47.849116, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:47.849223, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:30:47.849253, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:47.849374, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:30:47.849411, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:30:47.849456, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2383106):GETPWUID]: NT_STATUS_OK [2025/04/09 07:30:47.849505, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2383106):GETPWUID]: delivered response to client [2025/04/09 07:30:47.849683, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:53.279707, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:53.279870, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:53.279898, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383128)]: request interface version (version = 32) [2025/04/09 07:30:53.279945, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383128):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:53.280071, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:53.280097, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383128)]: request interface version (version = 32) [2025/04/09 07:30:53.280142, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383128):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:53.280238, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:30:53.280263, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2383128)]: request misc info [2025/04/09 07:30:53.280301, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383128):INFO]: delivered response to client [2025/04/09 07:30:53.280392, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:30:53.280416, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2383128)]: request netbios name [2025/04/09 07:30:53.280455, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383128):NETBIOS_NAME]: delivered response to client [2025/04/09 07:30:53.280550, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:30:53.280581, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2383128)]: request domain name [2025/04/09 07:30:53.280620, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383128):DOMAIN_NAME]: delivered response to client [2025/04/09 07:30:53.280711, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383128)] Handling async request: DOMAIN_INFO [2025/04/09 07:30:53.280736, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2383128]: domain_info [ADPROTOCOLX] [2025/04/09 07:30:53.280765, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383128):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:30:53.280835, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383128):DOMAIN_INFO]: delivered response to client [2025/04/09 07:30:53.280948, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383128)] Handling async request: PING_DC [2025/04/09 07:30:53.281007, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:53.283331, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:53.283407, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383128):PING_DC]: NT_STATUS_OK [2025/04/09 07:30:53.283454, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383128):PING_DC]: delivered response to client [2025/04/09 07:30:53.284106, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:53.286490, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:53.286563, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:53.286589, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2383129)]: request interface version (version = 32) [2025/04/09 07:30:53.286630, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2383129):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:53.286723, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2383129)] Handling async request: GETPWUID [2025/04/09 07:30:53.286751, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2383129)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:30:53.286781, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:30:53.286831, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:30:53.286876, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:53.286901, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:53.287630, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:30:53.287706, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:53.287727, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:30:53.287749, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:30:53.287768, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:53.287790, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:53.291331, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:30:53.291420, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:53.291442, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:53.291464, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:30:53.291484, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:30:53.291512, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:30:53 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:30:53.291555, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:30:53 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:30:53.291599, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:30:53.291620, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:53.291642, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:53.291667, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:53.291698, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:30:53.291720, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:30:53.291743, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:53.291773, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:30:53.291794, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:30:53.291823, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:30:53.291846, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:30:53.291865, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:53.291892, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:53.291917, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:30:53.291938, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:30:53.291997, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:30:53.292023, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:30:53.292056, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:30:53.292086, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:53.292192, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:30:53.292213, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:30:53.292249, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:30:53.292275, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:30:53.292294, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:30:53.292319, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:53.295616, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:30:53.295653, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:30:53.295741, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:30:53.295762, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:30:53.295784, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:53.295895, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:30:53.295921, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:53.303588, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:30:53.303748, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:53.303866, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:30:53.303887, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:30:53.304045, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:30:53.304074, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:30:53.304103, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2383129):GETPWUID]: NT_STATUS_OK [2025/04/09 07:30:53.304149, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2383129):GETPWUID]: delivered response to client [2025/04/09 07:30:53.304526, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:58.775833, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:58.776001, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:58.776047, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383178)]: request interface version (version = 32) [2025/04/09 07:30:58.776101, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383178):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:58.776563, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:58.776592, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383178)]: request interface version (version = 32) [2025/04/09 07:30:58.776636, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383178):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:58.776736, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:30:58.776762, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2383178)]: request misc info [2025/04/09 07:30:58.776809, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383178):INFO]: delivered response to client [2025/04/09 07:30:58.776917, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:30:58.776969, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2383178)]: request netbios name [2025/04/09 07:30:58.777023, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383178):NETBIOS_NAME]: delivered response to client [2025/04/09 07:30:58.777121, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:30:58.777147, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2383178)]: request domain name [2025/04/09 07:30:58.777187, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383178):DOMAIN_NAME]: delivered response to client [2025/04/09 07:30:58.777283, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383178)] Handling async request: DOMAIN_INFO [2025/04/09 07:30:58.777311, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2383178]: domain_info [ADPROTOCOLX] [2025/04/09 07:30:58.777353, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383178):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:30:58.777410, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383178):DOMAIN_INFO]: delivered response to client [2025/04/09 07:30:58.777527, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383178)] Handling async request: PING_DC [2025/04/09 07:30:58.777591, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:58.780326, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:58.780401, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383178):PING_DC]: NT_STATUS_OK [2025/04/09 07:30:58.780451, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383178):PING_DC]: delivered response to client [2025/04/09 07:30:58.782754, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:30:58.787297, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:30:58.787386, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:30:58.787413, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2383189)]: request interface version (version = 32) [2025/04/09 07:30:58.787466, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2383189):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:30:58.787566, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2383189)] Handling async request: GETPWUID [2025/04/09 07:30:58.787650, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2383189)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:30:58.787682, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:30:58.787746, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:30:58.787773, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:58.787805, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:30:58.789663, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:30:58.789755, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:30:58.789778, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:30:58.789800, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:30:58.789821, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:30:58.789845, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:31:01.373978, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:31:01.374136, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:01.374171, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383390)]: request interface version (version = 32) [2025/04/09 07:31:01.374221, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383390):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:01.374345, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:31:01.374379, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2383390)]: ping [2025/04/09 07:31:01.374420, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383390):PING]: delivered response to client [2025/04/09 07:31:01.380488, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:31:01.398590, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:31:01.399600, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:01.399636, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383401)]: request interface version (version = 32) [2025/04/09 07:31:01.399688, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383401):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:01.399796, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:01.399822, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383401)]: request interface version (version = 32) [2025/04/09 07:31:01.399865, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383401):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:01.399999, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:31:01.400030, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2383401)]: request misc info [2025/04/09 07:31:01.400075, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383401):INFO]: delivered response to client [2025/04/09 07:31:01.400175, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:31:01.400201, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2383401)]: request netbios name [2025/04/09 07:31:01.400243, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383401):NETBIOS_NAME]: delivered response to client [2025/04/09 07:31:01.400340, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:31:01.400366, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2383401)]: request domain name [2025/04/09 07:31:01.400406, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383401):DOMAIN_NAME]: delivered response to client [2025/04/09 07:31:01.400556, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383401)] Handling async request: DOMAIN_INFO [2025/04/09 07:31:01.400585, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2383401]: domain_info [ADPROTOCOLX] [2025/04/09 07:31:01.400645, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383401):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:31:01.400707, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383401):DOMAIN_INFO]: delivered response to client [2025/04/09 07:31:01.401056, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383401)] Handling async request: PING_DC [2025/04/09 07:31:01.401121, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:11.808536, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_IO_TIMEOUT [2025/04/09 07:31:11.808752, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:31:11.808779, 1, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:409(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_IO_TIMEOUT [2025/04/09 07:31:11.808801, 1, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_IO_TIMEOUT [2025/04/09 07:31:11.808842, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2383189):GETPWUID]: NT_STATUS_IO_TIMEOUT [2025/04/09 07:31:11.808913, 1, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_IO_TIMEOUT. [2025/04/09 07:31:11.808949, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2383189):GETPWUID]: delivered response to client [2025/04/09 07:31:11.809022, 0, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 13.021433 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:30:58.787563] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:31:11.808996] [13.021433] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:30:58.787649] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:31:11.808800] [13.021151] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:258 [2025/04/09 07:30:58.787681] ../../source3/winbindd/wb_xids2sids.c:351 [2025/04/09 07:31:11.808747] [13.021066] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 07:30:58.787740] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:30:58.787741] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:30:58.787746] ../../source3/winbindd/wb_xids2sids.c:193 [2025/04/09 07:30:58.789797] [0.002051] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:30:58.787801] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:30:58.789754] [0.001953] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:30:58.787802] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:30:58.789753] [0.001951] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:30:58.787803] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:30:58.789751] [0.001948] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:30:58.787998] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:30:58.789659] [0.001661] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:30:58.788000] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:30:58.789657] [0.001657] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:30:58.788000] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:30:58.789655] [0.001655] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:30:58.788002] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:30:58.788005] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:30:58.788013] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:30:58.789650] [0.001637] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:30:58.788013] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:30:58.788046] [0.000033] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:30:58.788014] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:30:58.788043] [0.000029] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:30:58.788047] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:30:58.789650] [0.001603] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:30:58.788047] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:30:58.789644] [0.001597] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:30:58.789800] ../../source3/winbindd/wb_xids2sids.c:159 [2025/04/09 07:31:11.808746] [13.018946] -> TEVENT_REQ_USER_ERROR (3 10483072397370982581)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:30:58.789842] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:31:11.808739] [13.018897] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:30:58.789843] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:31:11.808737] [13.018894] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:30:58.789844] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:11.808728] [13.018884] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:30:58.789943] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:11.808521] [13.018578] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:30:58.789945] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:11.808519] [13.018574] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:30:58.789945] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:11.808515] [13.018570] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:30:58.789947] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:30:58.789950] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:30:58.789989] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:11.808509] [13.018520] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:30:58.789989] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:30:58.790018] [0.000029] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:30:58.789990] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:30:58.790016] [0.000026] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:30:58.790020] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:11.808507] [13.018487] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:30:58.790020] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:11.808504] [13.018484] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:31:11.808880] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:31:11.808948] [0.000068] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:11.808881] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:11.808910] [0.000029] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:31:11.811274, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:31:13.551126, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:31:13.551310, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:13.551343, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:31:13.551368, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:13.551393, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:31:13.551416, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:16.997238, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:31:16.997461, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:16.997490, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383760)]: request interface version (version = 32) [2025/04/09 07:31:16.997555, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383760):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:16.997632, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:16.997668, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383760)]: request interface version (version = 32) [2025/04/09 07:31:16.997724, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383760):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:16.997788, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:31:16.997812, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2383760)]: request misc info [2025/04/09 07:31:16.997868, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383760):INFO]: delivered response to client [2025/04/09 07:31:16.997928, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:31:16.997970, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2383760)]: request netbios name [2025/04/09 07:31:16.998026, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383760):NETBIOS_NAME]: delivered response to client [2025/04/09 07:31:16.998087, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:31:16.998110, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2383760)]: request domain name [2025/04/09 07:31:16.998152, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383760):DOMAIN_NAME]: delivered response to client [2025/04/09 07:31:16.998277, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383760)] Handling async request: DOMAIN_INFO [2025/04/09 07:31:16.998324, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2383760]: domain_info [ADPROTOCOLX] [2025/04/09 07:31:16.998360, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383760):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:31:16.998407, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383760):DOMAIN_INFO]: delivered response to client [2025/04/09 07:31:16.998468, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383760)] Handling async request: PING_DC [2025/04/09 07:31:16.998508, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:23.962524, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2377294 matches my id: 1:2377294, type=0x40b [2025/04/09 07:31:23.962638, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2377300 [2025/04/09 07:31:23.962698, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! [2025/04/09 07:31:23.989677, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:23.989780, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383401):PING_DC]: NT_STATUS_OK [2025/04/09 07:31:23.989843, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383401):PING_DC]: delivered response to client [2025/04/09 07:31:23.989892, 0, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 22.588817 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:31:01.401053] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:31:23.989870] [22.588817] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 07:31:01.401097] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 07:31:23.989777] [22.588680] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 07:31:01.401101] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 07:31:23.989775] [22.588674] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 07:31:01.401104] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 07:31:23.989773] [22.588669] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:01.401117] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:23.989758] [22.588641] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:01.401185] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:23.989657] [22.588472] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:01.401187] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:31:23.989654] [22.588467] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:31:01.401188] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:31:23.989652] [22.588464] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:01.401194] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:23.989650] [22.588456] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:01.401196] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:01.401197] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:01.401203] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:23.989643] [22.588440] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:01.401204] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:01.401232] [0.000028] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:01.401205] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:01.401230] [0.000025] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:01.401234] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:23.989641] [22.588407] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:01.401235] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:23.989637] [22.588402] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:31:23.989816] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:31:23.989841] [0.000025] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:23.989817] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:23.989835] [0.000018] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:31:23.992722, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:31:24.038078, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:31:24.038191, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:24.038221, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383773)]: request interface version (version = 32) [2025/04/09 07:31:24.038274, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383773):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:24.038479, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:31:24.038505, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2383773)]: ping [2025/04/09 07:31:24.038552, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383773):PING]: delivered response to client [2025/04/09 07:31:24.038698, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:31:24.059004, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:31:24.059097, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:24.059121, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383776)]: request interface version (version = 32) [2025/04/09 07:31:24.059165, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383776):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:24.059256, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:24.059279, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2383776)]: request interface version (version = 32) [2025/04/09 07:31:24.059335, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383776):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:24.059429, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:31:24.059452, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2383776)]: request misc info [2025/04/09 07:31:24.059490, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383776):INFO]: delivered response to client [2025/04/09 07:31:24.059577, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:31:24.059600, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2383776)]: request netbios name [2025/04/09 07:31:24.059648, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383776):NETBIOS_NAME]: delivered response to client [2025/04/09 07:31:24.059747, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:31:24.059770, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2383776)]: request domain name [2025/04/09 07:31:24.059807, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383776):DOMAIN_NAME]: delivered response to client [2025/04/09 07:31:24.059897, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383776)] Handling async request: DOMAIN_INFO [2025/04/09 07:31:24.059922, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2383776]: domain_info [ADPROTOCOLX] [2025/04/09 07:31:24.059986, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383776):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:31:24.060041, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383776):DOMAIN_INFO]: delivered response to client [2025/04/09 07:31:24.060137, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2383776)] Handling async request: PING_DC [2025/04/09 07:31:24.060173, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:24.062751, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:24.062841, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383776):PING_DC]: NT_STATUS_OK [2025/04/09 07:31:24.062894, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383776):PING_DC]: delivered response to client [2025/04/09 07:31:24.063638, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:31:30.566585, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:809(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2377294 matches my id: 1:2377294, type=0x40b [2025/04/09 07:31:30.566645, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2377677 [2025/04/09 07:31:30.566689, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! [2025/04/09 07:31:30.585929, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:30.586051, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2383760):PING_DC]: NT_STATUS_OK [2025/04/09 07:31:30.586118, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2383760):PING_DC]: delivered response to client [2025/04/09 07:31:30.586156, 0, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 13.587680 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:31:16.998466] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:31:30.586146] [13.587680] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 07:31:16.998492] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 07:31:30.586042] [13.587550] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 07:31:16.998496] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 07:31:30.586040] [13.587544] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 07:31:16.998499] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 07:31:30.586039] [13.587540] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:16.998502] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:30.586035] [13.587533] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:16.998542] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:30.585916] [13.587374] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:16.998551] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:31:30.585914] [13.587363] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:31:16.998554] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:31:30.585912] [13.587358] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:16.998567] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:30.585910] [13.587343] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:16.998570] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:16.998576] [0.000006] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:16.998585] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:30.585894] [13.587309] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:16.998586] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:16.998628] [0.000042] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:16.998586] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:16.998626] [0.000040] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:16.998635] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:30.585893] [13.587258] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:16.998637] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:30.585884] [13.587247] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:31:30.586086] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:31:30.586116] [0.000030] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:30.586087] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:30.586110] [0.000023] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:31:30.590891, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:31:30.593202, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:31:30.593286, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:30.593313, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2383968)]: request interface version (version = 32) [2025/04/09 07:31:30.593359, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2383968):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:30.593475, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2383968)] Handling async request: GETPWUID [2025/04/09 07:31:30.593506, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2383968)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:31:30.593533, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:31:30.593592, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:31:30.593620, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:31:30.593653, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:31:30.594681, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:31:30.594767, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:31:30.594790, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:31:30.594812, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:31:30.594833, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:31:30.594857, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:31:31.371938, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:31:31.372111, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:31.372139, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384019)]: request interface version (version = 32) [2025/04/09 07:31:31.372204, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384019):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:31.372826, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:31:31.372859, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2384019)]: ping [2025/04/09 07:31:31.372918, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384019):PING]: delivered response to client [2025/04/09 07:31:31.373002, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:31:31.394002, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:31:31.394106, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:31.394132, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384026)]: request interface version (version = 32) [2025/04/09 07:31:31.394179, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384026):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:31.397143, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:31.397178, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384026)]: request interface version (version = 32) [2025/04/09 07:31:31.397229, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384026):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:31.400604, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:31:31.400638, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2384026)]: request misc info [2025/04/09 07:31:31.400684, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384026):INFO]: delivered response to client [2025/04/09 07:31:31.400829, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:31:31.400856, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2384026)]: request netbios name [2025/04/09 07:31:31.400909, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384026):NETBIOS_NAME]: delivered response to client [2025/04/09 07:31:31.401038, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:31:31.401067, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2384026)]: request domain name [2025/04/09 07:31:31.401109, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384026):DOMAIN_NAME]: delivered response to client [2025/04/09 07:31:31.401209, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384026)] Handling async request: DOMAIN_INFO [2025/04/09 07:31:31.401250, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2384026]: domain_info [ADPROTOCOLX] [2025/04/09 07:31:31.401298, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384026):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:31:31.401354, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384026):DOMAIN_INFO]: delivered response to client [2025/04/09 07:31:31.401845, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384026)] Handling async request: PING_DC [2025/04/09 07:31:31.401901, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:31.404590, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:31.404660, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384026):PING_DC]: NT_STATUS_OK [2025/04/09 07:31:31.404709, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384026):PING_DC]: delivered response to client [2025/04/09 07:31:31.406769, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:31:35.699809, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 07:31:35.699922, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) WB command dsgetdcname start. Search domain name adprotocolx and site name (null). [2025/04/09 07:31:35.699997, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:31:35.704598, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:31:35.704653, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : '\\windc1.adprotocolx.com' dc_address : * dc_address : '\\2001:192::656a:348:28e1:d1' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 domain_name : * domain_name : 'adprotocolx.com' forest_name : * forest_name : 'adprotocolx.com' dc_flags : 0xe001f3fd (3758224381) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 1: NBT_SERVER_HAS_DNS_NAME 1: NBT_SERVER_IS_DEFAULT_NC 1: NBT_SERVER_FOREST_ROOT dc_site_name : * dc_site_name : 'Default-First-Site-Name' client_site_name : * client_site_name : 'Default-First-Site-Name' result : NT_STATUS_OK [2025/04/09 07:31:35.704973, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) WB command dsgetdcname for adprotocolx end. [2025/04/09 07:31:35.705006, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_dsgetdcname.c:158(wb_dsgetdcname_gencache_set) dcinfo: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : '\\windc1.adprotocolx.com' dc_address : * dc_address : '\\2001:192::656a:348:28e1:d1' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 domain_name : * domain_name : 'adprotocolx.com' forest_name : * forest_name : 'adprotocolx.com' dc_flags : 0xe001f3fd (3758224381) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 1: NBT_SERVER_HAS_DNS_NAME 1: NBT_SERVER_IS_DEFAULT_NC 1: NBT_SERVER_FOREST_ROOT dc_site_name : * dc_site_name : 'Default-First-Site-Name' client_site_name : * client_site_name : 'Default-First-Site-Name' [2025/04/09 07:31:35.705257, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[DCINFO/ADPROTOCOLX] and timeout=[Wed Apr 9 08:31:35 AM 2025 EDT] (3600 seconds ahead) [2025/04/09 07:31:35.705321, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:31:38.744224, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:31:38.744334, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:31:38.744358, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:31:38.744385, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:31:38.744406, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:31:38.744439, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:31:38 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:31:38.744491, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:31:38 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:31:38.744543, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:31:38.744584, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:38.744626, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:31:38.744674, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:38.744713, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:31:38.744745, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:31:38.744775, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:38.744803, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:31:38.744825, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:31:38.744846, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:31:38.744868, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:31:38.744887, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:38.744909, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:31:38.744929, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:31:38.744951, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:31:38.745002, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:31:38.745048, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:31:38.745093, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:31:38.745115, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:38.745227, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:31:38.745256, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:31:38.745278, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:31:38.745325, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:31:38.745357, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:31:38.745409, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:38.756481, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:31:38.756520, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:31:38.756622, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:31:38.756645, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:31:38.756667, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:38.756776, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:31:38.756812, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:38.758625, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:31:38.758774, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:38.758882, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:31:38.758901, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:38.759052, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:31:38.759084, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:31:38.759112, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2383968):GETPWUID]: NT_STATUS_OK [2025/04/09 07:31:38.759172, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2383968):GETPWUID]: delivered response to client [2025/04/09 07:31:38.759217, 0, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 8.165727 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:31:30.593472] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:31:38.759199] [8.165727] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:31:30.593505] ../../source3/winbindd/winbindd_getpwuid.c:106 [2025/04/09 07:31:38.759082] [8.165577] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:258 [2025/04/09 07:31:30.593532] ../../source3/winbindd/wb_xids2sids.c:395 [2025/04/09 07:31:38.744541] [8.151009] -> TEVENT_REQ_DONE (2 0)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 07:31:30.593587] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:31:30.593587] [0.000000] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:31:30.593591] ../../source3/winbindd/wb_xids2sids.c:193 [2025/04/09 07:31:30.594809] [0.001218] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:31:30.593649] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:31:30.594766] [0.001117] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:31:30.593650] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:31:30.594765] [0.001115] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:30.593651] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:30.594763] [0.001112] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:30.593758] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:30.594676] [0.000918] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:30.593759] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:30.594675] [0.000916] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:30.593760] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:30.594673] [0.000913] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:30.593761] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:30.593764] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:30.593771] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:30.594669] [0.000898] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:30.593771] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:30.593799] [0.000028] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:30.593772] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:30.593797] [0.000025] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:30.593800] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:30.594668] [0.000868] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:30.593801] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:30.594666] [0.000865] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:31:30.594812] ../../source3/winbindd/wb_xids2sids.c:193 [2025/04/09 07:31:38.744378] [8.149566] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:31:30.594854] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:31:35.699918] [5.105064] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:31:30.594855] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:31:35.699916] [5.105061] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:30.594856] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:35.699907] [5.105051] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:30.594939] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:35.699795] [5.104856] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:30.594940] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:35.699789] [5.104849] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:30.594941] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:35.699780] [5.104839] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:30.594950] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:30.594980] [0.000030] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:30.594986] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:35.699765] [5.104779] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:30.594987] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:30.595013] [0.000026] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:30.594988] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:30.595011] [0.000023] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:30.595014] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:35.699764] [5.104750] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:30.595015] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:35.699747] [5.104732] -> TEVENT_REQ_DONE (2 0)) [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:31:35.699922] ../../source3/winbindd/wb_dsgetdcname.c:122 [2025/04/09 07:31:35.704972] [0.005050] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:31:35.699988] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:31:35.704966] [0.004978] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:31:35.699990] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:31:35.704965] [0.004975] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:35.699994] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:35.704949] [0.004955] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:35.700073] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:35.704629] [0.004556] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:35.700076] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:31:35.704627] [0.004551] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:31:35.700123] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:31:35.704574] [0.004451] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:35.700130] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:35.704572] [0.004442] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:35.700132] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:35.700133] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:35.700145] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:35.704561] [0.004416] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:35.700146] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:35.700190] [0.000044] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:35.700146] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:35.700188] [0.000042] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:35.700197] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:35.704561] [0.004364] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:35.700198] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:35.704559] [0.004361] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:31:35.705317] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:31:38.744332] [3.039015] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:31:35.705319] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:31:38.744330] [3.039011] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:35.705320] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:38.744327] [3.039007] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:35.705402] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:38.744216] [3.038814] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:35.705403] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:38.744213] [3.038810] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:35.705404] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:38.744210] [3.038806] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:35.705405] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:35.705409] [0.000004] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:35.705414] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:38.744204] [3.038790] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:35.705415] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:35.705441] [0.000026] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:35.705416] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:35.705439] [0.000023] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:35.705443] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:38.744203] [3.038760] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:35.705444] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:38.744199] [3.038755] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:31:38.744385] ../../source3/winbindd/wb_xids2sids.c:111 [2025/04/09 07:31:38.744425] [0.000040] -> TEVENT_REQ_DONE (2 0)) [struct wb_getpwsid_state] ../../source3/winbindd/wb_getpwsid.c:45 [2025/04/09 07:31:38.744626] ../../source3/winbindd/wb_getpwsid.c:148 [2025/04/09 07:31:38.759050] [0.014424] -> TEVENT_REQ_DONE (2 0)) [struct wb_queryuser_state] ../../source3/winbindd/wb_queryuser.c:52 [2025/04/09 07:31:38.744673] ../../source3/winbindd/wb_queryuser.c:340 [2025/04/09 07:31:38.758881] [0.014208] -> TEVENT_REQ_DONE (2 0)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:153 [2025/04/09 07:31:38.744709] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:31:38.744709] [0.000000] -> TEVENT_REQ_DONE (2 0)) [struct wb_sids2xids_state] ../../source3/winbindd/wb_sids2xids.c:85 [2025/04/09 07:31:38.744744] ../../source3/winbindd/wb_sids2xids.c:178 [2025/04/09 07:31:38.744864] [0.000120] -> TEVENT_REQ_DONE (2 0)) [struct wb_lookupsid_state] ../../source3/winbindd/wb_lookupsid.c:44 [2025/04/09 07:31:38.745255] ../../source3/winbindd/wb_lookupsid.c:88 [2025/04/09 07:31:38.756621] [0.011366] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_LookupSid_state] librpc/gen_ndr/ndr_winbind_c.c:335 [2025/04/09 07:31:38.745383] librpc/gen_ndr/ndr_winbind_c.c:401 [2025/04/09 07:31:38.756620] [0.011237] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_LookupSid_r_state] librpc/gen_ndr/ndr_winbind_c.c:248 [2025/04/09 07:31:38.745386] librpc/gen_ndr/ndr_winbind_c.c:282 [2025/04/09 07:31:38.756619] [0.011233] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:38.745405] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:38.756618] [0.011213] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:38.745468] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:38.756512] [0.011044] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:38.745469] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:31:38.756510] [0.011041] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:31:38.745486] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:31:38.756469] [0.010983] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:38.745493] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:38.756467] [0.010974] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:38.745494] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:38.745495] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:38.745509] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:38.756462] [0.010953] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:38.745519] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:38.745552] [0.000033] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:38.745520] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:38.745550] [0.000030] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:38.745564] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:38.756462] [0.010898] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:38.745582] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:38.756460] [0.010878] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_GetNssInfo_state] librpc/gen_ndr/ndr_winbind_c.c:1945 [2025/04/09 07:31:38.756807] librpc/gen_ndr/ndr_winbind_c.c:2007 [2025/04/09 07:31:38.758771] [0.001964] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_GetNssInfo_r_state] librpc/gen_ndr/ndr_winbind_c.c:1861 [2025/04/09 07:31:38.756809] librpc/gen_ndr/ndr_winbind_c.c:1895 [2025/04/09 07:31:38.758770] [0.001961] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:31:38.756810] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:31:38.758768] [0.001958] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:31:38.756978] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:31:38.758618] [0.001640] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:31:38.756979] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:31:38.758617] [0.001638] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:31:38.756980] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:31:38.758615] [0.001635] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:31:38.756982] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:31:38.756986] [0.000004] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:31:38.756996] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:31:38.758610] [0.001614] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:31:38.756998] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:31:38.757034] [0.000036] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:38.756999] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:38.757032] [0.000033] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:31:38.757035] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:31:38.758610] [0.001575] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:480 [2025/04/09 07:31:38.757036] ../../lib/async_req/async_sock.c:568 [2025/04/09 07:31:38.758608] [0.001572] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:31:38.759140] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:31:38.759171] [0.000031] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:267 [2025/04/09 07:31:38.759141] ../../lib/async_req/async_sock.c:373 [2025/04/09 07:31:38.759166] [0.000025] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:31:38.763498, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:31:43.552812, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:31:43.552915, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:43.552946, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:31:43.552990, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:43.553010, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:31:43.553033, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:44.216258, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:31:44.216375, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:44.216400, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384117)]: request interface version (version = 32) [2025/04/09 07:31:44.216454, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384117):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:44.216556, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:44.216579, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384117)]: request interface version (version = 32) [2025/04/09 07:31:44.216617, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384117):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:44.216718, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:31:44.216742, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2384117)]: request misc info [2025/04/09 07:31:44.216780, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384117):INFO]: delivered response to client [2025/04/09 07:31:44.216877, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:31:44.216902, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2384117)]: request netbios name [2025/04/09 07:31:44.216939, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384117):NETBIOS_NAME]: delivered response to client [2025/04/09 07:31:44.217057, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:31:44.217081, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2384117)]: request domain name [2025/04/09 07:31:44.217117, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384117):DOMAIN_NAME]: delivered response to client [2025/04/09 07:31:44.217205, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384117)] Handling async request: DOMAIN_INFO [2025/04/09 07:31:44.217231, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2384117]: domain_info [ADPROTOCOLX] [2025/04/09 07:31:44.217259, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384117):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:31:44.217300, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384117):DOMAIN_INFO]: delivered response to client [2025/04/09 07:31:44.217391, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384117)] Handling async request: PING_DC [2025/04/09 07:31:44.217431, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:44.219630, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:44.219721, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384117):PING_DC]: NT_STATUS_OK [2025/04/09 07:31:44.219769, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384117):PING_DC]: delivered response to client [2025/04/09 07:31:44.220869, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:31:44.222685, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:31:44.222756, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:44.222793, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2384118)]: request interface version (version = 32) [2025/04/09 07:31:44.222835, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2384118):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:44.222923, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2384118)] Handling async request: GETPWUID [2025/04/09 07:31:44.222949, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2384118)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:31:44.222999, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:264(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:31:44.223037, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:31:44.223059, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:31:44.223082, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:31:44.223799, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:31:44.223883, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:31:44.223904, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:31:44.223925, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:31:44.223943, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:31:44.223995, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:31:44.226152, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:31:44.226242, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:165(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:31:44.226264, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:188(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:31:44.226291, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:31:44.226309, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:31:44.226336, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:31:44 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:31:44.226378, 10, pid=2377294, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:31:44 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:31:44.226412, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:407(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:31:44.226431, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:420(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:44.226452, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:31:44.226477, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:44.226503, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:31:44.226525, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:31:44.226547, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:44.226572, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:31:44.226597, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:31:44.226617, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:31:44.226637, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:31:44.226655, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:44.226693, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:31:44.226712, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:31:44.226732, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:31:44.226750, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:31:44.226770, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:31:44.226800, 10, pid=2377294, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:31:44.226818, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:44.226909, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:31:44.226929, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:31:44.226947, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1432(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:31:44.227001, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1475(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:31:44.227022, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:31:44.227051, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:44.229980, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:31:44.230027, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:31:44.230115, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:31:44.230135, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:31:44.230157, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:44.230258, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:31:44.230282, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:44.232018, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:31:44.232174, 10, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:44.232276, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:31:44.232296, 5, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:31:44.232409, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:31:44.232436, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:31:44.232468, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2384118):GETPWUID]: NT_STATUS_OK [2025/04/09 07:31:44.232513, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2384118):GETPWUID]: delivered response to client [2025/04/09 07:31:44.232832, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:31:46.388998, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:31:46.389202, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:46.389231, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384331)]: request interface version (version = 32) [2025/04/09 07:31:46.389283, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384331):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:46.389419, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:31:46.389445, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2384331)]: ping [2025/04/09 07:31:46.389484, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384331):PING]: delivered response to client [2025/04/09 07:31:46.391809, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:31:46.418661, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:31:46.418825, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:46.418854, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384343)]: request interface version (version = 32) [2025/04/09 07:31:46.418922, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384343):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:46.419267, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:31:46.419296, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384343)]: request interface version (version = 32) [2025/04/09 07:31:46.419338, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384343):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:31:46.419436, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:31:46.419468, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2384343)]: request misc info [2025/04/09 07:31:46.419510, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384343):INFO]: delivered response to client [2025/04/09 07:31:46.420010, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:31:46.420042, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2384343)]: request netbios name [2025/04/09 07:31:46.420087, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384343):NETBIOS_NAME]: delivered response to client [2025/04/09 07:31:46.420186, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:31:46.420211, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2384343)]: request domain name [2025/04/09 07:31:46.420251, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384343):DOMAIN_NAME]: delivered response to client [2025/04/09 07:31:46.420346, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384343)] Handling async request: DOMAIN_INFO [2025/04/09 07:31:46.420375, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2384343]: domain_info [ADPROTOCOLX] [2025/04/09 07:31:46.420409, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384343):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:31:46.420470, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384343):DOMAIN_INFO]: delivered response to client [2025/04/09 07:31:46.420573, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384343)] Handling async request: PING_DC [2025/04/09 07:31:46.420629, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:46.423126, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:46.423196, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384343):PING_DC]: NT_STATUS_OK [2025/04/09 07:31:46.423243, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384343):PING_DC]: delivered response to client [2025/04/09 07:31:46.425101, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:32:01.364217, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:32:01.364390, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:01.364428, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384605)]: request interface version (version = 32) [2025/04/09 07:32:01.364477, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384605):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:01.364607, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:32:01.364640, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2384605)]: ping [2025/04/09 07:32:01.364680, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384605):PING]: delivered response to client [2025/04/09 07:32:01.366511, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:32:01.384781, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:32:01.385796, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:01.385828, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384611)]: request interface version (version = 32) [2025/04/09 07:32:01.385875, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384611):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:01.386077, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:01.386106, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384611)]: request interface version (version = 32) [2025/04/09 07:32:01.386147, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384611):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:01.386238, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:32:01.386261, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2384611)]: request misc info [2025/04/09 07:32:01.386304, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384611):INFO]: delivered response to client [2025/04/09 07:32:01.386399, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:32:01.386423, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2384611)]: request netbios name [2025/04/09 07:32:01.386472, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384611):NETBIOS_NAME]: delivered response to client [2025/04/09 07:32:01.386861, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:32:01.386887, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2384611)]: request domain name [2025/04/09 07:32:01.386926, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384611):DOMAIN_NAME]: delivered response to client [2025/04/09 07:32:01.387072, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384611)] Handling async request: DOMAIN_INFO [2025/04/09 07:32:01.387102, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2384611]: domain_info [ADPROTOCOLX] [2025/04/09 07:32:01.387151, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384611):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:32:01.387197, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384611):DOMAIN_INFO]: delivered response to client [2025/04/09 07:32:01.387295, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384611)] Handling async request: PING_DC [2025/04/09 07:32:01.387353, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:32:01.391162, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:32:01.391228, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384611):PING_DC]: NT_STATUS_OK [2025/04/09 07:32:01.391272, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384611):PING_DC]: delivered response to client [2025/04/09 07:32:01.393475, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:32:13.555586, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:32:13.555730, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:32:13.555776, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:32:13.555800, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:32:13.555818, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:32:13.555840, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:32:16.373161, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:32:16.373419, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:16.373454, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384915)]: request interface version (version = 32) [2025/04/09 07:32:16.373511, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384915):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:16.374313, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:32:16.374344, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2384915)]: ping [2025/04/09 07:32:16.374390, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384915):PING]: delivered response to client [2025/04/09 07:32:16.374694, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:32:16.398062, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:32:16.398173, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:16.398220, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384926)]: request interface version (version = 32) [2025/04/09 07:32:16.398284, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384926):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:16.398733, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:16.398761, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2384926)]: request interface version (version = 32) [2025/04/09 07:32:16.398807, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384926):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:16.398900, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:32:16.398924, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2384926)]: request misc info [2025/04/09 07:32:16.398995, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384926):INFO]: delivered response to client [2025/04/09 07:32:16.399092, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:32:16.399124, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2384926)]: request netbios name [2025/04/09 07:32:16.399170, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384926):NETBIOS_NAME]: delivered response to client [2025/04/09 07:32:16.399302, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:32:16.399326, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2384926)]: request domain name [2025/04/09 07:32:16.399363, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384926):DOMAIN_NAME]: delivered response to client [2025/04/09 07:32:16.399453, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384926)] Handling async request: DOMAIN_INFO [2025/04/09 07:32:16.399479, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2384926]: domain_info [ADPROTOCOLX] [2025/04/09 07:32:16.399539, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384926):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:32:16.399595, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384926):DOMAIN_INFO]: delivered response to client [2025/04/09 07:32:16.399708, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2384926)] Handling async request: PING_DC [2025/04/09 07:32:16.399776, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:32:16.403314, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:32:16.403412, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2384926):PING_DC]: NT_STATUS_OK [2025/04/09 07:32:16.403463, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2384926):PING_DC]: delivered response to client [2025/04/09 07:32:16.404899, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:32:31.363808, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:32:31.363999, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:31.364036, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2385221)]: request interface version (version = 32) [2025/04/09 07:32:31.364114, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385221):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:31.364227, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:32:31.364252, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2385221)]: ping [2025/04/09 07:32:31.364301, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385221):PING]: delivered response to client [2025/04/09 07:32:31.374751, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:32:31.387782, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:32:31.387868, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:31.387893, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2385227)]: request interface version (version = 32) [2025/04/09 07:32:31.387936, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385227):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:31.389338, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:31.389370, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2385227)]: request interface version (version = 32) [2025/04/09 07:32:31.389413, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385227):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:31.389522, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:32:31.389552, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2385227)]: request misc info [2025/04/09 07:32:31.389596, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385227):INFO]: delivered response to client [2025/04/09 07:32:31.389698, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:32:31.389738, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2385227)]: request netbios name [2025/04/09 07:32:31.389816, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385227):NETBIOS_NAME]: delivered response to client [2025/04/09 07:32:31.390017, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:32:31.390046, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2385227)]: request domain name [2025/04/09 07:32:31.390090, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385227):DOMAIN_NAME]: delivered response to client [2025/04/09 07:32:31.390493, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2385227)] Handling async request: DOMAIN_INFO [2025/04/09 07:32:31.390530, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2385227]: domain_info [ADPROTOCOLX] [2025/04/09 07:32:31.390578, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2385227):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:32:31.390624, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385227):DOMAIN_INFO]: delivered response to client [2025/04/09 07:32:31.390726, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2385227)] Handling async request: PING_DC [2025/04/09 07:32:31.390775, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:32:31.393306, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:32:31.393370, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2385227):PING_DC]: NT_STATUS_OK [2025/04/09 07:32:31.393415, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385227):PING_DC]: delivered response to client [2025/04/09 07:32:31.395525, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:32:43.558275, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:32:43.558465, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:32:43.558494, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:32:43.558518, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:32:43.558536, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:32:43.558558, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:32:49.471270, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:32:49.471454, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:49.471481, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2385775)]: request interface version (version = 32) [2025/04/09 07:32:49.471550, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385775):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:49.471686, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:32:49.471711, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2385775)]: ping [2025/04/09 07:32:49.471770, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385775):PING]: delivered response to client [2025/04/09 07:32:49.472990, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:32:49.495428, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:32:49.495537, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:49.495567, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2385784)]: request interface version (version = 32) [2025/04/09 07:32:49.495611, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385784):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:49.495732, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:32:49.495767, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2385784)]: request interface version (version = 32) [2025/04/09 07:32:49.495807, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385784):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:32:49.495903, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:32:49.495927, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2385784)]: request misc info [2025/04/09 07:32:49.495981, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385784):INFO]: delivered response to client [2025/04/09 07:32:49.496076, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:32:49.496099, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2385784)]: request netbios name [2025/04/09 07:32:49.496137, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385784):NETBIOS_NAME]: delivered response to client [2025/04/09 07:32:49.496224, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:32:49.496247, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2385784)]: request domain name [2025/04/09 07:32:49.496283, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385784):DOMAIN_NAME]: delivered response to client [2025/04/09 07:32:49.496371, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2385784)] Handling async request: DOMAIN_INFO [2025/04/09 07:32:49.496397, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2385784]: domain_info [ADPROTOCOLX] [2025/04/09 07:32:49.496440, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2385784):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:32:49.496484, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385784):DOMAIN_INFO]: delivered response to client [2025/04/09 07:32:49.496579, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2385784)] Handling async request: PING_DC [2025/04/09 07:32:49.496649, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:32:49.499578, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:32:49.499644, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2385784):PING_DC]: NT_STATUS_OK [2025/04/09 07:32:49.499687, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2385784):PING_DC]: delivered response to client [2025/04/09 07:32:49.500867, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:33:01.364027, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:33:01.364296, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:01.364332, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386017)]: request interface version (version = 32) [2025/04/09 07:33:01.364388, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386017):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:01.366404, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:33:01.366438, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2386017)]: ping [2025/04/09 07:33:01.366482, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386017):PING]: delivered response to client [2025/04/09 07:33:01.367570, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:33:01.392177, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:33:01.392277, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:01.392311, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386023)]: request interface version (version = 32) [2025/04/09 07:33:01.392364, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386023):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:01.392473, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:01.392499, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386023)]: request interface version (version = 32) [2025/04/09 07:33:01.392545, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386023):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:01.392639, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:33:01.392664, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2386023)]: request misc info [2025/04/09 07:33:01.392704, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386023):INFO]: delivered response to client [2025/04/09 07:33:01.392797, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:33:01.392822, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2386023)]: request netbios name [2025/04/09 07:33:01.392862, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386023):NETBIOS_NAME]: delivered response to client [2025/04/09 07:33:01.393000, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:33:01.393030, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2386023)]: request domain name [2025/04/09 07:33:01.393073, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386023):DOMAIN_NAME]: delivered response to client [2025/04/09 07:33:01.393168, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2386023)] Handling async request: DOMAIN_INFO [2025/04/09 07:33:01.393195, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2386023]: domain_info [ADPROTOCOLX] [2025/04/09 07:33:01.393252, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2386023):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:33:01.393308, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386023):DOMAIN_INFO]: delivered response to client [2025/04/09 07:33:01.393438, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2386023)] Handling async request: PING_DC [2025/04/09 07:33:01.393504, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:33:01.396172, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:33:01.396260, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2386023):PING_DC]: NT_STATUS_OK [2025/04/09 07:33:01.396312, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386023):PING_DC]: delivered response to client [2025/04/09 07:33:01.397534, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:33:13.560754, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:33:13.560941, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:33:13.560994, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:33:13.561021, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:33:13.561039, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:33:13.561061, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:33:16.397359, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:33:16.397503, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:16.397535, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386338)]: request interface version (version = 32) [2025/04/09 07:33:16.397583, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386338):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:16.398599, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:33:16.398630, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2386338)]: ping [2025/04/09 07:33:16.398680, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386338):PING]: delivered response to client [2025/04/09 07:33:16.400921, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:33:16.419380, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:33:16.419471, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:16.419501, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386351)]: request interface version (version = 32) [2025/04/09 07:33:16.419550, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386351):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:16.420014, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:16.420045, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386351)]: request interface version (version = 32) [2025/04/09 07:33:16.420102, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386351):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:16.421016, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:33:16.421049, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2386351)]: request misc info [2025/04/09 07:33:16.421111, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386351):INFO]: delivered response to client [2025/04/09 07:33:16.421245, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:33:16.421275, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2386351)]: request netbios name [2025/04/09 07:33:16.421329, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386351):NETBIOS_NAME]: delivered response to client [2025/04/09 07:33:16.421420, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:33:16.421444, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2386351)]: request domain name [2025/04/09 07:33:16.421481, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386351):DOMAIN_NAME]: delivered response to client [2025/04/09 07:33:16.421600, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2386351)] Handling async request: DOMAIN_INFO [2025/04/09 07:33:16.421626, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2386351]: domain_info [ADPROTOCOLX] [2025/04/09 07:33:16.421684, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2386351):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:33:16.421737, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386351):DOMAIN_INFO]: delivered response to client [2025/04/09 07:33:16.421845, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2386351)] Handling async request: PING_DC [2025/04/09 07:33:16.421911, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:33:16.424528, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:33:16.424610, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2386351):PING_DC]: NT_STATUS_OK [2025/04/09 07:33:16.424657, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386351):PING_DC]: delivered response to client [2025/04/09 07:33:16.425827, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:33:31.398088, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:33:31.398300, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:31.398336, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386647)]: request interface version (version = 32) [2025/04/09 07:33:31.398408, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386647):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:31.401975, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:33:31.402009, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2386647)]: ping [2025/04/09 07:33:31.402057, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386647):PING]: delivered response to client [2025/04/09 07:33:31.410627, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:33:31.431851, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:33:31.431995, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:31.432027, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386660)]: request interface version (version = 32) [2025/04/09 07:33:31.432075, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386660):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:31.432760, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:31.432790, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386660)]: request interface version (version = 32) [2025/04/09 07:33:31.432846, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386660):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:31.432955, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:33:31.432984, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2386660)]: request misc info [2025/04/09 07:33:31.433054, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386660):INFO]: delivered response to client [2025/04/09 07:33:31.433154, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:33:31.433179, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2386660)]: request netbios name [2025/04/09 07:33:31.433217, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386660):NETBIOS_NAME]: delivered response to client [2025/04/09 07:33:31.433307, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:33:31.433331, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2386660)]: request domain name [2025/04/09 07:33:31.433369, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386660):DOMAIN_NAME]: delivered response to client [2025/04/09 07:33:31.433486, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2386660)] Handling async request: DOMAIN_INFO [2025/04/09 07:33:31.433534, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2386660]: domain_info [ADPROTOCOLX] [2025/04/09 07:33:31.433589, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2386660):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:33:31.433640, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386660):DOMAIN_INFO]: delivered response to client [2025/04/09 07:33:31.433748, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2386660)] Handling async request: PING_DC [2025/04/09 07:33:31.433804, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:33:31.439987, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:33:31.440079, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2386660):PING_DC]: NT_STATUS_OK [2025/04/09 07:33:31.440141, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386660):PING_DC]: delivered response to client [2025/04/09 07:33:31.443022, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:33:43.563548, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:33:43.564008, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:33:43.564043, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:33:43.564080, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:33:43.564099, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:717(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:33:43.564122, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:33:46.395882, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:33:46.396084, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:46.396116, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386954)]: request interface version (version = 32) [2025/04/09 07:33:46.396179, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386954):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:46.397131, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:33:46.397168, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2386954)]: ping [2025/04/09 07:33:46.397221, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386954):PING]: delivered response to client [2025/04/09 07:33:46.398729, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:33:46.418934, 5, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:33:46.420464, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:46.420499, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386963)]: request interface version (version = 32) [2025/04/09 07:33:46.420552, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386963):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:46.420657, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:33:46.420689, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2386963)]: request interface version (version = 32) [2025/04/09 07:33:46.420741, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386963):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:33:46.420841, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:33:46.420865, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2386963)]: request misc info [2025/04/09 07:33:46.420906, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386963):INFO]: delivered response to client [2025/04/09 07:33:46.421040, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:33:46.421070, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2386963)]: request netbios name [2025/04/09 07:33:46.421111, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386963):NETBIOS_NAME]: delivered response to client [2025/04/09 07:33:46.421213, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:33:46.421237, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2386963)]: request domain name [2025/04/09 07:33:46.421276, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386963):DOMAIN_NAME]: delivered response to client [2025/04/09 07:33:46.421664, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2386963)] Handling async request: DOMAIN_INFO [2025/04/09 07:33:46.421694, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2386963]: domain_info [ADPROTOCOLX] [2025/04/09 07:33:46.421768, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2386963):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:33:46.421815, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386963):DOMAIN_INFO]: delivered response to client [2025/04/09 07:33:46.421918, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2386963)] Handling async request: PING_DC [2025/04/09 07:33:46.422004, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:33:46.426329, 1, pid=2377294, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:33:46.426397, 3, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2386963):PING_DC]: NT_STATUS_OK [2025/04/09 07:33:46.426446, 10, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2386963):PING_DC]: delivered response to client [2025/04/09 07:33:46.430209, 6, pid=2377294, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited Logs name: log.wb-ADPROTOCOLX.scenario2 ======================== [2025/04/09 07:30:31.375499, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:31.375589, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:30:31.375729, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:31.375826, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:30:31.375935, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001a (26) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:31.376180, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:31.376294, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:31.376325, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:31.377054, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:30:31.377121, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000001a (26) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 24 A0 EF 42 55 60 21 44 E2 82 D6 A0 3A C2 5F DC $..BU`!D ....:._. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 79 B6 2B D1 C7 A7 56 D8 C8 14 23 69 33 DF 15 1D y.+...V. ..#i3... [0030] 1E E5 69 4F D6 0D 69 A1 00 00 00 00 00 00 00 00 ..iO..i. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:31.377403, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:31.377426, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:30:31.377456, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:31.377493, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:30:31.377515, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:30:31.377535, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:30:31.377565, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:30:31.377637, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:30:31.377659, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:31.377720, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:31.377740, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:30:36.892881, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:36.892949, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:30:36.893062, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:36.893181, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:30:36.893280, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001b (27) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:36.893458, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:36.893570, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:36.893598, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:36.894182, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:30:36.894245, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000001b (27) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 5F 8B D2 85 AC 50 3F B8 3B 8E 55 B8 59 3B F9 43 _....P?. ;.U.Y;.C [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 44 72 DE AC 38 37 1D 4A CB 47 57 31 CB E8 F3 B5 Dr..87.J .GW1.... [0030] EB 51 1C 01 C8 58 5B ED 00 00 00 00 00 00 00 00 .Q...X[. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:36.894557, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:36.894581, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:30:36.894599, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:36.894634, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:30:36.894655, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:30:36.894673, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:30:36.894701, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:30:36.894765, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:30:36.894786, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:36.894842, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:36.894862, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:30:36.910703, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:30:36.910741, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:36.910761, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:30:36.910803, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:36.910881, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:30:36.910936, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:30:36.910983, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:30:36.911004, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:30:36.911030, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:196(winbindd_domain_init_backend) winbindd_domain_init_backend: Setting ADS methods for domain ADPROTOCOLX [2025/04/09 07:30:36.911065, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 07:30:36.911098, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 07:30:36.911158, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:30:36.911195, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:30:36.911256, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:30:36.911308, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 [2025/04/09 07:30:36.911340, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) ctdbd_migrate: Sending ctdb packet [2025/04/09 07:30:36.911492, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:30:36.911554, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:30:36.911585, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:30:36.911631, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:30:36.911650, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:30:36.911736, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 135 [2025/04/09 07:30:36.912556, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:30:36.913180, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 0, auth_level 1 [2025/04/09 07:30:36.913216, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x0000001c (28) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:30:36.913452, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:36.913474, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 72 [2025/04/09 07:30:36.913872, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 44 [2025/04/09 07:30:36.914015, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x0000001c (28) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x000010aa (4266) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] 00 00 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:30:36.914292, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK [2025/04/09 07:30:36.914315, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 60 bytes. [2025/04/09 07:30:36.914336, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:30:36.914397, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : NULL map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [0010] 00 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2025/04/09 07:30:36.914945, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000001d (29) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:36.915146, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:36.915169, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 140 [2025/04/09 07:30:36.915905, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 136 [2025/04/09 07:30:36.915950, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x0000001d (29) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 D7 86 32 9B 1C 21 77 49 A8 60 CB CA ......2. .!wI.`.. [0010] 7A C9 B4 2D 01 00 00 00 01 00 00 00 00 00 00 00 z..-.... ........ [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 57 34 12 34 12 CD AB EF 00 01 .....xW4 .4...... [0040] 23 45 67 89 AB 00 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C2 06 01 00 09 04 00 0A 1C 01 5D 00 00 00 00 00 ........ ..]..... [2025/04/09 07:30:36.916279, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128 [2025/04/09 07:30:36.916300, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK [2025/04/09 07:30:36.916318, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 128 bytes. [2025/04/09 07:30:36.916375, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 9b3286d7-211c-4977-a860-cbca7ac9b42d num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [0010] 00 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc206 (49670) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 10.28.1.93 result : 0x00000000 (0) [2025/04/09 07:30:36.916919, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 49670 [2025/04/09 07:30:36.917536, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:30:36.917648, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : f84a3e6cf7f56e83f9ea355692ec252e sequence : 0x67f65980 (1744198016) seed: struct netr_Credential data : 14a25089396d21ba client: struct netr_Credential data : 91793482be92c06e server: struct netr_Credential data : 968bde57e92fc9f8 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 07:30:36.918194, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 07:30:36.918240, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 07:30:36.918262, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 07:30:36.918316, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc4eaec0 [2025/04/09 07:30:36.918356, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4eaec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 07:30:36.918434, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 07:30:36.918533, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x0000001e (30) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 07:30:36.918826, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:36.918848, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 111 [2025/04/09 07:30:36.919245, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 64 [2025/04/09 07:30:36.919311, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0050 (80) auth_length : 0x000c (12) call_id : 0x0000001e (30) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000bbd (3005) secondary_address_size : 0x0006 (6) secondary_address : '49670' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 07:30:36.919614, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK [2025/04/09 07:30:36.919637, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 80 bytes. [2025/04/09 07:30:36.919658, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:30:36.919678, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:30:36.919705, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc4eaec0 [2025/04/09 07:30:36.919730, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc4eaec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 07:30:36.919766, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3622(cli_rpc_pipe_open_schannel_with_creds) cli_rpc_pipe_open_schannel_with_creds: opened pipe lsarpc to machine windc2.adprotocolx.com with key netlogon_creds_cli:CLI[GPFSNMBASH/GPFSNMBASH$]/SRV[WINDC2/ADPROTOCOLX] and bound using schannel. [2025/04/09 07:30:36.919797, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:30:36.919816, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:30:36.919841, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:30:36.919864, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 07:30:36.919885, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=15, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 07:30:36.919987, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:30:36.920023, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:30:36.920042, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:30:36.920059, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:30:36.920080, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:30:36.920127, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 07:30:36.920348, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:30:36.920528, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001f (31) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000084 (132) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:36.920719, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:36.920795, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:36.920819, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 232 [2025/04/09 07:30:36.921467, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 07:30:36.921516, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x0000001f (31) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] C4 31 B7 CE 69 0F 3C 11 BE 49 CD 5B D8 04 D4 B5 .1..i.<. .I.[.... [0010] 7A AC 95 88 46 33 84 A4 5C A7 60 BF 4D 81 2F 7F z...F3.. \.`.M./. [0020] DA 0E 15 5C BE 84 6A A9 AF 90 AA 45 F1 0F E9 E0 ...\..j. ...E.... [0030] E9 48 C3 00 57 F1 65 AF 01 81 28 A2 E7 21 B9 80 .H..W.e. ..(..!.. [0040] 5C BA 66 45 BC F6 EE D0 B5 DE E1 C6 A7 9C 1E E9 \.fE.... ........ [0050] C4 F2 C4 1A C8 0D 43 07 EA 53 CC 5A EF FC 14 DC ......C. .S.Z.... [0060] 09 B4 0B C8 16 D8 B7 E8 4C 65 51 6D 86 69 CC FE ........ LeQm.i.. [0070] 86 2A 70 9F A6 51 CD F1 30 2F 20 1C F0 27 71 DC .*p..Q.. 0/ ..'q. [0080] 23 35 D0 FF 25 31 3D 67 F0 13 61 70 9F D9 0F 68 #5..%1=g ..ap...h [0090] D3 E1 EE 7B B6 F0 76 53 F5 34 F3 E3 C4 1B 27 46 ...{..vS .4....'F [00A0] C6 42 71 69 DA C4 DD A9 76 60 B3 77 1B 93 D4 3B .Bqi.... v`.w...; [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] C8 4C AF AA 97 AC 05 D3 5F 82 E0 C5 12 C5 DD 26 .L...... _......& [00D0] FA 01 BF 9C 15 F0 B3 56 00 00 00 00 00 00 00 00 .......V ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:36.921936, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:36.921977, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:30:36.921998, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:36.922031, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 07:30:36.922052, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 07:30:36.922071, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 168 bytes. [2025/04/09 07:30:36.922123, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:30:36.922401, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:30:36.922425, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:30:36.922470, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:35:36 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:30:36.922561, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:35:36 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:30:36.922611, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:30:36.922725, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:36.922746, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:30:42.362395, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:42.362464, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:30:42.362551, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:42.362661, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:30:42.362755, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000020 (32) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:42.362972, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:42.363081, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:42.363110, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:42.363793, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:30:42.363845, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000020 (32) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 90 83 BD F5 4C 3A 64 86 E0 CA 26 6B 9F D5 2B 31 ....L:d. ..&k..+1 [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 29 9E 2D B6 7E 70 5A 26 63 FE 6C 78 E7 BC F2 93 ).-.~pZ& c.lx.... [0030] 07 26 1E 4C BD FA 94 C9 00 00 00 00 00 00 00 00 .&.L.... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:42.364135, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:42.364159, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:30:42.364178, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:42.364208, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:30:42.364230, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:30:42.364254, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:30:42.364293, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:30:42.364368, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:30:42.364390, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:42.364450, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:42.364480, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:30:42.373401, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:30:42.373457, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:42.373480, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:30:42.373517, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:42.373570, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:30:42.373615, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:30:42.373650, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:30:42.373669, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:30:42.373688, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 07:30:42.373715, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 07:30:42.373738, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:30:42.373781, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 07:30:42.373928, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000021 (33) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:42.374159, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:42.374235, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:42.374260, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:42.374937, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 07:30:42.375014, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x00000021 (33) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] 48 6D 9A 65 19 FD 6C AB 82 50 A2 5F 2D FA 8F 9F Hm.e..l. .P._-... [0010] 3D 9A E0 A3 01 53 A7 65 0F 1D 74 FF 36 A5 19 42 =....S.e ..t.6..B [0020] 57 AF 04 B7 52 93 AE 19 A2 84 80 D9 ED 6D E8 E0 W...R... .....m.. [0030] 3B 02 FB 83 86 90 FF 09 BC 0F 06 52 75 7B C2 F6 ;....... ...Ru{.. [0040] B9 B6 A8 B1 56 CB F0 BC B2 67 A5 A3 80 6D 01 92 ....V... .g...m.. [0050] E6 74 76 40 46 9B EB 44 92 C1 05 34 E9 06 62 87 .tv@F..D ...4..b. [0060] 89 25 CB E5 16 9D B2 89 61 2F 7B 9C B8 AB B5 B4 .%...... a/{..... [0070] 14 43 69 4C A5 81 45 E5 0C 5C E5 29 CC 5B FF BC .CiL..E. .\.).[.. [0080] F9 2C A0 33 7E 91 A4 B0 5E F2 45 32 8D DB 0C 8A .,.3~... ^.E2.... [0090] B4 75 DA 4D B8 68 93 C8 84 E6 14 48 88 EF 2B 84 .u.M.h.. ...H..+. [00A0] BC C7 93 F7 19 76 DF 5F 88 8A 86 FE D6 B4 D0 4A .....v._ .......J [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] 58 88 24 FB FA 50 11 C5 97 59 A5 A3 B6 E4 3F 0A X.$..P.. .Y....?. [00D0] 36 66 46 71 CA CF 2C D3 00 00 00 00 00 00 00 00 6fFq..,. ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:42.375415, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:42.375438, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:30:42.375456, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:42.375489, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 07:30:42.375510, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 07:30:42.375529, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 168 bytes. [2025/04/09 07:30:42.375582, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:30:42.375830, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:30:42.375855, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:30:42.375880, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:35:42 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:30:42.375919, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:35:42 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:30:42.375984, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:30:42.376098, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:42.376119, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:30:46.383159, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:46.383227, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:30:46.383317, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:46.383401, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:30:46.383500, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000022 (34) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:46.383677, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:46.383796, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:46.383835, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:46.384792, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:30:46.384860, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000022 (34) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] B4 4C 1F B4 9E 3B EC AF 75 1D A1 7D 74 54 B8 FF .L...;.. u..}tT.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 90 1E 63 ED 5E 90 7C E7 DE 82 8A 88 19 02 3F 99 ..c.^.|. ......?. [0030] FA C6 13 58 CA 01 F7 4E 0C B1 D0 11 9B A8 00 C0 ...X...N ........ [0040] 4F D9 2E F5 00 00 00 00 33 05 71 71 BA BE 37 49 O....... 3.qq..7I [2025/04/09 07:30:46.385151, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:46.385175, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:30:46.385193, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:46.385225, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:30:46.385247, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:30:46.385266, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:30:46.385293, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:30:46.385357, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:30:46.385379, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:46.385436, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:46.385455, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:30:47.832899, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:47.832947, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:30:47.833049, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:47.833111, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:30:47.833213, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000023 (35) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:47.833397, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:47.833492, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:47.833521, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:47.834258, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:30:47.834344, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000023 (35) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 5C 80 F6 CE 36 1E B3 0C E2 31 B7 23 F6 5D D6 F3 \...6... .1.#.].. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] F0 66 EB 83 00 33 86 46 32 F9 4C 52 F0 E7 AE 79 .f...3.F 2.LR...y [0030] C4 53 04 47 8C 35 0B F1 00 00 00 00 00 00 00 00 .S.G.5.. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:47.834629, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:47.834652, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:30:47.834670, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:47.834710, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:30:47.834744, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:30:47.834764, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:30:47.834791, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:30:47.834863, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:30:47.834884, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:47.834941, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:47.834996, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:30:47.843838, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:30:47.843884, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:47.843907, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:30:47.843946, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:47.844056, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:30:47.844094, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:30:47.844116, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:30:47.844134, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:30:47.844153, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 07:30:47.844173, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 07:30:47.844195, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:30:47.844227, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 07:30:47.844371, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000024 (36) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:47.844569, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:47.844645, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:47.844671, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:47.845307, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 07:30:47.845369, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x00000024 (36) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] 1F F5 7D 87 1F B9 FC F3 BA 02 98 7E 43 6D C9 0C ..}..... ...~Cm.. [0010] 84 00 B8 47 7C 7D E8 D3 62 42 EF 97 CE 0A 5B DC ...G|}.. bB....[. [0020] 25 13 60 0A 6E 27 05 1D 2B F7 8D 8C 0B 72 31 6D %.`.n'.. +....r1m [0030] 25 37 60 C0 92 E8 EF 6A C5 BF 13 4E 8D A8 C1 FF %7`....j ...N.... [0040] D8 F7 12 F8 0E 97 44 51 D3 E2 70 2D F1 90 58 A4 ......DQ ..p-..X. [0050] 15 3F 0E 82 DE DD B1 4B 68 F3 9F B3 BD AC C8 58 .?.....K h......X [0060] D0 71 81 50 95 4E 4A 93 41 26 A2 40 39 5D E7 39 .q.P.NJ. A&.@9].9 [0070] 55 00 C6 DF C2 08 30 98 0F D7 D8 E6 27 41 49 D0 U.....0. ....'AI. [0080] 82 2F CE 7E AF 7F CC 8C 16 86 86 AC A1 5B 29 72 ./.~.... .....[)r [0090] 2E 16 62 AA A0 0C 78 DD A0 B9 13 A4 36 25 07 08 ..b...x. ....6%.. [00A0] 65 8D 03 88 F6 6C 87 C3 50 63 6D 44 0A DC E0 0D e....l.. PcmD.... [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] 03 1B EE E6 B0 CB 3E D6 C6 19 D3 BF 40 1D 95 5C ......>. ....@..\ [00D0] 51 D3 F1 91 23 65 BE 7B 00 00 00 00 00 00 00 00 Q...#e.{ ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:47.845820, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:47.845843, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:30:47.845861, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:47.845895, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 07:30:47.845916, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 07:30:47.845935, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 168 bytes. [2025/04/09 07:30:47.845992, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:30:47.846242, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:30:47.846267, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:30:47.846293, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:35:47 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:30:47.846333, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:35:47 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:30:47.846372, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:30:47.846457, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:47.846477, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:30:53.281150, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:53.281200, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:30:53.281261, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:53.281327, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:30:53.281407, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000025 (37) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:53.281600, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:53.281692, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:53.281728, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:53.282476, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:30:53.282572, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000025 (37) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] B7 6D 55 47 E5 F7 0F C1 88 90 76 39 51 DC FA AE .mUG.... ..v9Q... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 9D 4E 49 4E A0 F6 DB 0B 49 1B 1D A2 87 D1 5E D4 .NIN.... I.....^. [0030] D8 63 DE A7 E7 09 A6 14 DE 06 37 B7 87 C8 2F 60 .c...... ..7.../` [0040] 81 43 46 D6 30 04 D0 93 3B 60 AA 07 65 62 F9 43 .CF.0... ;`..eb.C [2025/04/09 07:30:53.282854, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:53.282883, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:30:53.282902, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:53.282937, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:30:53.282987, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:30:53.283010, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:30:53.283043, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:30:53.283116, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:30:53.283143, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:53.283202, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:53.283222, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:30:53.292446, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:30:53.292482, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:53.292524, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:30:53.292568, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:30:53.292620, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:30:53.292645, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:30:53.292669, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:30:53.292689, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:30:53.292708, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 07:30:53.292728, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 07:30:53.292766, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:30:53.292834, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 07:30:53.293069, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000026 (38) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:53.293278, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:53.293360, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:53.293389, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:53.294350, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 07:30:53.294423, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x00000026 (38) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] 90 51 B5 55 11 2A 8F B7 82 14 C4 EB 94 10 EC 60 .Q.U.*.. .......` [0010] 26 38 57 F8 0A 47 E2 05 F4 6F 84 B5 BA A3 1B B5 &8W..G.. .o...... [0020] 81 04 FE 6A F0 28 6D 78 47 CC 2C 21 B7 FE 80 20 ...j.(mx G.,!... [0030] 62 23 14 18 07 6C 17 28 39 81 8B D2 69 E3 A1 EA b#...l.( 9...i... [0040] 24 FE 18 23 EA 9E C3 64 E5 B7 93 02 30 65 7E 91 $..#...d ....0e~. [0050] B9 BF 01 7E 5F 1D 31 4B A7 85 43 4C 86 4B 80 84 ...~_.1K ..CL.K.. [0060] 65 84 96 54 D0 AF A0 1D A5 13 F8 19 93 C5 55 41 e..T.... ......UA [0070] D0 ED 19 D0 DF FE 86 95 55 D0 4D F8 D9 46 19 9A ........ U.M..F.. [0080] B8 5E F6 D8 53 F3 5E 2A 41 D9 6A CF 73 0D 8F 51 .^..S.^* A.j.s..Q [0090] 39 EF 4B D5 56 66 5D CC CF A9 24 DC 91 71 F2 E6 9.K.Vf]. ..$..q.. [00A0] AC 79 57 D2 7F F0 7D B8 3D 3A EC 07 E6 D2 DE C6 .yW...}. =:...... [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] 7A 29 C6 33 2C 9C DF FA EC 2A 0B B7 46 62 22 82 z).3,... .*..Fb". [00D0] 9F CD B5 E3 2F D8 61 40 00 00 00 00 00 00 00 00 ..../.a@ ........ [00E0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:53.294858, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:53.294882, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:30:53.294901, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:53.294941, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 07:30:53.294987, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 07:30:53.295009, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 168 bytes. [2025/04/09 07:30:53.295045, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:30:53.295288, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:30:53.295312, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:30:53.295338, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:35:53 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:30:53.295380, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:35:53 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:30:53.295415, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:30:53.295513, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:53.295535, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:30:58.777759, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:30:58.777824, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:30:58.777926, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:30:58.778056, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:30:58.778203, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000027 (39) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:30:58.778475, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:30:58.778612, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:30:58.778648, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:30:58.779432, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:30:58.779507, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000027 (39) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] F1 3D 2A ED 5C 23 69 06 56 B0 D8 2D 32 E7 4D F3 .=*.\#i. V..-2.M. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] ED DB 4F 32 3D 5F FE 06 DF F0 14 F4 F0 EA B8 52 ..O2=_.. .......R [0030] 47 B1 8C 08 B7 61 B9 E7 B5 5E 4C 6E 14 B7 01 08 G....a.. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:30:58.779792, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:30:58.779819, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:30:58.779840, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:30:58.779875, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:30:58.779921, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:30:58.779945, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:30:58.780009, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:30:58.780103, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:30:58.780141, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:30:58.780206, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:30:58.780231, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:31:01.401290, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:01.401335, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:31:01.401459, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:01.401565, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:31:01.401675, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000028 (40) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:01.401891, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:01.402085, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:31:01.402133, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:31:11.412157, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) cli_api_pipe failed: NT_STATUS_IO_TIMEOUT [2025/04/09 07:31:11.412368, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 10000 (ms) to 1000 (ms). [2025/04/09 07:31:11.412477, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 1000 (ms) to 500 (ms). [2025/04/09 07:31:11.412508, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 500 (ms) to 500 (ms). [2025/04/09 07:31:11.412728, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:31:11.913579, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1946(connection_ok) connection_ok: Connection to windc2.adprotocolx.com for domain ADPROTOCOLX is not connected [2025/04/09 07:31:11.913674, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1760(cm_open_connection) Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. [2025/04/09 07:31:11.913702, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1767(cm_open_connection) Attempt 0/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 07:31:11.913736, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1528(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 07:31:11.913839, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX" domain [2025/04/09 07:31:11.913881, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc2.adprotocolx.com [2025/04/09 07:31:11.913901, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1439(connect_preferred_dc) connect_preferred_dc: saf_servername is 'windc2.adprotocolx.com' for domain ADPROTOCOLX [2025/04/09 07:31:11.913935, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:31:11.913987, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:31:11.914027, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:31:11.914068, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:11.914102, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. [2025/04/09 07:31:11.914183, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.93'. [2025/04/09 07:31:11.914218, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: adprotocolx.com) [2025/04/09 07:31:16.998822, 4, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:16.999022, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:31:16.999293, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:16.999591, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:31:16.999710, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:31:16.999977, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000008 (8) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000088 (136) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:17.000370, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:17.000494, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:31:17.000534, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 232 [2025/04/09 07:31:17.916942, 2, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/cldap.c:417(ads_cldap_netlogon) ads_cldap_netlogon: did not get a reply [2025/04/09 07:31:17.917074, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:387(ads_try_connect) ads_try_connect: ads_cldap_netlogon_5(10.28.1.93, adprotocolx.com) failed. [2025/04/09 07:31:17.917121, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:32:17 AM 2025 EDT] (60 seconds ahead) [2025/04/09 07:31:17.917340, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX (windc2.adprotocolx.com) to failed conn cache [2025/04/09 07:31:17.917368, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) [2025/04/09 07:31:17.917390, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) [2025/04/09 07:31:17.917416, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [ADPROTOCOLX] [2025/04/09 07:31:17.917437, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/adprotocolx.com,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:32:17 AM 2025 EDT] (60 seconds ahead) [2025/04/09 07:31:17.917473, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain adprotocolx.com (windc2.adprotocolx.com) to failed conn cache [2025/04/09 07:31:17.917495, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 07:31:17.917527, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 07:31:17.917554, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [adprotocolx.com] [2025/04/09 07:31:17.917576, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1539(find_dc) Retrieving a list of IP addresses for DCs. [2025/04/09 07:31:17.917608, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 07:31:17.917630, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) ads_dc_name: domain=ADPROTOCOLX [2025/04/09 07:31:17.917686, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 07:31:17.917712, 6, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'adprotocolx.com' [2025/04/09 07:31:17.917736, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) [2025/04/09 07:31:17.917767, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 07:31:17.917791, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:31:17.917811, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) [2025/04/09 07:31:17.917844, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 07:31:17.917879, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:17.917900, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:17.917925, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:17.917947, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:17.918011, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:17.918036, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:17.918068, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:17.918091, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.918126, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:17.918151, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:17.918169, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.918197, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:17.918244, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:17.918270, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:17.918293, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:17.918317, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:17.918342, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.918375, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) cldap_ping_list: Try to create 6 netlogon connections for domain 'adprotocolx.com' (provided count of addresses was 6). [2025/04/09 07:31:17.919913, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f3fd (127997) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc1.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC1' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:31:17.920348, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:31:17.920376, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478522 seconds ahead) [2025/04/09 07:31:17.920419, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:31:17.920439, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478522 seconds ahead) [2025/04/09 07:31:17.920472, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) cldap_ping_list: realm[adprotocolx.com]: selected 10.28.1.92 => windc1.adprotocolx.com [2025/04/09 07:31:17.920491, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f3fd (127997) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc1.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC1' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:31:17.920801, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.92 [2025/04/09 07:31:17.920827, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 07:31:17.920850, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:31:17.920896, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX [2025/04/09 07:31:17.920921, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 07:31:17.920953, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:31:17.921040, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:31:17.921073, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 07:31:17.921167, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 07:31:17.921326, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:31:17.921363, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 07:31:17.921453, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 13 88 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 07:31:17.922995, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 13 88 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 07:31:17.923374, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 07:31:17.923402, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 07:31:17.923422, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.923441, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 07:31:17.923459, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 07:31:17.923476, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:17.923496, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:17.923547, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:17.923571, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:17.923593, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:17.923615, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.923637, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:17.923664, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:17.923687, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:17.923705, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:17.923724, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:17.923752, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:17.923775, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:31:17.923797, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 07:31:17.923818, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:31:17.923837, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) [2025/04/09 07:31:17.923869, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 07:31:17.923887, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 07:31:17.923937, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:31:17.923959, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 07:31:17.924042, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 64 3C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 d<...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 07:31:17.924496, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 64 3C 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 d<...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s [0100] D0 D7 81 C8 0F 00 ...... [2025/04/09 07:31:17.924785, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 07:31:17.924809, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 07:31:17.924828, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:17.924846, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 07:31:17.924864, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 07:31:17.924882, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.924901, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.924943, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:17.924984, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:17.925016, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:17.925039, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:17.925061, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:17.925081, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:17.925102, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.925125, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:17.925144, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:17.925161, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:17.925188, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:31:17.925234, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:31:18.127345, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f3fd (127997) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc1.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC1' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:31:20.927177, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.92 kdc = [2001:192::656a:348:28e1:d1]:88 [2025/04/09 07:31:20.927603, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.92 kdc = [2001:192::656a:348:28e1:d1]:88 [2025/04/09 07:31:20.927673, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) ads_dc_name: using server='WINDC1.ADPROTOCOLX.COM' IP=10.28.1.92 [2025/04/09 07:31:20.927765, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'adprotocolx.com': "Default-First-Site-Name" [2025/04/09 07:31:20.927792, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename Default-First-Site-Name) [2025/04/09 07:31:20.927822, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 07:31:20.927857, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:31:20.927881, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename Default-First-Site-Name) [2025/04/09 07:31:20.927910, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 07:31:20.927950, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:20.928012, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:20.928040, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:20.928068, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:20.928109, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.928144, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:20.928182, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:20.928205, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.928224, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:20.928244, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:20.928262, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.928303, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:31:20.928328, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:31:20.928359, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:31:20.928400, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:31:20.928429, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.928454, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.928474, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name adprotocolx.com (sitename NULL) [2025/04/09 07:31:20.928497, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 07:31:20.928518, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:31:20.928537, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#1c (sitename (null)) [2025/04/09 07:31:20.928561, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name adprotocolx.com#1C found. [2025/04/09 07:31:20.928589, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:20.928626, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:20.928651, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:20.928673, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:20.928695, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.928717, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:20.928738, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:20.928760, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.928779, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:20.928798, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:20.928821, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.928847, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:31:20.928870, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:31:20.928892, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:31:20.928914, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:31:20.928936, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.928996, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.929021, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1543(find_dc) Retrieved IP addresses for 6 DCs. [2025/04/09 07:31:20.929058, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1564(find_dc) Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). [2025/04/09 07:31:20.929165, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 445 [2025/04/09 07:31:20.930596, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1579(find_dc) Successfully connected to DC '10.28.1.92'. [2025/04/09 07:31:20.930651, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. [2025/04/09 07:31:20.930683, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.92'. [2025/04/09 07:31:20.930708, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: adprotocolx.com) [2025/04/09 07:31:20.931526, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f3fd (127997) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc1.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC1' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:31:20.931895, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:31:20.931923, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478519 seconds ahead) [2025/04/09 07:31:20.932002, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:31:20.932025, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478519 seconds ahead) [2025/04/09 07:31:20.932063, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.92 [2025/04/09 07:31:20.932088, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc1.adprotocolx.com#20: 10.28.1.92 [2025/04/09 07:31:20.932113, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC1.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:42:20 AM 2025 EDT] (660 seconds ahead) [2025/04/09 07:31:20.932146, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1134(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f3fd [2025/04/09 07:31:20.932166, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:31:20.932188, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:31:20.932242, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX [2025/04/09 07:31:20.932270, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 07:31:20.932310, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:31:20.932330, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:31:20.932352, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 07:31:20.932373, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 07:31:20.932459, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:31:20.932484, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 07:31:20.932550, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 9A 81 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 07:31:20.933293, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 9A 81 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. [0120] D7 81 C8 0F 00 ..... [2025/04/09 07:31:20.933631, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 07:31:20.933664, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 07:31:20.933686, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.933706, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 07:31:20.933724, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 07:31:20.933743, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.933764, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.933808, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:20.933833, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:20.933857, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:20.933879, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.933901, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:20.933923, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:20.933944, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.934006, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:20.934029, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:20.934048, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.934071, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:31:20.934095, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "adprotocolx.com" domain [2025/04/09 07:31:20.934116, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:31:20.934141, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) [2025/04/09 07:31:20.934163, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 07:31:20.934183, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 07:31:20.934237, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:31:20.934259, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 07:31:20.934329, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 92 6A 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .j...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 07:31:20.934886, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 92 6A 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .j...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej [0100] 03 48 28 E1 00 D1 .H(... [2025/04/09 07:31:20.935190, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 07:31:20.935216, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 07:31:20.935235, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.935255, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 07:31:20.935286, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 07:31:20.935307, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.935342, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.935387, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:20.935411, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:20.935434, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:20.935456, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:20.935478, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:20.935500, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:20.935521, 9, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.935540, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:20.935560, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:20.935578, 4, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:20.935600, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:31:20.935623, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:31:21.036753, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f3fd (127997) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc1.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC1' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:31:23.936149, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.92 kdc = [2001:192::656a:348:28e1:d1]:88 [2025/04/09 07:31:23.936415, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.92 kdc = [2001:192::656a:348:28e1:d1]:88 [2025/04/09 07:31:23.936503, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc1.adprotocolx.com], expire = [1744199183] [2025/04/09 07:31:23.936535, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:46:23 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:31:23.936584, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [adprotocolx.com], server = [windc1.adprotocolx.com], expire = [1744199183] [2025/04/09 07:31:23.936605, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:46:23 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:31:23.936635, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1168(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92' is 'windc1.adprotocolx.com' [2025/04/09 07:31:23.936662, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc1.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 07:31:23.936922, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 20000 (ms) to 10000 (ms). [2025/04/09 07:31:23.937068, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:31:23.939271, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:857(cm_prepare_connection) connecting to windc1.adprotocolx.com (ADPROTOCOLX, adprotocolx.com) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] [2025/04/09 07:31:23.939358, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc1.adprotocolx.com [2025/04/09 07:31:23.939523, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] [2025/04/09 07:31:23.939599, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939515: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:31:23.940806, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939517: Sending unauthenticated request [2025/04/09 07:31:23.940864, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939518: Sending request (182 bytes) to ADPROTOCOLX.COM [2025/04/09 07:31:23.941501, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939519: Sending initial UDP request to dgram 10.28.1.92:88 [2025/04/09 07:31:23.943909, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939520: Received answer (219 bytes) from dgram 10.28.1.92:88 [2025/04/09 07:31:23.943992, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939521: Response was from master KDC [2025/04/09 07:31:23.944037, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939522: Received error from KDC: -1765328359/Additional pre-authentication required [2025/04/09 07:31:23.944088, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939525: Preauthenticating using KDC method data [2025/04/09 07:31:23.944116, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939526: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) [2025/04/09 07:31:23.944152, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939527: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:31:23.947996, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939528: AS key obtained for encrypted timestamp: aes256-cts/C8D8 [2025/04/09 07:31:23.948107, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939530: Encrypted timestamp (for 1744209082.486206): plain 301AA011180F32303235303430393134333132325AA1050203076B3E, encrypted BBA77B0BC1F3943B1D39DF45ED76BEC8C0C2BB4F27B42D948B8EC68818A48D79E0D814D67A78B3247FC7949D187599C8951AA97E27DE4BBC [2025/04/09 07:31:23.948143, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939531: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [2025/04/09 07:31:23.948167, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939532: Produced preauth for next request: PA-ENC-TIMESTAMP (2) [2025/04/09 07:31:23.948206, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939533: Sending request (261 bytes) to ADPROTOCOLX.COM [2025/04/09 07:31:23.948270, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939534: Sending initial UDP request to dgram 10.28.1.92:88 [2025/04/09 07:31:23.950310, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939535: Received answer (102 bytes) from dgram 10.28.1.92:88 [2025/04/09 07:31:23.950384, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939536: Response was from master KDC [2025/04/09 07:31:23.950420, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939537: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP [2025/04/09 07:31:23.950446, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939538: Request or response is too big for UDP; retrying with TCP [2025/04/09 07:31:23.950479, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939539: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) [2025/04/09 07:31:23.950538, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939540: Initiating TCP connection to stream 10.28.1.92:88 [2025/04/09 07:31:23.951120, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939541: Sending TCP request to stream 10.28.1.92:88 [2025/04/09 07:31:23.952359, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939542: Received answer (1596 bytes) from stream 10.28.1.92:88 [2025/04/09 07:31:23.952413, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939543: Terminating TCP connection to stream 10.28.1.92:88 [2025/04/09 07:31:23.952493, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939544: Response was from master KDC [2025/04/09 07:31:23.952547, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939545: Processing preauth types: PA-ETYPE-INFO2 (19) [2025/04/09 07:31:23.952583, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939546: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:31:23.952620, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939547: Produced preauth for next request: (empty) [2025/04/09 07:31:23.952648, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939548: AS key determined by preauth: aes256-cts/C8D8 [2025/04/09 07:31:23.952743, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939549: Decrypted AS reply; session key is: aes256-cts/E772 [2025/04/09 07:31:23.952783, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939550: FAST negotiation: unavailable [2025/04/09 07:31:23.952929, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:31:23.953039, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939551: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:31:23.953084, 10, pid=2377300, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377300] 1744198283.939552: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect [2025/04/09 07:31:23.953120, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc1.adprotocolx.com using Kerberos [2025/04/09 07:31:23.953143, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) cli_session_setup_spnego_send: Connect to windc1.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO [2025/04/09 07:31:23.953409, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 07:31:23.953500, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 07:31:23.958200, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55bdbc4f8610]: subreq: 0x55bdbc4eaec0 [2025/04/09 07:31:23.958243, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55bdbc4fb000]: subreq: 0x55bdbc551ae0 [2025/04/09 07:31:23.958280, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55bdbc4f8610]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4eaec0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906] [2025/04/09 07:31:23.958352, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc551ae0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55bdbc551cc0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] [2025/04/09 07:31:23.960282, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55bdbc4f8610]: subreq: 0x55bdbc542e40 [2025/04/09 07:31:23.960340, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55bdbc4fb000]: subreq: 0x55bdbc551ae0 [2025/04/09 07:31:23.960368, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55bdbc4f8610]: NT_STATUS_OK tevent_req[0x55bdbc542e40/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55bdbc543020)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913] [2025/04/09 07:31:23.960444, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc551ae0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55bdbc551cc0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] [2025/04/09 07:31:23.960638, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:31:23.961037, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc1.adprotocolx.com], expire = [1744199183] [2025/04/09 07:31:23.961071, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:46:23 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:31:23.961115, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [adprotocolx.com], server = [windc1.adprotocolx.com], expire = [1744199183] [2025/04/09 07:31:23.961137, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:46:23 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:31:23.961207, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) set_domain_online: called for domain ADPROTOCOLX [2025/04/09 07:31:23.961495, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:23.961883, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) messaging_dgm_send: Sending message to 2377294 [2025/04/09 07:31:23.961936, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403285364 seconds ahead) ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:31:23.962209, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=18, srvid=0 [2025/04/09 07:31:23.962750, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=17, vnn=4026531841, opcode=4, srvid=0 [2025/04/09 07:31:23.962850, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=18, vnn=4026531841, opcode=149, srvid=0 [2025/04/09 07:31:23.963067, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b [2025/04/09 07:31:23.964095, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:31:23.964134, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:31:23.964172, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:23.964256, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 [2025/04/09 07:31:23.964295, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) ctdbd_migrate: Sending ctdb packet [2025/04/09 07:31:23.964820, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:23.964880, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:23.964912, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:31:23.964943, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:31:23.964995, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:31:23.965107, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 135 [2025/04/09 07:31:23.965804, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:31:23.966749, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 [2025/04/09 07:31:23.966799, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000029 (41) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:23.968101, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.968130, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 72 [2025/04/09 07:31:23.968510, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 44 [2025/04/09 07:31:23.968605, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x00000029 (41) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00001041 (4161) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] 38 00 8. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:23.968901, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.968925, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. [2025/04/09 07:31:23.968949, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:31:23.969080, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : NULL map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2025/04/09 07:31:23.969613, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000002a (42) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:23.969798, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.969820, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 140 [2025/04/09 07:31:23.970370, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 136 [2025/04/09 07:31:23.970433, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x0000002a (42) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 2B 9D 30 91 7C DB E5 4C A6 0E CD 80 ....+.0. |..L.... [0010] 7D EF B5 56 01 00 00 00 01 00 00 00 00 00 00 00 }..V.... ........ [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C2 06 01 00 09 04 00 0A 1C 01 5C 00 00 00 00 00 ........ ..\..... [2025/04/09 07:31:23.970752, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128 [2025/04/09 07:31:23.970773, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.970793, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 128 bytes. [2025/04/09 07:31:23.970841, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 91309d2b-db7c-4ce5-a60e-cd807defb556 num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc206 (49670) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 10.28.1.92 result : 0x00000000 (0) [2025/04/09 07:31:23.971442, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 49670 [2025/04/09 07:31:23.971997, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:31:23.972172, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 [2025/04/09 07:31:23.972205, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x0000002b (43) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:23.972478, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.972504, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 72 [2025/04/09 07:31:23.972760, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 44 [2025/04/09 07:31:23.972812, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x0000002b (43) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b09 (2825) secondary_address_size : 0x0006 (6) secondary_address : '49670' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:23.973096, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.973121, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. [2025/04/09 07:31:23.973145, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:31:23.973175, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3410(cli_rpc_pipe_open_noauth_transport) cli_rpc_pipe_open_noauth: opened pipe netlogon to machine windc1.adprotocolx.com and bound anonymously. [2025/04/09 07:31:23.973216, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 2 for netlogon_creds_cli.tdb [2025/04/09 07:31:23.973242, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2:netlogon_creds_cli.tdb 3: 4: [2025/04/09 07:31:23.973271, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 761302038 key 434C495B475046534E4D [2025/04/09 07:31:23.973297, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=21, vnn=4026531841, opcode=128, srvid=761302038 [2025/04/09 07:31:23.973392, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 761302038 key 434C495B475046534E4D [2025/04/09 07:31:23.973431, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 2 for netlogon_creds_cli.tdb [2025/04/09 07:31:23.973479, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_ServerReqChallenge: struct netr_ServerReqChallenge in: struct netr_ServerReqChallenge server_name : * server_name : '\\windc1.adprotocolx.com' computer_name : * computer_name : 'GPFSNMBASH' credentials : * credentials: struct netr_Credential data : 67f35085d52192ff [2025/04/09 07:31:23.973601, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000002c (44) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000006e (110) context_id : 0x0000 (0) opnum : 0x0004 (4) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:23.973798, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.973821, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 134 [2025/04/09 07:31:23.974240, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 20 [2025/04/09 07:31:23.974293, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0024 (36) auth_length : 0x0000 (0) call_id : 0x0000002c (44) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=12 [0000] 86 B1 10 03 7F CC 52 39 00 00 00 00 ......R9 .... [2025/04/09 07:31:23.974514, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 36, data_len 12 [2025/04/09 07:31:23.974537, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 36 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.974557, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:31:23.974593, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_ServerReqChallenge: struct netr_ServerReqChallenge out: struct netr_ServerReqChallenge return_credentials : * return_credentials: struct netr_Credential data : 86b110037fcc5239 result : NT_STATUS_OK [2025/04/09 07:31:23.974699, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_ServerAuthenticate3: struct netr_ServerAuthenticate3 in: struct netr_ServerAuthenticate3 server_name : * server_name : '\\windc1.adprotocolx.com' account_name : * account_name : 'GPFSNMBASH$' secure_channel_type : SEC_CHAN_WKSTA (2) computer_name : * computer_name : 'GPFSNMBASH' credentials : * credentials: struct netr_Credential data : f09427dc47a0c036 negotiate_flags : * negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC [2025/04/09 07:31:23.975043, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000002d (45) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000009c (156) context_id : 0x0000 (0) opnum : 0x001a (26) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:23.975235, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.975259, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 180 [2025/04/09 07:31:23.976105, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 28 [2025/04/09 07:31:23.976162, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x002c (44) auth_length : 0x0000 (0) call_id : 0x0000002d (45) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000014 (20) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=20 [0000] 11 1E 37 C7 AC 11 3D 0E FF FF 0F 61 54 04 00 00 ..7...=. ...aT... [0010] 00 00 00 00 .... [2025/04/09 07:31:23.976504, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 44, data_len 20 [2025/04/09 07:31:23.976553, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 44 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.976579, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 20 bytes. [2025/04/09 07:31:23.976614, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_ServerAuthenticate3: struct netr_ServerAuthenticate3 out: struct netr_ServerAuthenticate3 return_credentials : * return_credentials: struct netr_Credential data : 111e37c7ac113d0e negotiate_flags : * negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC rid : * rid : 0x00000454 (1108) result : NT_STATUS_OK [2025/04/09 07:31:23.976883, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 2 for netlogon_creds_cli.tdb [2025/04/09 07:31:23.976908, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2:netlogon_creds_cli.tdb 3: 4: [2025/04/09 07:31:23.976935, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 761302038 key 434C495B475046534E4D [2025/04/09 07:31:23.977006, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 761302038 key 434C495B475046534E4D [2025/04/09 07:31:23.977039, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 2 for netlogon_creds_cli.tdb [2025/04/09 07:31:23.977086, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 0f6aa5761550cc62041379939299a172 sequence : 0x67f65a8b (1744198283) seed: struct netr_Credential data : f09427dc47a0c036 client: struct netr_Credential data : f09427dc47a0c036 server: struct netr_Credential data : 111e37c7ac113d0e secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 07:31:23.977384, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_netlogon.c:249(rpccli_setup_netlogon_creds_locked) rpccli_setup_netlogon_creds_locked: using new netlogon_creds cli[GPFSNMBASH$/GPFSNMBASH] to windc1.adprotocolx.com [2025/04/09 07:31:23.977475, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 135 [2025/04/09 07:31:23.977875, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:31:23.978061, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 [2025/04/09 07:31:23.978099, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x0000002e (46) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:23.978371, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.978396, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 72 [2025/04/09 07:31:23.978625, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 44 [2025/04/09 07:31:23.978678, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x0000002e (46) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00001042 (4162) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] 30 91 0. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:23.978987, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.979013, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. [2025/04/09 07:31:23.979037, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:31:23.979089, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : NULL map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2025/04/09 07:31:23.979558, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000002f (47) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:23.979760, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.979784, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 140 [2025/04/09 07:31:23.980088, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 136 [2025/04/09 07:31:23.980140, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x0000002f (47) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 6D BD 67 DB 59 92 10 49 8A D7 13 E3 ....m.g. Y..I.... [0010] 14 DB BB 74 01 00 00 00 01 00 00 00 00 00 00 00 ...t.... ........ [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C2 06 01 00 09 04 00 0A 1C 01 5C 00 00 00 00 00 ........ ..\..... [2025/04/09 07:31:23.980481, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128 [2025/04/09 07:31:23.980504, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.980524, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 128 bytes. [2025/04/09 07:31:23.980558, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : db67bd6d-9259-4910-8ad7-13e314dbbb74 num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc206 (49670) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 10.28.1.92 result : 0x00000000 (0) [2025/04/09 07:31:23.981115, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 49670 [2025/04/09 07:31:23.981482, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:31:23.981527, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 0f6aa5761550cc62041379939299a172 sequence : 0x67f65a8b (1744198283) seed: struct netr_Credential data : f09427dc47a0c036 client: struct netr_Credential data : f09427dc47a0c036 server: struct netr_Credential data : 111e37c7ac113d0e secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 07:31:23.981926, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 07:31:23.981988, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 07:31:23.982018, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 07:31:23.982059, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55bdbc502550]: subreq: 0x55bdbc542e40 [2025/04/09 07:31:23.982089, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55bdbc502550]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc542e40/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc543020)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 07:31:23.982123, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 07:31:23.982221, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x00000030 (48) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 07:31:23.983299, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.983339, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 111 [2025/04/09 07:31:23.984099, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 64 [2025/04/09 07:31:23.984217, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0050 (80) auth_length : 0x000c (12) call_id : 0x00000030 (48) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b0a (2826) secondary_address_size : 0x0006 (6) secondary_address : '49670' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 07:31:23.984514, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.984539, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 80 bytes. [2025/04/09 07:31:23.984564, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:31:23.984598, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:31:23.984636, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55bdbc502550]: subreq: 0x55bdbc542e40 [2025/04/09 07:31:23.984666, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55bdbc502550]: NT_STATUS_OK tevent_req[0x55bdbc542e40/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc543020)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 07:31:23.984746, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 0f6aa5761550cc62041379939299a172 sequence : 0x67f65a8b (1744198283) seed: struct netr_Credential data : f09427dc47a0c036 client: struct netr_Credential data : f09427dc47a0c036 server: struct netr_Credential data : 111e37c7ac113d0e secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 07:31:23.985039, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:254(netlogon_creds_step) seed dc2794f0:36c0a047 [2025/04/09 07:31:23.985068, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:259(netlogon_creds_step) seed+time 441def7d:36c0a047 [2025/04/09 07:31:23.985101, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:269(netlogon_creds_step) CLIENT 294550ea:b7a85bdc [2025/04/09 07:31:23.985119, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:275(netlogon_creds_step) seed+time+1 441def7e:36c0a047 [2025/04/09 07:31:23.985140, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../libcli/auth/credentials.c:283(netlogon_creds_step) SERVER be3250e9:bfbd2ef9 [2025/04/09 07:31:23.985177, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonGetCapabilities: struct netr_LogonGetCapabilities in: struct netr_LogonGetCapabilities server_name : * server_name : '\\windc1.adprotocolx.com' computer_name : * computer_name : 'GPFSNMBASH' credential : * credential: struct netr_Authenticator cred: struct netr_Credential data : ea504529dc5ba8b7 timestamp : Wed Apr 9 07:31:25 AM 2025 EDT return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : 0000000000000000 timestamp : (time_t)0 query_level : 0x00000001 (1) [2025/04/09 07:31:23.985353, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:31:23.985539, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000031 (49) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000000c0 (192) context_id : 0x0000 (0) opnum : 0x0015 (21) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:23.985723, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:23.985812, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.985837, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 280 [2025/04/09 07:31:23.986408, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 104 [2025/04/09 07:31:23.986468, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0078 (120) auth_length : 0x0038 (56) call_id : 0x00000031 (49) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000018 (24) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=96 [0000] B0 6F 25 41 05 84 98 FD CE BD AE 50 7D 5A 69 37 .o%A.... ...P}Zi7 [0010] 67 B3 0A 09 DF 11 A9 56 DB 99 0F B9 F6 61 C7 4A g......V .....a.J [0020] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0030] 7E 0B BC AC B5 F9 38 F6 F3 CB 90 B9 33 40 C1 95 ~.....8. ....3@.. [0040] E9 A4 95 D7 11 F6 72 3E 00 00 00 00 00 00 00 00 ......r> ........ [0050] 0C 00 00 00 00 00 00 00 41 00 44 00 50 00 52 00 ........ A.D.P.R. [2025/04/09 07:31:23.986744, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:23.986766, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:31:23.986785, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:23.986819, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 120, data_len 24 [2025/04/09 07:31:23.986841, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 120 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.986868, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 24 bytes. [2025/04/09 07:31:23.986898, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonGetCapabilities: struct netr_LogonGetCapabilities out: struct netr_LogonGetCapabilities return_authenticator : * return_authenticator: struct netr_Authenticator cred: struct netr_Credential data : e95032bef92ebdbf timestamp : (time_t)0 capabilities : * capabilities : union netr_Capabilities(case 1) server_capabilities : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC result : NT_STATUS_OK [2025/04/09 07:31:23.987196, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:754(netlogon_creds_cli_store_internal) creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 0f6aa5761550cc62041379939299a172 sequence : 0x67f65a8d (1744198285) seed: struct netr_Credential data : 7eef1d4447a0c036 client: struct netr_Credential data : ea504529dc5ba8b7 server: struct netr_Credential data : e95032bef92ebdbf secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 07:31:23.987480, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 2 for netlogon_creds_cli.tdb [2025/04/09 07:31:23.987503, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2:netlogon_creds_cli.tdb 3: 4: [2025/04/09 07:31:23.987529, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 761302038 key 434C495B475046534E4D [2025/04/09 07:31:23.987556, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 761302038 key 434C495B475046534E4D [2025/04/09 07:31:23.987583, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 2 for netlogon_creds_cli.tdb [2025/04/09 07:31:23.987619, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:31:23.987640, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:31:23.987665, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:23.987692, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 07:31:23.987715, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=22, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 07:31:23.987755, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:23.987784, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:31:23.987803, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:31:23.987820, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:31:23.987856, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:31:23.987917, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000032 (50) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:23.988133, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:23.988209, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:23.988234, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:31:23.988757, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:31:23.988813, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000032 (50) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] AF 95 E9 C9 2F 01 E5 12 01 E3 BC 40 16 25 46 1E ..../... ...@.%F. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] F5 57 8F C2 02 74 3D 8F 28 86 C6 FA C5 F7 1A 19 .W...t=. (....... [0030] 86 2D 16 50 C3 06 84 E9 F3 CB 90 B9 33 40 C1 95 .-.P.... ....3@.. [0040] E9 A4 95 D7 11 F6 72 3E 00 00 00 00 00 00 00 00 ......r> ........ [2025/04/09 07:31:23.989102, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:23.989126, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:31:23.989145, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:23.989177, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:31:23.989198, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:31:23.989217, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:31:23.989244, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:31:23.989346, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:31:23.989379, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:23.989460, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:23.989481, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:31:24.060372, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:24.060436, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:31:24.060505, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:24.060587, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:31:24.060667, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000033 (51) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:24.060872, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:24.060985, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:24.061018, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:31:24.061843, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:31:24.061900, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000033 (51) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 94 1B D1 6C E2 D5 5B CC 2F 1F 1C D8 E8 3F 44 4E ...l..[. /....?DN [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 2F 5E 68 C9 B8 14 13 EE FE 0D 2A 47 E2 CD 4E B2 /^h..... ..*G..N. [0030] E3 D5 DD 9F C1 B2 74 20 F3 CB 90 B9 33 40 C1 95 ......t ....3@.. [0040] E9 A4 95 D7 11 F6 72 3E 00 00 00 00 00 00 00 00 ......r> ........ [2025/04/09 07:31:24.062204, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:24.062229, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:31:24.062248, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:24.062281, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:31:24.062304, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:31:24.062337, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:31:24.062375, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:31:24.062444, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:31:24.062467, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:24.062525, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:24.062545, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:31:27.010922, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) cli_api_pipe failed: NT_STATUS_IO_TIMEOUT [2025/04/09 07:31:27.011195, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 10000 (ms) to 1000 (ms). [2025/04/09 07:31:27.011314, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 1000 (ms) to 500 (ms). [2025/04/09 07:31:27.011384, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 500 (ms) to 500 (ms). [2025/04/09 07:31:27.011588, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:31:27.512458, 3, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1946(connection_ok) connection_ok: Connection to windc2.adprotocolx.com for domain ADPROTOCOLX is not connected [2025/04/09 07:31:27.512534, 3, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1760(cm_open_connection) Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. [2025/04/09 07:31:27.512558, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1767(cm_open_connection) Attempt 0/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 07:31:27.512588, 3, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1528(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 07:31:27.512663, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc1.adprotocolx.com" for "ADPROTOCOLX" domain [2025/04/09 07:31:27.512690, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com [2025/04/09 07:31:27.512708, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1439(connect_preferred_dc) connect_preferred_dc: saf_servername is 'windc1.adprotocolx.com' for domain ADPROTOCOLX [2025/04/09 07:31:27.512752, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:31:27.512777, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:31:27.512801, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc1.adprotocolx.com#20 found. [2025/04/09 07:31:27.512845, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:27.512880, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1106(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. [2025/04/09 07:31:27.512941, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.92'. [2025/04/09 07:31:27.512997, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: adprotocolx.com) [2025/04/09 07:31:27.513802, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f3fd (127997) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc1.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC1' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:31:27.514191, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:31:27.514217, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478512 seconds ahead) [2025/04/09 07:31:27.514290, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:31:27.514312, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447478512 seconds ahead) [2025/04/09 07:31:27.514347, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.92 [2025/04/09 07:31:27.514378, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc1.adprotocolx.com#20: 10.28.1.92 [2025/04/09 07:31:27.514418, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC1.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:42:27 AM 2025 EDT] (660 seconds ahead) [2025/04/09 07:31:27.514450, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1134(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f3fd [2025/04/09 07:31:27.514469, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:31:27.514490, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:31:27.514551, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = adprotocolx.com, domain = ADPROTOCOLX [2025/04/09 07:31:27.514578, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc1.adprotocolx.com" for "adprotocolx.com" domain [2025/04/09 07:31:27.514602, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc1.adprotocolx.com, *" [2025/04/09 07:31:27.514621, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:31:27.514641, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 07:31:27.514669, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 07:31:27.514749, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:31:27.514778, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 07:31:27.514851, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] E0 6F 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .o...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 .com..!. . [2025/04/09 07:31:27.515504, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] E0 6F 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .o...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 sdcs.adp rotocolx [0050] 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 00 .com..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 07:31:27.515825, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 07:31:27.515852, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 07:31:27.515871, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:27.515890, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 07:31:27.515908, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 07:31:27.515926, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:27.515945, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:27.516015, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:27.516046, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:31:27.516068, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:31:27.516090, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc1.adprotocolx.com#20 found. [2025/04/09 07:31:27.516113, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:27.516137, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:27.516159, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:27.516181, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:27.516202, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:27.516223, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:27.516243, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:27.516264, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:27.516287, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:27.516307, 4, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:27.516325, 4, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 10.28.1.93 192.168.122.206 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:27.516347, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:31:27.516369, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc1.adprotocolx.com" for "adprotocolx.com" domain [2025/04/09 07:31:27.516404, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc1.adprotocolx.com, *" [2025/04/09 07:31:27.516425, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up adprotocolx.com#dcdc (sitename (null)) [2025/04/09 07:31:27.516446, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for adprotocolx.com using DNS [2025/04/09 07:31:27.516464, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.adprotocolx.com [2025/04/09 07:31:27.516512, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:31:27.516534, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.adprotocolx.com/1/33 via UDP [2025/04/09 07:31:27.516589, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] B2 90 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 x.com..! .. [2025/04/09 07:31:27.517143, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] B2 90 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 61 64 70 72 6F 74 6F 63 6F 6C msdcs.ad protocol [0030] 78 03 63 6F 6D 00 00 21 00 01 C0 0C 00 21 00 01 x.com..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s [0100] D0 D7 81 C8 0F 00 ...... [2025/04/09 07:31:27.517451, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.92 [2025/04/09 07:31:27.517484, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.133 [2025/04/09 07:31:27.517503, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:27.517522, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[0] 10.28.1.93 [2025/04/09 07:31:27.517539, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[1] 192.168.122.206 [2025/04/09 07:31:27.517557, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup adprotocolx.com got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:27.517577, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:27.517618, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:31:27.517648, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:31:27.517670, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:31:27.517692, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc1.adprotocolx.com#20 found. [2025/04/09 07:31:27.517715, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:27.517738, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:27.517760, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.92 [2025/04/09 07:31:27.517781, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.133 [2025/04/09 07:31:27.517802, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::656a:348:28e1:d1 [2025/04/09 07:31:27.517823, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 10.28.1.93 [2025/04/09 07:31:27.517843, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 192.168.122.206 [2025/04/09 07:31:27.517870, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain adprotocolx.com server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:27.517889, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:31:27.517908, 4, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:31:27.517929, 4, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:31:27.517951, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:31:27.517998, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:31:27.719787, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f3fd (127997) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc1.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC1' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:31:30.521011, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.92 kdc = [2001:192::656a:348:28e1:d1]:88 [2025/04/09 07:31:30.521200, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.92 kdc = [2001:192::656a:348:28e1:d1]:88 [2025/04/09 07:31:30.521278, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc1.adprotocolx.com], expire = [1744199190] [2025/04/09 07:31:30.521306, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:46:30 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:31:30.521352, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [adprotocolx.com], server = [windc1.adprotocolx.com], expire = [1744199190] [2025/04/09 07:31:30.521373, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:46:30 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:31:30.521404, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1168(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92' is 'windc1.adprotocolx.com' [2025/04/09 07:31:30.521448, 9, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com [2025/04/09 07:31:30.521526, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 445 [2025/04/09 07:31:30.523105, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc1.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 07:31:30.523361, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 20000 (ms) to 10000 (ms). [2025/04/09 07:31:30.523480, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:31:30.526315, 5, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:857(cm_prepare_connection) connecting to windc1.adprotocolx.com (ADPROTOCOLX, adprotocolx.com) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] [2025/04/09 07:31:30.526362, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc1.adprotocolx.com [2025/04/09 07:31:30.526612, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] [2025/04/09 07:31:30.526681, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526604: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:31:30.527267, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526606: Sending unauthenticated request [2025/04/09 07:31:30.527323, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526607: Sending request (182 bytes) to ADPROTOCOLX.COM [2025/04/09 07:31:30.527649, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526608: Sending initial UDP request to dgram 10.28.1.92:88 [2025/04/09 07:31:30.529111, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526609: Received answer (219 bytes) from dgram 10.28.1.92:88 [2025/04/09 07:31:30.529214, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526610: Response was from master KDC [2025/04/09 07:31:30.529261, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526611: Received error from KDC: -1765328359/Additional pre-authentication required [2025/04/09 07:31:30.529318, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526614: Preauthenticating using KDC method data [2025/04/09 07:31:30.529347, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526615: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) [2025/04/09 07:31:30.529377, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526616: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:31:30.533353, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526617: AS key obtained for encrypted timestamp: aes256-cts/C8D8 [2025/04/09 07:31:30.533430, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526619: Encrypted timestamp (for 1744209089.79996): plain 301AA011180F32303235303430393134333132395AA105020301387C, encrypted 6908374D76B1D77DE8F4A79A810815AA8FC6427FC4D5187C3301D62207329D2ED38EAD306CEB7D76812BC3F6AFD3FA3EAF23C0C60C19DB6D [2025/04/09 07:31:30.533476, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526620: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [2025/04/09 07:31:30.533501, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526621: Produced preauth for next request: PA-ENC-TIMESTAMP (2) [2025/04/09 07:31:30.533550, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526622: Sending request (261 bytes) to ADPROTOCOLX.COM [2025/04/09 07:31:30.533632, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526623: Sending initial UDP request to dgram 10.28.1.92:88 [2025/04/09 07:31:30.534861, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526624: Received answer (102 bytes) from dgram 10.28.1.92:88 [2025/04/09 07:31:30.534926, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526625: Response was from master KDC [2025/04/09 07:31:30.535014, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526626: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP [2025/04/09 07:31:30.535048, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526627: Request or response is too big for UDP; retrying with TCP [2025/04/09 07:31:30.535073, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526628: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) [2025/04/09 07:31:30.535145, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526629: Initiating TCP connection to stream 10.28.1.92:88 [2025/04/09 07:31:30.535539, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526630: Sending TCP request to stream 10.28.1.92:88 [2025/04/09 07:31:30.537337, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526631: Received answer (1596 bytes) from stream 10.28.1.92:88 [2025/04/09 07:31:30.537378, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526632: Terminating TCP connection to stream 10.28.1.92:88 [2025/04/09 07:31:30.537488, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526633: Response was from master KDC [2025/04/09 07:31:30.537547, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526634: Processing preauth types: PA-ETYPE-INFO2 (19) [2025/04/09 07:31:30.537579, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526635: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:31:30.537625, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526636: Produced preauth for next request: (empty) [2025/04/09 07:31:30.537661, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526637: AS key determined by preauth: aes256-cts/C8D8 [2025/04/09 07:31:30.537781, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526638: Decrypted AS reply; session key is: aes256-cts/92D9 [2025/04/09 07:31:30.537856, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526639: FAST negotiation: unavailable [2025/04/09 07:31:30.537910, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:31:30.537956, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526640: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:31:30.538042, 10, pid=2377677, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3947(smb_krb5_trace_cb) smb_krb5_trace_cb: [2377677] 1744198290.526641: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect [2025/04/09 07:31:30.538091, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc1.adprotocolx.com using Kerberos [2025/04/09 07:31:30.538117, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) cli_session_setup_spnego_send: Connect to windc1.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO [2025/04/09 07:31:30.538362, 5, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 07:31:30.538444, 5, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 07:31:30.549224, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55bdbc4fabf0]: subreq: 0x55bdbc4f2ad0 [2025/04/09 07:31:30.549260, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55bdbc4fb000]: subreq: 0x55bdbc4daaa0 [2025/04/09 07:31:30.549289, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55bdbc4fabf0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4f2ad0/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55bdbc4f2cb0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906] [2025/04/09 07:31:30.549373, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4daaa0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55bdbc4dac80)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] [2025/04/09 07:31:30.551132, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55bdbc4fabf0]: subreq: 0x55bdbc514150 [2025/04/09 07:31:30.551165, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55bdbc4fb000]: subreq: 0x55bdbc4daaa0 [2025/04/09 07:31:30.551192, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55bdbc4fabf0]: NT_STATUS_OK tevent_req[0x55bdbc514150/../../source3/librpc/crypto/gse.c:896]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55bdbc514330)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:913] [2025/04/09 07:31:30.551227, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc4daaa0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55bdbc4dac80)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116] [2025/04/09 07:31:30.551442, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:575(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:31:30.553057, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc1.adprotocolx.com], expire = [1744199190] [2025/04/09 07:31:30.553094, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 07:46:30 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:31:30.553161, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [adprotocolx.com], server = [windc1.adprotocolx.com], expire = [1744199190] [2025/04/09 07:31:30.553184, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 07:46:30 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:31:30.553251, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) set_domain_online: called for domain ADPROTOCOLX [2025/04/09 07:31:30.553283, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:30.553386, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) messaging_dgm_send: Sending message to 2377294 [2025/04/09 07:31:30.553448, 10, pid=2377677, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403285357 seconds ahead) ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:31:30.553665, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=14, vnn=4026531841, opcode=18, srvid=0 [2025/04/09 07:31:30.553783, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=15, vnn=4026531841, opcode=4, srvid=0 [2025/04/09 07:31:30.553872, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=149, srvid=0 [2025/04/09 07:31:30.553988, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b [2025/04/09 07:31:30.554092, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 0f6aa5761550cc62041379939299a172 sequence : 0x67f65a8d (1744198285) seed: struct netr_Credential data : 7eef1d4447a0c036 client: struct netr_Credential data : ea504529dc5ba8b7 server: struct netr_Credential data : e95032bef92ebdbf secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 07:31:30.554451, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:31:30.554498, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:31:30.554532, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:30.554605, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 [2025/04/09 07:31:30.554633, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:952(ctdbd_migrate) ctdbd_migrate: Sending ctdb packet [2025/04/09 07:31:30.566749, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:30.566789, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:30.566819, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:31:30.566840, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:31:30.566858, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:31:30.566925, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 135 [2025/04/09 07:31:30.574664, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:31:30.574863, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 [2025/04/09 07:31:30.574910, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000009 (9) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:30.575195, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:30.575221, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 72 [2025/04/09 07:31:30.575987, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 44 [2025/04/09 07:31:30.576090, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x00000009 (9) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00001044 (4164) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] 67 DB g. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:30.576382, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK [2025/04/09 07:31:30.576407, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. [2025/04/09 07:31:30.576431, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:31:30.576505, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : NULL map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2025/04/09 07:31:30.577059, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x0000000a (10) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:30.577252, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:30.577275, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 140 [2025/04/09 07:31:30.579373, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 136 [2025/04/09 07:31:30.579443, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x0000000a (10) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 99 C2 52 EF 88 B8 CB 4A 93 25 86 8B ......R. ...J.%.. [0010] AE 1A E0 20 01 00 00 00 01 00 00 00 00 00 00 00 ... .... ........ [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 56 34 12 34 12 CD AB EF 00 01 .....xV4 .4...... [0040] 23 45 67 CF FB 01 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C2 06 01 00 09 04 00 0A 1C 01 5C 00 00 00 00 00 ........ ..\..... [2025/04/09 07:31:30.579769, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128 [2025/04/09 07:31:30.579793, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK [2025/04/09 07:31:30.579813, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 128 bytes. [2025/04/09 07:31:30.579851, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : ef52c299-b888-4acb-9325-868bae1ae020 num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. [0010] 01 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc206 (49670) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 10.28.1.92 result : 0x00000000 (0) [2025/04/09 07:31:30.580443, 3, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 49670 [2025/04/09 07:31:30.581275, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:31:30.581329, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 0f6aa5761550cc62041379939299a172 sequence : 0x67f65a8d (1744198285) seed: struct netr_Credential data : 7eef1d4447a0c036 client: struct netr_Credential data : ea504529dc5ba8b7 server: struct netr_Credential data : e95032bef92ebdbf secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 07:31:30.581737, 5, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 07:31:30.581781, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 07:31:30.581805, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 07:31:30.581854, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc514150 [2025/04/09 07:31:30.581886, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc514150/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc514330)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 07:31:30.581924, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 07:31:30.582045, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x0000000b (11) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 07:31:30.582357, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:30.582381, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 111 [2025/04/09 07:31:30.582834, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 64 [2025/04/09 07:31:30.582888, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0050 (80) auth_length : 0x000c (12) call_id : 0x0000000b (11) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b0c (2828) secondary_address_size : 0x0006 (6) secondary_address : '49670' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 07:31:30.583243, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK [2025/04/09 07:31:30.583268, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 80 bytes. [2025/04/09 07:31:30.583291, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:31:30.583313, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:31:30.583344, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc514150 [2025/04/09 07:31:30.583371, 10, pid=2377677, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc514150/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc514330)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 07:31:30.583411, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:31:30.583450, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:31:30.583479, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:30.583504, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 07:31:30.583527, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=18, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 07:31:30.583641, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:30.583677, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:31:30.583697, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:31:30.583715, 5, pid=2377677, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:31:30.583751, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:31:30.583815, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:31:30.584068, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000c (12) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000088 (136) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:30.584257, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:30.584350, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:30.584376, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 232 [2025/04/09 07:31:30.585052, 5, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:31:30.585112, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000000c (12) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 51 0E 39 8B 33 B0 94 2B E8 6F E1 A8 98 11 C7 B8 Q.9.3..+ .o...... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 36 D0 33 4E 1A 49 E6 1B 42 AB 45 0F 33 CA 09 A4 6.3N.I.. B.E.3... [0030] 45 A6 16 75 B5 E4 B0 AD 5F 8C 48 13 64 8C 6D 4D E..u.... _.H.d.mM [0040] BC 45 A3 DC F6 F2 E1 87 52 EC D9 1D 9C B1 C1 D8 .E...... R....... [2025/04/09 07:31:30.585381, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:30.585403, 10, pid=2377677, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:31:30.585423, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:30.585475, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:31:30.585499, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:31:30.585519, 10, pid=2377677, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:31:30.585547, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:31:30.585636, 5, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:31:30.585671, 1, pid=2377677, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:30.585780, 4, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:30.585804, 10, pid=2377677, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:31:31.402176, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:31.402225, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:31:31.402456, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:31.402557, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:31:31.402669, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000034 (52) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:31.402882, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:31.403037, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:31.403081, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:31:31.403729, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:31:31.403794, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000034 (52) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 7F CA 94 BD D3 8B 6F D9 9E EC EF 22 21 76 6A 19 ......o. ..."!vj. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 6C FC BD 2E 4E 89 B0 37 46 0D BB 1F 74 41 EE 91 l...N..7 F...tA.. [0030] CB D9 B5 B8 84 B3 3C 72 F3 CB 90 B9 33 40 C1 95 ...... ........ [2025/04/09 07:31:31.404090, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:31.404115, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:31:31.404135, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:31.404178, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:31:31.404201, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:31:31.404256, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:31:31.404290, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:31:31.404362, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:31:31.404386, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:31.404477, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:31.404501, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:31:35.700268, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 36 extra bytes [2025/04/09 07:31:35.700339, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:35.700375, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') [2025/04/09 07:31:35.700470, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:31:35.700625, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_DsRGetDCName: struct netr_DsRGetDCName in: struct netr_DsRGetDCName server_unc : * server_unc : 'windc1.adprotocolx.com' domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_guid : NULL flags : 0x40000001 (1073741825) 1: DS_FORCE_REDISCOVERY 0: DS_DIRECTORY_SERVICE_REQUIRED 0: DS_DIRECTORY_SERVICE_PREFERRED 0: DS_GC_SERVER_REQUIRED 0: DS_PDC_REQUIRED 0: DS_BACKGROUND_ONLY 0: DS_IP_REQUIRED 0: DS_KDC_REQUIRED 0: DS_TIMESERV_REQUIRED 0: DS_WRITABLE_REQUIRED 0: DS_GOOD_TIMESERV_PREFERRED 0: DS_AVOID_SELF 0: DS_ONLY_LDAP_NEEDED 0: DS_IS_FLAT_NAME 0: DS_IS_DNS_NAME 0: DS_TRY_NEXTCLOSEST_SITE 0: DS_DIRECTORY_SERVICE_6_REQUIRED 0: DS_WEB_SERVICE_REQUIRED 0: DS_DIRECTORY_SERVICE_8_REQUIRED 0: DS_DIRECTORY_SERVICE_9_REQUIRED 0: DS_DIRECTORY_SERVICE_10_REQUIRED 1: DS_RETURN_DNS_NAME 0: DS_RETURN_FLAT_NAME [2025/04/09 07:31:35.700876, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000035 (53) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x0014 (20) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:35.701103, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:35.701203, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:35.701229, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 216 [2025/04/09 07:31:35.702959, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 472 [2025/04/09 07:31:35.703051, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x01e8 (488) auth_length : 0x0038 (56) call_id : 0x00000035 (53) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000190 (400) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=464 [0000] 5D B7 54 E1 51 AD 2F B3 7B 49 4B 6B 0F 0A 5A 98 ].T.Q./. {IKk..Z. [0010] 7A EA EC 0D 91 12 F0 8A F3 33 86 76 F9 C9 CC 69 z....... .3.v...i [0020] FA 80 BA 5D 0F 0E E4 98 00 62 C3 6B 7A A1 65 54 ...].... .b.kz.eT [0030] A5 A7 03 77 63 22 57 2F C5 F6 E6 A1 F4 DF 84 9B ...wc"W/ ........ [0040] 56 AC 16 E1 49 21 24 82 82 5A 15 DB 4B C6 37 D0 V...I!$. .Z..K.7. [0050] C0 8D 10 60 B9 90 74 3F 96 B2 1D CF CD BC 7F 49 ...`..t? .......I [0060] 27 74 F7 16 6C B8 65 60 4E 08 55 C4 8F 38 78 F5 't..l.e` N.U..8x. [0070] 06 E2 54 1E 87 18 10 0E D9 6B D9 1B 5A BC 36 FC ..T..... .k..Z.6. [0080] 48 E1 78 5E 7D C7 D4 ED BE F7 96 C1 0C 05 03 6B H.x^}... .......k [0090] 55 50 5D 0E E8 E9 9E 8E 16 5C B8 DE 36 DA 91 40 UP]..... .\..6..@ [00A0] 04 D9 DD 3E A7 77 2B 14 72 3E 01 B0 FE C9 DD 3A ...>.w+. r>.....: [00B0] B9 FB 5B CE 4C 33 42 34 AF D1 E3 54 E5 4D 21 B9 ..[.L3B4 ...T.M!. [00C0] E6 A4 66 B9 B3 84 92 FF E6 3E BA BF A9 AB C1 9F ..f..... .>...... [00D0] 26 24 6B 0F F8 2C 15 8E 05 72 5C 18 4E 84 23 D8 &$k..,.. .r\.N.#. [00E0] FB 30 11 7D FC 42 A0 24 27 EE 6C D3 C3 6C 43 84 .0.}.B.$ '.l..lC. [00F0] 22 54 C8 C6 25 65 A3 5B B8 8D 92 CA C8 87 DC D4 "T..%e.[ ........ [0100] DD CC 65 B4 1C 71 EA 12 1B 46 21 15 83 48 32 52 ..e..q.. .F!..H2R [0110] E5 DE 79 8B 77 F4 9E D1 9C 6D 9A F1 A6 9F CF BB ..y.w... .m...... [0120] 57 4B 31 D5 E9 0B C6 80 F7 77 F2 0F 96 F2 D5 EE WK1..... .w...... [0130] 17 71 97 88 DF 84 D3 F8 B9 DD A0 61 4C 87 BA 8D .q...... ...aL... [0140] D6 CB DB 27 E7 3A 25 30 59 2A 34 3B 0C A1 99 E1 ...'.:%0 Y*4;.... [0150] 51 FD 20 15 EB 89 F1 73 D7 E4 30 0C 65 EA B6 03 Q. ....s ..0.e... [0160] 7D 15 4A D3 11 30 64 87 5F 51 90 D5 D0 54 11 E2 }.J..0d. _Q...T.. [0170] 50 7D F3 41 D6 64 0F 6A 05 AA 8F 76 18 B8 43 39 P}.A.d.j ...v..C9 [0180] 9F F4 35 A9 48 E0 FC E0 4F 42 DB AF A9 6D F9 0D ..5.H... OB...m.. [0190] 44 06 00 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [01A0] 25 0B 8E D7 CB 45 39 5A 31 70 22 48 FB E6 DD AB %....E9Z 1p"H.... [01B0] 81 A1 53 A0 E2 B4 C8 70 00 00 00 00 00 00 00 00 ..S....p ........ [01C0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:31:35.703694, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:35.703718, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:31:35.703737, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:35.703776, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 488, data_len 400 [2025/04/09 07:31:35.703798, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 488 at offset 0: NT_STATUS_OK [2025/04/09 07:31:35.703817, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 400 bytes. [2025/04/09 07:31:35.703872, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_DsRGetDCName: struct netr_DsRGetDCName out: struct netr_DsRGetDCName info : * info : * info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : '\\windc1.adprotocolx.com' dc_address : * dc_address : '\\2001:192::656a:348:28e1:d1' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 domain_name : * domain_name : 'adprotocolx.com' forest_name : * forest_name : 'adprotocolx.com' dc_flags : 0xe001f3fd (3758224381) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 1: NBT_SERVER_HAS_DNS_NAME 1: NBT_SERVER_IS_DEFAULT_NC 1: NBT_SERVER_FOREST_ROOT dc_site_name : * dc_site_name : 'Default-First-Site-Name' client_site_name : * client_site_name : 'Default-First-Site-Name' result : WERR_OK [2025/04/09 07:31:35.704179, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : * dc_info: struct netr_DsRGetDCNameInfo dc_unc : * dc_unc : '\\windc1.adprotocolx.com' dc_address : * dc_address : '\\2001:192::656a:348:28e1:d1' dc_address_type : DS_ADDRESS_TYPE_INET (1) domain_guid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 domain_name : * domain_name : 'adprotocolx.com' forest_name : * forest_name : 'adprotocolx.com' dc_flags : 0xe001f3fd (3758224381) 1: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 1: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 1: NBT_SERVER_HAS_DNS_NAME 1: NBT_SERVER_IS_DEFAULT_NC 1: NBT_SERVER_FOREST_ROOT dc_site_name : * dc_site_name : 'Default-First-Site-Name' client_site_name : * client_site_name : 'Default-First-Site-Name' result : NT_STATUS_OK [2025/04/09 07:31:35.704459, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:35.704483, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4408 bytes to parent [2025/04/09 07:31:38.745614, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:31:38.745669, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:38.745692, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:31:38.745759, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:38.745829, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:38.745863, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:31:38.745891, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:31:38.745912, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:31:38.745942, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 07:31:38.745999, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 07:31:38.746043, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:31:38.746073, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:31:38.746112, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:38.746164, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:38.746196, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:31:38.746216, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:31:38.746235, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:31:38.746303, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 135 [2025/04/09 07:31:38.746716, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:31:38.747035, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 0, auth_level 1 [2025/04/09 07:31:38.747077, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0048 (72) auth_length : 0x0000 (0) call_id : 0x00000036 (54) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : e1af8308-5d1f-11c9-91a4-08002b14a0fa if_version : 0x00000003 (3) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:38.747339, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:38.747364, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 72 [2025/04/09 07:31:38.747635, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 44 [2025/04/09 07:31:38.747706, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x003c (60) auth_length : 0x0000 (0) call_id : 0x00000036 (54) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00001045 (4165) secondary_address_size : 0x0004 (4) secondary_address : '135' _pad1 : DATA_BLOB length=2 [0000] 52 EF R. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=0 [2025/04/09 07:31:38.748020, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 60 at offset 0: NT_STATUS_OK [2025/04/09 07:31:38.748046, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 60 bytes. [2025/04/09 07:31:38.748070, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:31:38.748125, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map in: struct epm_Map object : NULL map_tower : * map_tower: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [0010] 00 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 0.0.0.0 entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 00000000-0000-0000-0000-000000000000 max_towers : 0x00000001 (1) [2025/04/09 07:31:38.748628, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0000 (0) call_id : 0x00000037 (55) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000074 (116) context_id : 0x0000 (0) opnum : 0x0003 (3) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:38.748819, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:38.748843, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 140 [2025/04/09 07:31:38.749215, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 136 [2025/04/09 07:31:38.749275, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0098 (152) auth_length : 0x0000 (0) call_id : 0x00000037 (55) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000080 (128) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=128 [0000] 00 00 00 00 A0 CD 8B D1 3E 32 A1 43 A4 04 E8 DA ........ >2.C.... [0010] 2A 3E 45 14 01 00 00 00 01 00 00 00 00 00 00 00 *>E..... ........ [0020] 01 00 00 00 02 00 00 00 4B 00 00 00 4B 00 00 00 ........ K...K... [0030] 05 00 13 00 0D 78 57 34 12 34 12 CD AB EF 00 01 .....xW4 .4...... [0040] 23 45 67 89 AB 00 00 02 00 00 00 13 00 0D 04 5D #Eg..... .......] [0050] 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 ........ ..+.H`.. [0060] 02 00 00 00 01 00 0B 02 00 00 00 01 00 07 02 00 ........ ........ [0070] C2 03 01 00 09 04 00 0A 1C 01 5C 00 00 00 00 00 ........ ..\..... [2025/04/09 07:31:38.749607, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 152, data_len 128 [2025/04/09 07:31:38.749630, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 152 at offset 0: NT_STATUS_OK [2025/04/09 07:31:38.749650, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 128 bytes. [2025/04/09 07:31:38.749688, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) epm_Map: struct epm_Map out: struct epm_Map entry_handle : * entry_handle: struct policy_handle handle_type : 0x00000000 (0) uuid : d18bcda0-323e-43a1-a404-e8da2a3e4514 num_towers : * num_towers : 0x00000001 (1) towers: ARRAY(1) towers: struct epm_twr_p_t twr : * twr: struct epm_twr_t tower_length : 0x0000004b (75) tower: struct epm_tower num_floors : 0x0005 (5) floors: ARRAY(5) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [0010] 00 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_UUID (13) lhs_data : DATA_BLOB length=18 [0000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [0010] 02 00 .. rhs : union epm_rhs(case 13) uuid: struct epm_rhs_uuid unknown : DATA_BLOB length=2 [0000] 00 00 .. floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_NCACN (11) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 11) ncacn: struct epm_rhs_ncacn minor_version : 0x0000 (0) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_TCP (7) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 7) tcp: struct epm_rhs_tcp port : 0xc203 (49667) floors: struct epm_floor lhs: struct epm_lhs protocol : EPM_PROTOCOL_IP (9) lhs_data : DATA_BLOB length=0 rhs : union epm_rhs(case 9) ip: struct epm_rhs_ip ipaddr : 10.28.1.92 result : 0x00000000 (0) [2025/04/09 07:31:38.750254, 3, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.92 at port 49667 [2025/04/09 07:31:38.750880, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1014(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 [2025/04/09 07:31:38.750944, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:660(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC session_key : 0f6aa5761550cc62041379939299a172 sequence : 0x67f65a8d (1744198285) seed: struct netr_Credential data : 7eef1d4447a0c036 client: struct netr_Credential data : ea504529dc5ba8b7 server: struct netr_Credential data : e95032bef92ebdbf secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' sid : NULL [2025/04/09 07:31:38.751381, 5, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:846(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 07:31:38.751424, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 07:31:38.751448, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 07:31:38.751496, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc4eaec0 [2025/04/09 07:31:38.751532, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55bdbc4eaec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 07:31:38.751567, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 07:31:38.751684, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x00000038 (56) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 07:31:38.752021, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:38.752046, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 111 [2025/04/09 07:31:38.752331, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 64 [2025/04/09 07:31:38.752383, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0050 (80) auth_length : 0x000c (12) call_id : 0x00000038 (56) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b0d (2829) secondary_address_size : 0x0006 (6) secondary_address : '49667' _pad1 : DATA_BLOB length=0 num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 07:31:38.752695, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 80 at offset 0: NT_STATUS_OK [2025/04/09 07:31:38.752720, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 80 bytes. [2025/04/09 07:31:38.752743, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:31:38.752766, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:31:38.752796, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55bdbc4fb000]: subreq: 0x55bdbc4eaec0 [2025/04/09 07:31:38.752823, 10, pid=2377300, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55bdbc4fb000]: NT_STATUS_OK tevent_req[0x55bdbc4eaec0/../../auth/gensec/schannel.c:776]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55bdbc4eb0a0)] timer[(nil)] finish[../../auth/gensec/schannel.c:792] [2025/04/09 07:31:38.752862, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3622(cli_rpc_pipe_open_schannel_with_creds) cli_rpc_pipe_open_schannel_with_creds: opened pipe lsarpc to machine windc1.adprotocolx.com with key netlogon_creds_cli:CLI[GPFSNMBASH/GPFSNMBASH$]/SRV[WINDC1/ADPROTOCOLX] and bound using schannel. [2025/04/09 07:31:38.752898, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:31:38.752919, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:31:38.752946, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:38.753006, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 07:31:38.753038, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:774(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=23, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 07:31:38.753161, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:31:38.753196, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:31:38.753217, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:31:38.753242, 5, pid=2377300, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:31:38.753267, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:31:38.753310, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 07:31:38.753518, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:31:38.753758, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000039 (57) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000084 (132) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:38.753978, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:38.754083, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:38.754121, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 232 [2025/04/09 07:31:38.755088, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 07:31:38.755140, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x00000039 (57) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] 79 39 53 C7 99 1E 26 CD 79 91 56 91 B0 55 9E 56 y9S...&. y.V..U.V [0010] 7E 71 3C 2A 93 7C 23 BE 58 33 05 04 F5 8B EA C6 ~q<*.|#. X3...... [0020] 77 B5 DC 34 01 B7 FA 47 4F AF 80 CF 7B 19 00 CD w..4...G O...{... [0030] 9E 01 10 45 D1 9A F6 08 3F BC 70 C5 1A FB FC C6 ...E.... ?.p..... [0040] 86 AF C9 8B A2 04 4B 32 0B 2C A1 E8 33 0C E7 FF ......K2 .,..3... [0050] DF D4 7E ED 89 0B DE D3 89 AA 4F B5 4A FD 89 FD ..~..... ..O.J... [0060] 46 97 B5 CD 73 80 81 9C 85 E9 7C 6B F9 52 FD F8 F...s... ..|k.R.. [0070] 8D 0A 46 5F 89 39 75 C8 9C 8A 38 9B EB 35 DC E9 ..F_.9u. ..8..5.. [0080] C3 8A B3 27 F4 A9 D7 4A FA 02 5A 51 DE B6 CA BB ...'...J ..ZQ.... [0090] F2 05 A9 76 03 69 7B CC 4A 2A 0E EF 8C 15 25 3F ...v.i{. J*....%? [00A0] 10 F7 FC C2 A9 0F DC A8 E5 16 07 96 06 59 86 CC ........ .....Y.. [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] C0 24 31 15 B5 F3 F7 D1 5E 46 6D 53 66 95 94 7E .$1..... ^FmSf..~ [00D0] FC E0 DE ED D0 55 6B 7B 63 00 6F 00 6D 00 00 00 .....Uk{ c.o.m... [00E0] 00 00 00 00 F9 01 00 00 00 00 00 00 22 00 00 00 ........ ...."... [2025/04/09 07:31:38.755593, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:38.755626, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:31:38.755646, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:38.755683, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 07:31:38.755717, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 07:31:38.755741, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. [2025/04/09 07:31:38.755797, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:31:38.756114, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:31:38.756140, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:31:38.756178, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:36:38 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:31:38.756228, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:36:38 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:31:38.756271, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:31:38.756372, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:38.756399, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:31:44.217577, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:44.217632, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:31:44.217708, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:44.217788, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:31:44.217869, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003a (58) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:44.218104, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:44.218194, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:44.218220, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:31:44.218846, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:31:44.218909, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003a (58) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 4E A2 B3 FB 1C E0 47 68 55 5A 31 A5 9D AE D1 65 N.....Gh UZ1....e [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 29 A9 7F F1 B5 90 44 92 DA 2A 0A 93 10 86 DE E2 ).....D. .*...... [0030] 36 46 38 D4 D0 89 1A F7 3F BC 70 C5 1A FB FC C6 6F8..... ?.p..... [0040] 86 AF C9 8B A2 04 4B 32 0B 2C A1 E8 33 0C E7 FF ......K2 .,..3... [2025/04/09 07:31:44.219201, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:44.219225, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:31:44.219248, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:44.219280, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:31:44.219302, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:31:44.219321, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:31:44.219349, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:31:44.219414, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:31:44.219435, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:44.219491, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:44.219510, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:31:44.227185, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:31:44.227225, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:44.227245, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:31:44.227291, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:31:44.227344, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:31:44.227369, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:31:44.227388, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:31:44.227406, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:31:44.227431, 3, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 07:31:44.227452, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2814(cm_connect_lsa_tcp) cm_connect_lsa_tcp [2025/04/09 07:31:44.227485, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:402(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:31:44.227517, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 in: struct lsa_LookupSids3 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray2 count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) lookup_options : LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMES (0) client_revision : LSA_CLIENT_REVISION_2 (2) [2025/04/09 07:31:44.227701, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003b (59) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000048 (72) context_id : 0x0000 (0) opnum : 0x004c (76) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:44.227904, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:44.228005, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:44.228040, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:31:44.228682, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 248 [2025/04/09 07:31:44.228744, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0108 (264) auth_length : 0x0038 (56) call_id : 0x0000003b (59) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a8 (168) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=240 [0000] FE 56 0E A7 24 CB 96 D3 CE 40 B9 B5 EE A0 3C F6 .V..$... .@....<. [0010] 28 83 A5 5E 80 77 0E B7 41 04 79 89 C4 EB EB D9 (..^.w.. A.y..... [0020] 9D EE A3 99 C0 B2 B2 C4 31 78 78 E9 F3 8E C6 72 ........ 1xx....r [0030] 5C 11 99 71 A4 E8 E0 31 42 A4 FE 01 EF 1A C9 BA \..q...1 B....... [0040] 68 CC E7 54 90 0E EA 2B D0 CA 48 53 E9 A7 7A 12 h..T...+ ..HS..z. [0050] 20 14 CB AC 01 18 83 FF CF E1 B1 37 99 BA E8 F1 ....... ...7.... [0060] 79 DA 3E 0D 1B 00 C0 89 79 B3 34 7A 3E FE DB 35 y.>..... y.4z>..5 [0070] F8 F2 56 63 97 83 1A B4 4A A8 BE 8F E1 DA 75 A2 ..Vc.... J.....u. [0080] 9B 3F 6D E1 AD 08 57 9B 0F 94 A6 82 E4 19 58 7C .?m...W. ......X| [0090] BD 3D C4 9A D9 56 C0 AF CB 7D DB F6 A4 7F 03 C2 .=...V.. .}...... [00A0] 98 77 EF 77 55 F0 FF D3 ED 40 55 2C 76 FF 23 6D .w.wU... .@U,v.#m [00B0] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [00C0] AD 17 1D DE 84 CF F9 66 D4 29 BA 86 19 83 BF 1D .......f .)...... [00D0] EC C0 47 1D 38 7D 83 82 63 00 6F 00 6D 00 00 00 ..G.8}.. c.o.m... [00E0] 00 00 00 00 F9 01 00 00 00 00 00 00 22 00 00 00 ........ ...."... [2025/04/09 07:31:44.229196, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:44.229220, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:31:44.229238, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:44.229271, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 264, data_len 168 [2025/04/09 07:31:44.229292, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 264 at offset 0: NT_STATUS_OK [2025/04/09 07:31:44.229315, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 168 bytes. [2025/04/09 07:31:44.229351, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids3: struct lsa_LookupSids3 out: struct lsa_LookupSids3 domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray2 count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName2 sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) unknown : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:31:44.229585, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:244(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:31:44.229609, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:31:44.229640, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:36:44 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:31:44.229690, 10, pid=2377300, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:36:44 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:31:44.229726, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:31:44.229816, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:44.229837, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:31:46.420798, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:31:46.420872, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:31:46.420993, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:31:46.421112, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:31:46.421212, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003c (60) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:31:46.421407, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:31:46.421529, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:31:46.421564, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:31:46.422233, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:31:46.422331, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003c (60) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] F1 2C 18 04 00 4D 08 0C 29 93 22 59 E4 28 1B AF .,...M.. )."Y.(.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 68 F7 EC 52 BB C8 B9 71 A5 16 9C C9 6F 67 32 E6 h..R...q ....og2. [0030] C6 93 5C BC D3 77 2F 64 42 A4 FE 01 EF 1A C9 BA ..\..w/d B....... [0040] 68 CC E7 54 90 0E EA 2B D0 CA 48 53 E9 A7 7A 12 h..T...+ ..HS..z. [2025/04/09 07:31:46.422628, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:31:46.422653, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:31:46.422674, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:31:46.422720, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:31:46.422747, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:31:46.422768, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:31:46.422800, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:31:46.422873, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:31:46.422896, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:31:46.423005, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:31:46.423031, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:32:01.387565, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:32:01.387641, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:32:01.387748, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:32:01.387852, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:32:01.388029, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003d (61) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:32:01.388235, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:32:01.388343, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:32:01.388380, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:32:01.390325, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:32:01.390388, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003d (61) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 9A 30 90 62 18 9B FA 0E CF DB D4 4E 6D FA 55 4B .0.b.... ...Nm.UK [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] B0 DE 55 56 F1 5D 4F DB 7E 3D 71 DA 67 5F 9A DD ..UV.]O. ~=q.g_.. [0030] 25 E7 7A 2A BA 8F B0 BE CF BA EF 3F CC C1 D9 70 %.z*.... ...?...p [0040] 16 B3 CD DD A4 96 E4 50 02 C2 A4 02 AA A3 5F 87 .......P ......_. [2025/04/09 07:32:01.390666, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:32:01.390689, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:32:01.390707, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:32:01.390739, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:32:01.390761, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:32:01.390780, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:32:01.390819, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:32:01.390886, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:32:01.390908, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:32:01.391033, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:32:01.391056, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:32:16.399929, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:32:16.400006, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:32:16.400157, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:32:16.400335, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:32:16.400479, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003e (62) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:32:16.400680, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:32:16.400844, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:32:16.400893, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:32:16.402006, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:32:16.402088, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003e (62) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] C3 28 0A ED 86 78 EF AC 3A 04 51 C4 BC 66 04 F5 .(...x.. :.Q..f.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] FC DB 2A E7 FF DA 57 FB AF 9A 63 4F F0 3E 6B EA ..*...W. ..cO.>k. [0030] A1 B3 15 96 F3 24 23 8D 01 00 00 00 00 00 00 00 .....$#. ........ [0040] 80 4F 3B B8 F9 01 00 00 A0 4F 3B B8 F9 01 00 00 .O;..... .O;..... [2025/04/09 07:32:16.402419, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:32:16.402444, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:32:16.402463, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:32:16.402497, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:32:16.402533, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:32:16.402553, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:32:16.402585, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:32:16.402693, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:32:16.402731, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:32:16.402796, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:32:16.402817, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:32:31.391001, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:32:31.391075, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:32:31.391194, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:32:31.391322, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:32:31.391419, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003f (63) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:32:31.391657, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:32:31.391766, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:32:31.391798, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:32:31.392463, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:32:31.392530, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003f (63) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 81 FC 98 E9 54 DE CE F3 C9 09 CB 23 2E 10 F8 E2 ....T... ...#.... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 39 A7 3B 73 BD 8D F1 B6 CA F0 30 02 B4 BA DE 48 9.;s.... ..0....H [0030] A0 C2 43 C6 A5 D9 31 96 CF BA EF 3F CC C1 D9 70 ..C...1. ...?...p [0040] 16 B3 CD DD A4 96 E4 50 02 C2 A4 02 AA A3 5F 87 .......P ......_. [2025/04/09 07:32:31.392827, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:32:31.392850, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:32:31.392868, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:32:31.392900, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:32:31.392922, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:32:31.392994, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:32:31.393033, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:32:31.393105, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:32:31.393138, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:32:31.393206, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:32:31.393227, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:32:49.496979, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:32:49.497084, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:32:49.497264, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:32:49.497422, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:32:49.497523, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000040 (64) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:32:49.497702, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:32:49.497816, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:32:49.497842, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:32:49.498711, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:32:49.498806, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000040 (64) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 0B 9B 0B 03 E6 7C 12 D6 7D C3 62 7B 86 B4 B7 87 .....|.. }.b{.... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] ED 51 8D 71 4B 61 A1 DD 00 9B 0C B0 FE 16 1C 5B .Q.qKa.. .......[ [0030] 85 FF DA FA 28 E5 C4 5F B5 5E 4C 6E 14 B7 01 08 ....(.._ .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:32:49.499151, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:32:49.499176, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:32:49.499194, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:32:49.499226, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:32:49.499248, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:32:49.499274, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:32:49.499301, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:32:49.499377, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:32:49.499400, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:32:49.499466, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:32:49.499488, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:33:01.393672, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:33:01.393764, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:33:01.393884, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:33:01.394020, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:33:01.394142, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000041 (65) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:33:01.394334, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:33:01.394455, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:33:01.394495, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:33:01.395202, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:33:01.395267, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000041 (65) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 2C 2B 4E F9 A9 DB 03 5D F9 64 9A 63 F2 52 00 7A ,+N....] .d.c.R.z [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 90 30 CE B2 1B 7A 7B A9 FC 41 BB 72 CA 9D C9 51 .0...z{. .A.r...Q [0030] D4 AE 63 BC 3B 9D 82 37 B5 5E 4C 6E 14 B7 01 08 ..c.;..7 .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:33:01.395551, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:33:01.395598, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:33:01.395619, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:33:01.395655, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:33:01.395687, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:33:01.395709, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:33:01.395749, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:33:01.395828, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:33:01.395851, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:33:01.395924, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:33:01.396030, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:33:16.422098, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:33:16.422151, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:33:16.422263, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:33:16.422398, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:33:16.422543, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000042 (66) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:33:16.422734, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:33:16.422856, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:33:16.422890, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:33:16.423654, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:33:16.423717, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000042 (66) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 2F D6 C8 57 2D 7C E7 B5 F6 8D 49 FE 07 F5 E1 E4 /..W-|.. ..I..... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] C9 23 20 95 26 7F 1A A0 BC 97 75 98 20 7C A2 C9 .# .&... ..u. |.. [0030] 63 CD FE 63 2A 39 45 94 B5 5E 4C 6E 14 B7 01 08 c..c*9E. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:33:16.424042, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:33:16.424068, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:33:16.424092, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:33:16.424133, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:33:16.424161, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:33:16.424181, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:33:16.424224, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:33:16.424311, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:33:16.424338, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:33:16.424397, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:33:16.424417, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:33:31.435068, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:33:31.435184, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:33:31.435379, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:33:31.435545, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:33:31.435673, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000043 (67) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:33:31.435881, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:33:31.436091, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:33:31.436146, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:33:31.439073, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:33:31.439154, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000043 (67) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 49 3D 29 F8 F3 E1 3E 83 96 3B 4F 71 21 93 91 B0 I=)...>. .;Oq!... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] C3 30 42 D4 63 96 87 D2 24 E4 AF BF 09 5E C0 44 .0B.c... $....^.D [0030] 6F 4F 26 0F 25 E5 7A A4 00 00 00 00 00 00 00 00 oO&.%.z. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:33:31.439471, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:33:31.439495, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:33:31.439515, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:33:31.439547, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:33:31.439578, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:33:31.439610, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:33:31.439639, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:33:31.439740, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:33:31.439773, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:33:31.439844, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:33:31.439867, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:33:46.424051, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:33:46.424122, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:33:46.424224, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:33:46.424311, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:33:46.424408, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000044 (68) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:33:46.424624, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:33:46.424747, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:33:46.424778, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:33:46.425495, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:33:46.425556, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000044 (68) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] D4 F3 57 E8 64 6B 79 A2 3B 26 A7 43 3B 4D A6 12 ..W.dky. ;&.C;M.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 52 E0 F1 A5 30 40 F4 27 88 1E 71 92 2E 65 86 0A R...0@.' ..q..e.. [0030] FA 02 82 1D 7D 7E AA D6 00 00 00 00 00 00 00 00 ....}~.. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:33:46.425838, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:33:46.425862, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:33:46.425881, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:33:46.425915, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:33:46.425937, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:33:46.426018, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:33:46.426052, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:33:46.426137, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:33:46.426161, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:33:46.426222, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:33:46.426242, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:34:01.432089, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1642(child_handler) child daemon request 55 [2025/04/09 07:34:01.432209, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:34:01.432457, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:34:01.432605, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:34:01.432756, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000045 (69) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:34:01.432944, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:34:01.433096, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:34:01.433125, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:185(rpc_write_send) rpc_write_send: data_to_write: 168 [2025/04/09 07:34:01.433886, 5, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:34:01.433937, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000045 (69) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 58 92 16 8A DA CD D5 D5 AE 21 0B 9E 15 11 AF 38 X....... .!.....8 [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 79 A0 48 08 FF 59 BF FD 31 2B AF A4 5D C2 C9 E6 y.H..Y.. 1+..]... [0030] D0 6F F9 32 17 07 1E A4 B5 5E 4C 6E 14 B7 01 08 .o.2.... .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:34:01.434338, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:34:01.434374, 10, pid=2377300, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:400(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:34:01.434394, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:34:01.434440, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:34:01.434462, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:34:01.434482, 10, pid=2377300, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:34:01.434516, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:34:01.434590, 5, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:34:01.434613, 1, pid=2377300, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:34:01.434721, 4, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1650(child_handler) Finished processing child request 55 [2025/04/09 07:34:01.434746, 10, pid=2377300, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent Logs name: log.winbindd.scenario3 ======================== [2025/04/09 07:45:31.536391, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:31.536595, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:31.536631, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403456)]: request interface version (version = 32) [2025/04/09 07:45:31.536689, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403456):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:31.536824, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:45:31.536849, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2403456)]: ping [2025/04/09 07:45:31.536888, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403456):PING]: delivered response to client [2025/04/09 07:45:31.539296, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:31.558923, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:31.559033, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:31.559062, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403465)]: request interface version (version = 32) [2025/04/09 07:45:31.559106, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403465):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:31.559251, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:31.559276, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403465)]: request interface version (version = 32) [2025/04/09 07:45:31.559315, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403465):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:31.559407, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:45:31.559435, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2403465)]: request misc info [2025/04/09 07:45:31.559494, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403465):INFO]: delivered response to client [2025/04/09 07:45:31.559587, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:45:31.559610, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2403465)]: request netbios name [2025/04/09 07:45:31.559660, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403465):NETBIOS_NAME]: delivered response to client [2025/04/09 07:45:31.559749, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:45:31.559773, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2403465)]: request domain name [2025/04/09 07:45:31.559809, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403465):DOMAIN_NAME]: delivered response to client [2025/04/09 07:45:31.559900, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2403465)] Handling async request: DOMAIN_INFO [2025/04/09 07:45:31.559934, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2403465]: domain_info [ADPROTOCOLX] [2025/04/09 07:45:31.560019, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2403465):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:45:31.560078, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403465):DOMAIN_INFO]: delivered response to client [2025/04/09 07:45:31.560181, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2403465)] Handling async request: PING_DC [2025/04/09 07:45:31.560259, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:31.566536, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:31.566609, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2403465):PING_DC]: NT_STATUS_OK [2025/04/09 07:45:31.566662, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403465):PING_DC]: delivered response to client [2025/04/09 07:45:31.569337, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:31.589606, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:45:31.589753, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:45:31.589784, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:45:31.589817, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:45:31.589838, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:45:31.589861, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:45:44.812554, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:44.812760, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:44.812789, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403797)]: request interface version (version = 32) [2025/04/09 07:45:44.812852, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403797):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:44.813017, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:44.813059, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403797)]: request interface version (version = 32) [2025/04/09 07:45:44.813101, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403797):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:44.813205, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:45:44.813231, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2403797)]: request misc info [2025/04/09 07:45:44.813281, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403797):INFO]: delivered response to client [2025/04/09 07:45:44.813375, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:45:44.813400, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2403797)]: request netbios name [2025/04/09 07:45:44.813439, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403797):NETBIOS_NAME]: delivered response to client [2025/04/09 07:45:44.813529, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:45:44.813553, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2403797)]: request domain name [2025/04/09 07:45:44.813600, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403797):DOMAIN_NAME]: delivered response to client [2025/04/09 07:45:44.813703, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2403797)] Handling async request: DOMAIN_INFO [2025/04/09 07:45:44.813731, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2403797]: domain_info [ADPROTOCOLX] [2025/04/09 07:45:44.813763, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2403797):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:45:44.813805, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403797):DOMAIN_INFO]: delivered response to client [2025/04/09 07:45:44.813921, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2403797)] Handling async request: PING_DC [2025/04/09 07:45:44.813995, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:44.816994, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:44.817089, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2403797):PING_DC]: NT_STATUS_OK [2025/04/09 07:45:44.817141, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403797):PING_DC]: delivered response to client [2025/04/09 07:45:44.818479, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:44.820641, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:44.820733, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:44.820770, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2403798)]: request interface version (version = 32) [2025/04/09 07:45:44.820820, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2403798):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:44.820895, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2403798)] Handling async request: GETPWUID [2025/04/09 07:45:44.820928, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2403798)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:45:44.821011, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:45:44.821103, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:45:44.821159, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:45:44.821218, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:45:44.826510, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:45:44.826595, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:45:44.826618, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:45:44.826648, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:45:44.826672, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:45:44.826710, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:45:44.831377, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:45:44.831466, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:45:44.831493, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:44.831517, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:45:44.831547, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:45:44.831589, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:45:44 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:45:44.831649, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:45:44 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:45:44.831703, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:45:44.831736, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:421(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:44.831764, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:44.831809, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:44.831850, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:45:44.831874, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:45:44.831898, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:44.831926, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:45:44.831947, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:45:44.832001, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:45:44.832025, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:45:44.832045, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:44.832066, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:44.832090, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:44.832113, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:45:44.832132, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:45:44.832172, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:45:44.832242, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:45:44.832267, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:44.832365, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:45:44.832393, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:45:44.832421, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1430(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:45:44.832480, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1473(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:45:44.832524, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:45:44.832560, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:44.861083, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:45:44.861172, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:45:44.861308, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:45:44.861332, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:45:44.861364, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:44.861471, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:45:44.861513, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:44.864071, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:45:44.864256, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:44.864378, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:45:44.864403, 5, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:44.864569, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:45:44.864599, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:45:44.864629, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2403798):GETPWUID]: NT_STATUS_OK [2025/04/09 07:45:44.864710, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2403798):GETPWUID]: delivered response to client [2025/04/09 07:45:44.865014, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:46.556004, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:46.557132, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:46.557174, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403814)]: request interface version (version = 32) [2025/04/09 07:45:46.557232, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403814):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:46.557342, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:45:46.557368, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2403814)]: ping [2025/04/09 07:45:46.557408, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403814):PING]: delivered response to client [2025/04/09 07:45:46.563814, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:46.579687, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:46.579808, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:46.579835, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403826)]: request interface version (version = 32) [2025/04/09 07:45:46.579882, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403826):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:46.579999, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:46.580030, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403826)]: request interface version (version = 32) [2025/04/09 07:45:46.580073, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403826):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:46.580184, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:45:46.580210, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2403826)]: request misc info [2025/04/09 07:45:46.580270, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403826):INFO]: delivered response to client [2025/04/09 07:45:46.580364, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:45:46.580390, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2403826)]: request netbios name [2025/04/09 07:45:46.580430, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403826):NETBIOS_NAME]: delivered response to client [2025/04/09 07:45:46.580531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:45:46.580557, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2403826)]: request domain name [2025/04/09 07:45:46.580596, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403826):DOMAIN_NAME]: delivered response to client [2025/04/09 07:45:46.580693, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2403826)] Handling async request: DOMAIN_INFO [2025/04/09 07:45:46.580731, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2403826]: domain_info [ADPROTOCOLX] [2025/04/09 07:45:46.580779, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2403826):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:45:46.580826, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403826):DOMAIN_INFO]: delivered response to client [2025/04/09 07:45:46.580927, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2403826)] Handling async request: PING_DC [2025/04/09 07:45:46.580984, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:46.583780, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:46.583855, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2403826):PING_DC]: NT_STATUS_OK [2025/04/09 07:45:46.583902, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403826):PING_DC]: delivered response to client [2025/04/09 07:45:46.586281, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:50.332338, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:50.332570, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:50.332600, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403976)]: request interface version (version = 32) [2025/04/09 07:45:50.332647, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403976):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:50.332797, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:50.332824, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2403976)]: request interface version (version = 32) [2025/04/09 07:45:50.332875, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403976):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:50.333001, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:45:50.333032, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2403976)]: request misc info [2025/04/09 07:45:50.333073, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403976):INFO]: delivered response to client [2025/04/09 07:45:50.333199, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:45:50.333224, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2403976)]: request netbios name [2025/04/09 07:45:50.333279, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403976):NETBIOS_NAME]: delivered response to client [2025/04/09 07:45:50.333400, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:45:50.333424, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2403976)]: request domain name [2025/04/09 07:45:50.333466, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403976):DOMAIN_NAME]: delivered response to client [2025/04/09 07:45:50.333555, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2403976)] Handling async request: DOMAIN_INFO [2025/04/09 07:45:50.333587, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2403976]: domain_info [ADPROTOCOLX] [2025/04/09 07:45:50.333616, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2403976):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:45:50.333661, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403976):DOMAIN_INFO]: delivered response to client [2025/04/09 07:45:50.333755, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2403976)] Handling async request: PING_DC [2025/04/09 07:45:50.333802, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:50.337040, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:50.337111, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2403976):PING_DC]: NT_STATUS_OK [2025/04/09 07:45:50.337156, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2403976):PING_DC]: delivered response to client [2025/04/09 07:45:50.338386, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:50.340551, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:50.340621, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:50.340645, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2403977)]: request interface version (version = 32) [2025/04/09 07:45:50.340686, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2403977):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:50.340784, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2403977)] Handling async request: GETPWUID [2025/04/09 07:45:50.340812, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2403977)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:45:50.340836, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:45:50.340885, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:45:50.340911, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:45:50.340935, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:45:50.341671, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:45:50.341751, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:45:50.341781, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:45:50.341804, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:45:50.341824, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:45:50.341846, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:45:50.345452, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:45:50.345533, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:45:50.345554, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:50.345575, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:45:50.345594, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:45:50.345621, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:45:50 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:45:50.345664, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:45:50 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:45:50.345697, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:45:50.345716, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:421(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:50.345745, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:50.345783, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:50.345813, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:45:50.345835, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:45:50.345861, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:50.345886, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:45:50.345906, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:45:50.345924, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:45:50.345944, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:45:50.345987, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:50.346010, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:50.346029, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:50.346049, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:45:50.346067, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:45:50.346096, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:45:50.346128, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:45:50.346146, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:50.346241, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:45:50.346262, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:45:50.346280, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1430(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:45:50.346310, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1473(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:45:50.346332, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:45:50.346357, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:50.349938, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:45:50.349993, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:45:50.350076, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:45:50.350096, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:45:50.350117, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:50.350219, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:45:50.350245, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:50.351973, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:45:50.352120, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:50.352229, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:45:50.352248, 5, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:50.352363, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:45:50.352390, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:45:50.352417, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2403977):GETPWUID]: NT_STATUS_OK [2025/04/09 07:45:50.352459, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2403977):GETPWUID]: delivered response to client [2025/04/09 07:45:50.352699, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:55.796811, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:55.796973, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:55.797004, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404009)]: request interface version (version = 32) [2025/04/09 07:45:55.797061, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404009):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:55.797166, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:55.797194, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404009)]: request interface version (version = 32) [2025/04/09 07:45:55.797232, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404009):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:55.797324, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:45:55.797348, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2404009)]: request misc info [2025/04/09 07:45:55.797386, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404009):INFO]: delivered response to client [2025/04/09 07:45:55.797484, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:45:55.797508, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2404009)]: request netbios name [2025/04/09 07:45:55.797566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404009):NETBIOS_NAME]: delivered response to client [2025/04/09 07:45:55.797656, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:45:55.797680, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2404009)]: request domain name [2025/04/09 07:45:55.797717, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404009):DOMAIN_NAME]: delivered response to client [2025/04/09 07:45:55.797805, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2404009)] Handling async request: DOMAIN_INFO [2025/04/09 07:45:55.797831, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2404009]: domain_info [ADPROTOCOLX] [2025/04/09 07:45:55.797870, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2404009):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:45:55.797913, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404009):DOMAIN_INFO]: delivered response to client [2025/04/09 07:45:55.798025, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2404009)] Handling async request: PING_DC [2025/04/09 07:45:55.798064, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:55.800729, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:55.800794, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2404009):PING_DC]: NT_STATUS_OK [2025/04/09 07:45:55.800837, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404009):PING_DC]: delivered response to client [2025/04/09 07:45:55.801010, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:45:55.804994, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:45:55.805070, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:45:55.805100, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2404010)]: request interface version (version = 32) [2025/04/09 07:45:55.805144, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2404010):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:45:55.805234, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2404010)] Handling async request: GETPWUID [2025/04/09 07:45:55.805267, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2404010)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:45:55.805292, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:45:55.805339, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:45:55.805365, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:45:55.805389, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:45:55.806142, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:45:55.806226, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:45:55.806246, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:45:55.806267, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:45:55.806285, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:45:55.806307, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:45:55.808446, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-1-5-21-3967939894-2044440985-2694731363-1104 result : NT_STATUS_OK [2025/04/09 07:45:55.808525, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:45:55.808546, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:55.808568, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain *. [2025/04/09 07:45:55.808587, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:90(wb_xids2sids_dom_send) 0: XID 10001 is out of range. [2025/04/09 07:45:55.808623, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 16 07:45:55 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:45:55.808682, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[IDMAP/UID2SID/10001] and timeout=[Wed Apr 16 07:45:55 AM 2025 EDT] (604800 seconds ahead) [2025/04/09 07:45:55.808716, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:45:55.808736, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:421(wb_xids2sids_recv) 0: XID 10001 mapped to SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:55.808764, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:49(wb_getpwsid_send) WB command getpwsid start. Query user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:55.808788, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:57(wb_queryuser_send) WB command queryuser start. Query user sid S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:55.808815, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:96(wb_queryuser_idmap_setup_done) Convert the user SID S-1-5-21-3967939894-2044440985-2694731363-1104 to XID. [2025/04/09 07:45:55.808839, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:91(wb_sids2xids_send) WB command sids2xids start. Resolving 1 SID(s). [2025/04/09 07:45:55.808872, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:157(wb_sids2xids_send) 0: SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:55.808906, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:58(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: value=[10001:U] [2025/04/09 07:45:55.808933, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/idmap_cache.c:77(idmap_cache_find_sid2unixid) Parsing value for key [IDMAP/SID2XID/S-1-5-21-3967939894-2044440985-2694731363-1104]: id=[10001], endptr=[:U] [2025/04/09 07:45:55.808974, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:176(wb_sids2xids_send) Found 1 (out of 1) SID(s) in cache. [2025/04/09 07:45:55.809012, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:777(wb_sids2xids_recv) WB command sids2xids end. [2025/04/09 07:45:55.809032, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_sids2xids.c:784(wb_sids2xids_recv) 0: Found XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:55.809060, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:137(wb_queryuser_got_uid) Received XID 10001 for SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:55.809079, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:158(wb_queryuser_got_uid) Preconfigured 'Domain Users' RID 513 was used to create group SID S-1-5-21-3967939894-2044440985-2694731363-513 from user SID S-1-5-21-3967939894-2044440985-2694731363-1104. [2025/04/09 07:45:55.809098, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:161(wb_queryuser_got_uid) Setting 'homedir' to the template '/home/%D/%U'. [2025/04/09 07:45:55.809116, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:167(wb_queryuser_got_uid) Setting 'shell' to the template '/bin/false'. [2025/04/09 07:45:55.809137, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:252(netsamlogon_cache_get) netsamlogon_cache_get: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:45:55.809165, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/samlogon_cache.c:256(netsamlogon_cache_get) tdb fetch for S-1-5-21-3967939894-2044440985-2694731363-1104 is empty [2025/04/09 07:45:55.809183, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:188(wb_queryuser_got_uid) state->info: struct wbint_userinfo domain_name : NULL acct_name : NULL full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:55.809277, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:190(wb_queryuser_got_uid) Domain name is empty, calling wb_lookupsid_send() to get it. [2025/04/09 07:45:55.809296, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:49(wb_lookupsid_send) WB command lookupsid start. [2025/04/09 07:45:55.809314, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1430(find_lookup_domain_from_sid) find_lookup_domain_from_sid: SID [S-1-5-21-3967939894-2044440985-2694731363-1104] [2025/04/09 07:45:55.809338, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:1473(find_lookup_domain_from_sid) calling find_our_domain [2025/04/09 07:45:55.809361, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:63(wb_lookupsid_send) Looking up SID S-1-5-21-3967939894-2044440985-2694731363-1104 in domain ADPROTOCOLX. [2025/04/09 07:45:55.809387, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:55.812689, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:45:55.812724, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:45:55.812815, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:100(wb_lookupsid_recv) WB command lookupsid end. [2025/04/09 07:45:55.812834, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_lookupsid.c:112(wb_lookupsid_recv) SID S-1-5-21-3967939894-2044440985-2694731363-1104 has name 'adxuser191' with type '1' in domain 'ADPROTOCOLX'. [2025/04/09 07:45:55.812855, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:234(wb_queryuser_got_domain) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:55.813001, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:263(wb_queryuser_got_domain) About to call dcerpc_wbint_GetNssInfo_send() [2025/04/09 07:45:55.813030, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo in: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x00000000ffffffff (4294967295) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:55.814718, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_GetNssInfo: struct wbint_GetNssInfo out: struct wbint_GetNssInfo info : * info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 result : NT_STATUS_OK [2025/04/09 07:45:55.814872, 10, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:339(wb_queryuser_done) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:55.815009, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_queryuser.c:473(wb_queryuser_recv) WB command queryuser end. [2025/04/09 07:45:55.815030, 5, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/winbindd/wb_queryuser.c:474(wb_queryuser_recv) state->info: struct wbint_userinfo domain_name : * domain_name : 'ADPROTOCOLX' acct_name : * acct_name : 'adxuser191' full_name : NULL homedir : * homedir : '/home/%D/%U' shell : * shell : '/bin/false' uid : 0x0000000000002711 (10001) primary_gid : 0x0000000000004e21 (20001) primary_group_name : NULL user_sid : S-1-5-21-3967939894-2044440985-2694731363-1104 group_sid : S-1-5-21-3967939894-2044440985-2694731363-513 [2025/04/09 07:45:55.815142, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_getpwsid.c:154(wb_getpwsid_recv) WB command getpwsid end. Return status NT_STATUS_OK. [2025/04/09 07:45:55.815169, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:134(winbindd_getpwuid_recv) Winbind external command GETPWUID end. (name:passwd:uid:gid:gecos:dir:shell) ADPROTOCOLX\adxuser191:*:10001:20001::/home/ADPROTOCOLX/adxuser191:/bin/false [2025/04/09 07:45:55.815201, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2404010):GETPWUID]: NT_STATUS_OK [2025/04/09 07:45:55.815249, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2404010):GETPWUID]: delivered response to client [2025/04/09 07:45:55.815599, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:46:01.285154, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:46:01.285439, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:01.285469, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404219)]: request interface version (version = 32) [2025/04/09 07:46:01.285519, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404219):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:01.285646, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:01.285673, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404219)]: request interface version (version = 32) [2025/04/09 07:46:01.285713, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404219):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:01.285810, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:46:01.285836, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2404219)]: request misc info [2025/04/09 07:46:01.285877, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404219):INFO]: delivered response to client [2025/04/09 07:46:01.286008, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:46:01.286040, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2404219)]: request netbios name [2025/04/09 07:46:01.286083, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404219):NETBIOS_NAME]: delivered response to client [2025/04/09 07:46:01.286179, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:46:01.286205, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2404219)]: request domain name [2025/04/09 07:46:01.286255, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404219):DOMAIN_NAME]: delivered response to client [2025/04/09 07:46:01.286351, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2404219)] Handling async request: DOMAIN_INFO [2025/04/09 07:46:01.286378, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2404219]: domain_info [ADPROTOCOLX] [2025/04/09 07:46:01.286426, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2404219):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:46:01.286471, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404219):DOMAIN_INFO]: delivered response to client [2025/04/09 07:46:01.286588, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2404219)] Handling async request: PING_DC [2025/04/09 07:46:01.286631, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:46:01.290007, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:46:01.290076, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2404219):PING_DC]: NT_STATUS_OK [2025/04/09 07:46:01.290122, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404219):PING_DC]: delivered response to client [2025/04/09 07:46:01.291028, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:46:01.293191, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:46:01.293290, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:01.293316, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2404220)]: request interface version (version = 32) [2025/04/09 07:46:01.293366, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2404220):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:01.293432, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2404220)] Handling async request: GETPWUID [2025/04/09 07:46:01.293458, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2404220)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:46:01.293483, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:46:01.293539, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:46:01.293567, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:46:01.293608, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:46:01.294903, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:46:01.295022, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:46:01.295046, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:46:01.295068, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:46:01.295093, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:46:01.295117, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:46:01.540610, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:46:01.540744, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:01.540783, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404229)]: request interface version (version = 32) [2025/04/09 07:46:01.540837, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404229):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:01.543725, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:46:01.543761, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2404229)]: ping [2025/04/09 07:46:01.543810, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404229):PING]: delivered response to client [2025/04/09 07:46:01.547311, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:46:01.572182, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:46:01.572297, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:01.572323, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404242)]: request interface version (version = 32) [2025/04/09 07:46:01.572370, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404242):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:01.572471, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:01.572495, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404242)]: request interface version (version = 32) [2025/04/09 07:46:01.572547, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404242):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:01.572653, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:46:01.572678, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2404242)]: request misc info [2025/04/09 07:46:01.572718, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404242):INFO]: delivered response to client [2025/04/09 07:46:01.572809, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:46:01.572833, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2404242)]: request netbios name [2025/04/09 07:46:01.572872, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404242):NETBIOS_NAME]: delivered response to client [2025/04/09 07:46:01.573019, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:46:01.573050, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2404242)]: request domain name [2025/04/09 07:46:01.573098, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404242):DOMAIN_NAME]: delivered response to client [2025/04/09 07:46:01.573209, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2404242)] Handling async request: DOMAIN_INFO [2025/04/09 07:46:01.573236, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2404242]: domain_info [ADPROTOCOLX] [2025/04/09 07:46:01.573275, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2404242):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:46:01.573318, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404242):DOMAIN_INFO]: delivered response to client [2025/04/09 07:46:01.573415, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2404242)] Handling async request: PING_DC [2025/04/09 07:46:01.573455, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:46:01.575872, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:46:01.575942, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2404242):PING_DC]: NT_STATUS_OK [2025/04/09 07:46:01.576019, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404242):PING_DC]: delivered response to client [2025/04/09 07:46:01.580156, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:46:01.590290, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:46:01.590434, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:46:01.590460, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:46:01.590484, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:46:01.590508, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:46:01.590531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:46:16.309614, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_IO_TIMEOUT [2025/04/09 07:46:16.309765, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) Domain controller not found. Calling wb_dsgetdcname_send() to get it. [2025/04/09 07:46:16.309803, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) WB command dsgetdcname start. Search domain name adprotocolx and site name (null). [2025/04/09 07:46:16.309862, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:46:16.542254, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:46:16.542388, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:16.542415, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404546)]: request interface version (version = 32) [2025/04/09 07:46:16.542467, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404546):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:16.542913, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:46:16.542939, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2404546)]: ping [2025/04/09 07:46:16.543002, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404546):PING]: delivered response to client [2025/04/09 07:46:16.544840, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:46:16.563887, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:46:16.564007, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:16.564036, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404553)]: request interface version (version = 32) [2025/04/09 07:46:16.564100, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404553):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:16.564514, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:16.564541, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2404553)]: request interface version (version = 32) [2025/04/09 07:46:16.564586, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404553):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:16.564677, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:46:16.564701, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2404553)]: request misc info [2025/04/09 07:46:16.564739, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404553):INFO]: delivered response to client [2025/04/09 07:46:16.564827, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:46:16.564851, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2404553)]: request netbios name [2025/04/09 07:46:16.564901, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404553):NETBIOS_NAME]: delivered response to client [2025/04/09 07:46:16.565082, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:46:16.565112, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2404553)]: request domain name [2025/04/09 07:46:16.565169, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404553):DOMAIN_NAME]: delivered response to client [2025/04/09 07:46:16.565837, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2404553)] Handling async request: DOMAIN_INFO [2025/04/09 07:46:16.565868, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2404553]: domain_info [ADPROTOCOLX] [2025/04/09 07:46:16.565901, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2404553):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:46:16.565950, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2404553):DOMAIN_INFO]: delivered response to client [2025/04/09 07:46:16.566107, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2404553)] Handling async request: PING_DC [2025/04/09 07:46:16.566156, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:46:31.594411, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:46:31.594574, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:46:31.594614, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:46:31.594641, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:46:31.594660, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:46:31.594684, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:46:41.552518, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) winbind_client_activity[2404553:PING_DC]: client has closed connection - removing client [2025/04/09 07:46:41.552614, 2, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) final write to client failed: Broken pipe [2025/04/09 07:46:41.552891, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) wb_child_request_cleanup: keep orphaned subreq[0x55cf82599d10] [2025/04/09 07:46:41.624344, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:46:41.624486, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:41.624515, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2405100)]: request interface version (version = 32) [2025/04/09 07:46:41.624583, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405100):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:41.624711, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:46:41.624739, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2405100)]: ping [2025/04/09 07:46:41.624781, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405100):PING]: delivered response to client [2025/04/09 07:46:41.626058, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:46:41.645752, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:46:41.645840, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:41.645874, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2405103)]: request interface version (version = 32) [2025/04/09 07:46:41.645920, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405103):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:41.646052, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:46:41.646082, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2405103)]: request interface version (version = 32) [2025/04/09 07:46:41.646124, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405103):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:46:41.646221, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:46:41.646246, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2405103)]: request misc info [2025/04/09 07:46:41.646300, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405103):INFO]: delivered response to client [2025/04/09 07:46:41.646395, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:46:41.646421, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2405103)]: request netbios name [2025/04/09 07:46:41.646467, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405103):NETBIOS_NAME]: delivered response to client [2025/04/09 07:46:41.646563, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:46:41.646588, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2405103)]: request domain name [2025/04/09 07:46:41.646639, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405103):DOMAIN_NAME]: delivered response to client [2025/04/09 07:46:41.646736, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2405103)] Handling async request: DOMAIN_INFO [2025/04/09 07:46:41.646772, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2405103]: domain_info [ADPROTOCOLX] [2025/04/09 07:46:41.646828, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2405103):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:46:41.646889, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405103):DOMAIN_INFO]: delivered response to client [2025/04/09 07:46:41.647045, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2405103)] Handling async request: PING_DC [2025/04/09 07:46:41.647148, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:46:41.647299, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1684(fork_domain_child) fork_domain_child called for domain 'ADPROTOCOLX' [2025/04/09 07:46:41.649305, 10, pid=2405105, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1758(fork_domain_child) Child process 2405105 [2025/04/09 07:46:41.649848, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) msg_ctdb_ref_destructor: refs=(nil) [2025/04/09 07:46:41.649932, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) msg_dgm_ref_destructor: refs=0x55cf82596540 [2025/04/09 07:46:41.650416, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) messaging_dgm_ref: messaging_dgm_init returned Success [2025/04/09 07:46:41.650461, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) messaging_dgm_ref: unique = 8081820949844588800 [2025/04/09 07:46:41.650593, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 07:46:41.650755, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 07:46:41.650894, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=4123060171628972689 [2025/04/09 07:46:41.651096, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2405105 [2025/04/09 07:46:41.651239, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 [2025/04/09 07:46:41.651340, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=8081820949844588800 [2025/04/09 07:46:41.651451, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) vnn pid 2405105 = 1 [2025/04/09 07:46:41.651485, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) messaging_ctdb_ref: messaging_ctdb_init returned Success [2025/04/09 07:46:41.651559, 5, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE [2025/04/09 07:46:41.651681, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 07:46:41.651776, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 07:46:41.651882, 10, pid=2405105, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=7278957261039500461 [2025/04/09 07:46:41.652066, 5, pid=2405105, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:157(make_pdb_method_name) Attempting to find a passdb backend to match tdbsam (tdbsam) [2025/04/09 07:46:41.652113, 5, pid=2405105, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:178(make_pdb_method_name) Found pdb backend tdbsam [2025/04/09 07:46:41.652208, 5, pid=2405105, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:190(make_pdb_method_name) pdb backend tdbsam has a valid init [2025/04/09 07:47:01.596501, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:47:01.596658, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:47:01.596690, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:47:01.596718, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:47:01.596738, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:47:01.596763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:47:06.629709, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) winbind_client_activity[2405103:PING_DC]: client has closed connection - removing client [2025/04/09 07:47:06.629823, 2, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) final write to client failed: Broken pipe [2025/04/09 07:47:06.629951, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) wb_child_request_cleanup: keep orphaned subreq[0x55cf825b5c00] [2025/04/09 07:47:06.668780, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:969(remove_timed_out_clients) Client request timed out, shutting down sock 27, pid 2404220 [2025/04/09 07:47:06.668988, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) wb_child_request_cleanup: keep orphaned subreq[0x55cf8257eaf0] [2025/04/09 07:47:06.669145, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:47:06.669233, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:06.669261, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2405693)]: request interface version (version = 32) [2025/04/09 07:47:06.669321, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405693):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:06.669550, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:47:06.669592, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2405693)]: ping [2025/04/09 07:47:06.669636, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405693):PING]: delivered response to client [2025/04/09 07:47:06.671214, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:47:06.690584, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:47:06.690675, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:06.690704, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2405695)]: request interface version (version = 32) [2025/04/09 07:47:06.690751, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405695):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:06.690859, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:06.690888, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2405695)]: request interface version (version = 32) [2025/04/09 07:47:06.690946, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405695):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:06.691116, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:47:06.691152, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2405695)]: request misc info [2025/04/09 07:47:06.691199, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405695):INFO]: delivered response to client [2025/04/09 07:47:06.691361, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:47:06.691416, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2405695)]: request netbios name [2025/04/09 07:47:06.691508, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405695):NETBIOS_NAME]: delivered response to client [2025/04/09 07:47:06.691649, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:47:06.691705, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2405695)]: request domain name [2025/04/09 07:47:06.691766, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405695):DOMAIN_NAME]: delivered response to client [2025/04/09 07:47:06.691895, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2405695)] Handling async request: DOMAIN_INFO [2025/04/09 07:47:06.691975, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2405695]: domain_info [ADPROTOCOLX] [2025/04/09 07:47:06.692060, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2405695):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:47:06.692126, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405695):DOMAIN_INFO]: delivered response to client [2025/04/09 07:47:06.692306, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2405695)] Handling async request: PING_DC [2025/04/09 07:47:06.692373, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:47:06.692449, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1684(fork_domain_child) fork_domain_child called for domain 'ADPROTOCOLX' [2025/04/09 07:47:06.694502, 10, pid=2405698, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1758(fork_domain_child) Child process 2405698 [2025/04/09 07:47:06.695074, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) msg_ctdb_ref_destructor: refs=(nil) [2025/04/09 07:47:06.695270, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) msg_dgm_ref_destructor: refs=0x55cf82596540 [2025/04/09 07:47:06.695688, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) messaging_dgm_ref: messaging_dgm_init returned Success [2025/04/09 07:47:06.695748, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) messaging_dgm_ref: unique = 16329941230091360097 [2025/04/09 07:47:06.696098, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 07:47:06.696305, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 07:47:06.696494, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=8060909910973365424 [2025/04/09 07:47:06.696684, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2405698 [2025/04/09 07:47:06.696862, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 [2025/04/09 07:47:06.697094, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=16329941230091360097 [2025/04/09 07:47:06.697401, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) vnn pid 2405698 = 1 [2025/04/09 07:47:06.697444, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) messaging_ctdb_ref: messaging_ctdb_init returned Success [2025/04/09 07:47:06.697515, 5, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE [2025/04/09 07:47:06.697737, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 07:47:06.697913, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 07:47:06.698107, 10, pid=2405698, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=11909729853467258436 [2025/04/09 07:47:06.698336, 5, pid=2405698, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:157(make_pdb_method_name) Attempting to find a passdb backend to match tdbsam (tdbsam) [2025/04/09 07:47:06.698377, 5, pid=2405698, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:178(make_pdb_method_name) Found pdb backend tdbsam [2025/04/09 07:47:06.698485, 5, pid=2405698, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:190(make_pdb_method_name) pdb backend tdbsam has a valid init [2025/04/09 07:47:11.870390, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:47:11.870588, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:11.870630, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2405714)]: request interface version (version = 32) [2025/04/09 07:47:11.870713, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405714):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:11.870843, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:11.870888, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2405714)]: request interface version (version = 32) [2025/04/09 07:47:11.870937, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405714):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:11.871089, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:47:11.871136, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2405714)]: request misc info [2025/04/09 07:47:11.871196, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405714):INFO]: delivered response to client [2025/04/09 07:47:11.871317, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:47:11.871367, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2405714)]: request netbios name [2025/04/09 07:47:11.871416, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405714):NETBIOS_NAME]: delivered response to client [2025/04/09 07:47:11.871532, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:47:11.871581, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2405714)]: request domain name [2025/04/09 07:47:11.871627, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405714):DOMAIN_NAME]: delivered response to client [2025/04/09 07:47:11.871749, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2405714)] Handling async request: DOMAIN_INFO [2025/04/09 07:47:11.871799, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2405714]: domain_info [ADPROTOCOLX] [2025/04/09 07:47:11.871842, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2405714):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:47:11.871896, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2405714):DOMAIN_INFO]: delivered response to client [2025/04/09 07:47:11.872151, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2405714)] Handling async request: PING_DC [2025/04/09 07:47:11.872232, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:47:11.872323, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1684(fork_domain_child) fork_domain_child called for domain 'ADPROTOCOLX' [2025/04/09 07:47:11.873629, 10, pid=2405715, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1758(fork_domain_child) Child process 2405715 [2025/04/09 07:47:11.874227, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:139(msg_ctdb_ref_destructor) msg_ctdb_ref_destructor: refs=(nil) [2025/04/09 07:47:11.874310, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:163(msg_dgm_ref_destructor) msg_dgm_ref_destructor: refs=0x55cf82596540 [2025/04/09 07:47:11.874728, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:80(messaging_dgm_ref) messaging_dgm_ref: messaging_dgm_init returned Success [2025/04/09 07:47:11.874791, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm_ref.c:109(messaging_dgm_ref) messaging_dgm_ref: unique = 17250037970596681267 [2025/04/09 07:47:11.874861, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 07:47:11.875058, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 07:47:11.875207, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=16052246599528253588 [2025/04/09 07:47:11.875336, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=4, vnn=4026531841, opcode=23, srvid=2405715 [2025/04/09 07:47:11.875488, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=5, vnn=4026531841, opcode=23, srvid=18302628885633695746 [2025/04/09 07:47:11.875594, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=6, vnn=4026531841, opcode=23, srvid=17250037970596681267 [2025/04/09 07:47:11.875711, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/util_procid.c:37(set_my_vnn) vnn pid 2405715 = 1 [2025/04/09 07:47:11.875747, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/messages_ctdb_ref.c:77(messaging_ctdb_ref) messaging_ctdb_ref: messaging_ctdb_init returned Success [2025/04/09 07:47:11.875811, 5, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/tallocmsg.c:84(register_msg_pool_usage) register_msg_pool_usage: Registered MSG_REQ_POOL_USAGE [2025/04/09 07:47:11.875936, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=1, vnn=4026531841, opcode=35, srvid=0 [2025/04/09 07:47:11.876076, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=2, vnn=4026531841, opcode=91, srvid=0 [2025/04/09 07:47:11.876185, 10, pid=2405715, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=3, vnn=4026531841, opcode=23, srvid=11166258238532806582 [2025/04/09 07:47:11.876330, 5, pid=2405715, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:157(make_pdb_method_name) Attempting to find a passdb backend to match tdbsam (tdbsam) [2025/04/09 07:47:11.876383, 5, pid=2405715, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:178(make_pdb_method_name) Found pdb backend tdbsam [2025/04/09 07:47:11.876477, 5, pid=2405715, effective(0, 0), real(0, 0), class=passdb] ../../source3/passdb/pdb_interface.c:190(make_pdb_method_name) pdb backend tdbsam has a valid init [2025/04/09 07:47:31.600045, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:47:31.600256, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:47:31.600288, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:47:31.600315, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:47:31.600335, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:47:31.600378, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:47:31.678017, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) winbind_client_activity[2405695:PING_DC]: client has closed connection - removing client [2025/04/09 07:47:31.678135, 2, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) final write to client failed: Broken pipe [2025/04/09 07:47:31.678290, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) wb_child_request_cleanup: keep orphaned subreq[0x55cf8259d020] [2025/04/09 07:47:31.718948, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:47:31.719218, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:31.719279, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406077)]: request interface version (version = 32) [2025/04/09 07:47:31.719340, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406077):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:31.720016, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:47:31.720067, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2406077)]: ping [2025/04/09 07:47:31.720118, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406077):PING]: delivered response to client [2025/04/09 07:47:31.722356, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:47:31.743078, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:47:31.743192, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:31.743221, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406086)]: request interface version (version = 32) [2025/04/09 07:47:31.743268, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406086):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:31.743375, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:31.743403, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406086)]: request interface version (version = 32) [2025/04/09 07:47:31.743445, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406086):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:31.743556, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:47:31.743584, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2406086)]: request misc info [2025/04/09 07:47:31.743631, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406086):INFO]: delivered response to client [2025/04/09 07:47:31.747561, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:47:31.747601, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2406086)]: request netbios name [2025/04/09 07:47:31.747654, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406086):NETBIOS_NAME]: delivered response to client [2025/04/09 07:47:31.750502, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:47:31.750544, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2406086)]: request domain name [2025/04/09 07:47:31.750594, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406086):DOMAIN_NAME]: delivered response to client [2025/04/09 07:47:31.750732, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2406086)] Handling async request: DOMAIN_INFO [2025/04/09 07:47:31.750763, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2406086]: domain_info [ADPROTOCOLX] [2025/04/09 07:47:31.750854, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2406086):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:47:31.750917, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406086):DOMAIN_INFO]: delivered response to client [2025/04/09 07:47:31.751052, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2406086)] Handling async request: PING_DC [2025/04/09 07:47:31.751149, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:47:31.993402, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b [2025/04/09 07:47:31.993512, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2398754 [2025/04/09 07:47:31.993606, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! [2025/04/09 07:47:32.002611, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) wb_child_request_orphaned: cleanup orphaned subreq[0x55cf82599d10] [2025/04/09 07:47:32.004579, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:47:32.004696, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2406086):PING_DC]: NT_STATUS_OK [2025/04/09 07:47:32.004763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406086):PING_DC]: delivered response to client [2025/04/09 07:47:32.004974, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:47:46.576138, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:47:46.576286, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:46.576313, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406500)]: request interface version (version = 32) [2025/04/09 07:47:46.576373, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406500):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:46.576494, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:47:46.576518, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2406500)]: ping [2025/04/09 07:47:46.576556, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406500):PING]: delivered response to client [2025/04/09 07:47:46.580025, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:47:46.603419, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:47:46.603513, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:46.603539, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406510)]: request interface version (version = 32) [2025/04/09 07:47:46.603587, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406510):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:46.603691, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:47:46.603726, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406510)]: request interface version (version = 32) [2025/04/09 07:47:46.603767, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406510):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:47:46.603870, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:47:46.603894, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2406510)]: request misc info [2025/04/09 07:47:46.603942, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406510):INFO]: delivered response to client [2025/04/09 07:47:46.604061, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:47:46.604089, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2406510)]: request netbios name [2025/04/09 07:47:46.604134, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406510):NETBIOS_NAME]: delivered response to client [2025/04/09 07:47:46.604224, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:47:46.604248, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2406510)]: request domain name [2025/04/09 07:47:46.604286, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406510):DOMAIN_NAME]: delivered response to client [2025/04/09 07:47:46.604377, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2406510)] Handling async request: DOMAIN_INFO [2025/04/09 07:47:46.604403, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2406510]: domain_info [ADPROTOCOLX] [2025/04/09 07:47:46.604464, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2406510):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:47:46.604521, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406510):DOMAIN_INFO]: delivered response to client [2025/04/09 07:47:46.604626, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2406510)] Handling async request: PING_DC [2025/04/09 07:47:46.604698, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:47:46.608015, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:47:46.608112, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2406510):PING_DC]: NT_STATUS_OK [2025/04/09 07:47:46.608170, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406510):PING_DC]: delivered response to client [2025/04/09 07:47:46.609665, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:48:01.577713, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:48:01.577885, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:01.577913, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406806)]: request interface version (version = 32) [2025/04/09 07:48:01.578006, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406806):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:01.578164, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:48:01.578189, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2406806)]: ping [2025/04/09 07:48:01.578229, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406806):PING]: delivered response to client [2025/04/09 07:48:01.579522, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:48:01.599641, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:48:01.600458, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:48:01.600535, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:48:01.600566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:48:01.600613, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:48:01.600632, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:48:01.600673, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:48:01.600734, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:01.600758, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406818)]: request interface version (version = 32) [2025/04/09 07:48:01.600807, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406818):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:01.601605, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:01.601636, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2406818)]: request interface version (version = 32) [2025/04/09 07:48:01.601678, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406818):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:01.601775, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:48:01.601799, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2406818)]: request misc info [2025/04/09 07:48:01.601853, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406818):INFO]: delivered response to client [2025/04/09 07:48:01.601947, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:48:01.602000, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2406818)]: request netbios name [2025/04/09 07:48:01.602043, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406818):NETBIOS_NAME]: delivered response to client [2025/04/09 07:48:01.602135, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:48:01.602159, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2406818)]: request domain name [2025/04/09 07:48:01.602198, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406818):DOMAIN_NAME]: delivered response to client [2025/04/09 07:48:01.602337, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2406818)] Handling async request: DOMAIN_INFO [2025/04/09 07:48:01.602378, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2406818]: domain_info [ADPROTOCOLX] [2025/04/09 07:48:01.602416, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2406818):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:48:01.602461, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406818):DOMAIN_INFO]: delivered response to client [2025/04/09 07:48:01.602573, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2406818)] Handling async request: PING_DC [2025/04/09 07:48:01.602644, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:48:01.605936, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:48:01.606052, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2406818):PING_DC]: NT_STATUS_OK [2025/04/09 07:48:01.606103, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2406818):PING_DC]: delivered response to client [2025/04/09 07:48:01.609356, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:48:16.579370, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:969(remove_timed_out_clients) Client request timed out, shutting down sock 29, pid 2405714 [2025/04/09 07:48:16.579603, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) wb_child_request_cleanup: keep orphaned subreq[0x55cf825d1cc0] [2025/04/09 07:48:16.579676, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:48:16.579786, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:16.579812, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2407118)]: request interface version (version = 32) [2025/04/09 07:48:16.579862, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407118):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:16.584384, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:48:16.584437, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2407118)]: ping [2025/04/09 07:48:16.584502, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407118):PING]: delivered response to client [2025/04/09 07:48:16.586936, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:48:16.587057, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:48:16.587119, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:16.587143, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2407132)]: request interface version (version = 32) [2025/04/09 07:48:16.587193, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2407132):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:16.596734, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2407132)] Handling async request: GETPWUID [2025/04/09 07:48:16.596783, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2407132)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:48:16.596830, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:48:16.596948, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:48:16.597017, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:48:16.597069, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:48:16.598855, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:48:16.598938, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:48:16.598981, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:48:16.599016, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:48:16.599044, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:48:16.599069, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:48:16.606357, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:48:16.606474, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:16.606499, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2407133)]: request interface version (version = 32) [2025/04/09 07:48:16.606560, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407133):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:16.607543, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:16.607581, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2407133)]: request interface version (version = 32) [2025/04/09 07:48:16.607635, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407133):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:16.610005, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:48:16.610059, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2407133)]: request misc info [2025/04/09 07:48:16.610110, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407133):INFO]: delivered response to client [2025/04/09 07:48:16.610231, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:48:16.610256, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2407133)]: request netbios name [2025/04/09 07:48:16.610307, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407133):NETBIOS_NAME]: delivered response to client [2025/04/09 07:48:16.610399, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:48:16.610423, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2407133)]: request domain name [2025/04/09 07:48:16.610460, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407133):DOMAIN_NAME]: delivered response to client [2025/04/09 07:48:16.610550, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2407133)] Handling async request: DOMAIN_INFO [2025/04/09 07:48:16.610589, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2407133]: domain_info [ADPROTOCOLX] [2025/04/09 07:48:16.610631, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2407133):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:48:16.610673, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407133):DOMAIN_INFO]: delivered response to client [2025/04/09 07:48:16.610768, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2407133)] Handling async request: PING_DC [2025/04/09 07:48:16.610826, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:48:16.614298, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:48:16.614391, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2407133):PING_DC]: NT_STATUS_OK [2025/04/09 07:48:16.614468, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407133):PING_DC]: delivered response to client [2025/04/09 07:48:16.614780, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:48:24.212140, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 07:48:24.212295, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) Domain controller not found. Calling wb_dsgetdcname_send() to get it. [2025/04/09 07:48:24.212331, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) WB command dsgetdcname start. Search domain name adprotocolx and site name (null). [2025/04/09 07:48:24.212403, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:48:31.572763, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:48:31.574124, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:31.574160, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2407426)]: request interface version (version = 32) [2025/04/09 07:48:31.574238, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407426):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:31.575644, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:48:31.575680, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2407426)]: ping [2025/04/09 07:48:31.575724, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407426):PING]: delivered response to client [2025/04/09 07:48:31.580783, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:48:31.599718, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:48:31.599812, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:31.599839, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2407441)]: request interface version (version = 32) [2025/04/09 07:48:31.599885, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407441):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:31.600348, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:31.600380, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2407441)]: request interface version (version = 32) [2025/04/09 07:48:31.600425, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407441):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:31.600535, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:48:31.600562, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2407441)]: request misc info [2025/04/09 07:48:31.600603, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407441):INFO]: delivered response to client [2025/04/09 07:48:31.600699, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:48:31.600724, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2407441)]: request netbios name [2025/04/09 07:48:31.600763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407441):NETBIOS_NAME]: delivered response to client [2025/04/09 07:48:31.600807, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:48:31.600845, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:48:31.600865, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:48:31.600888, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:48:31.600913, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:48:31.600937, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:48:31.601049, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:48:31.601074, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2407441)]: request domain name [2025/04/09 07:48:31.601114, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407441):DOMAIN_NAME]: delivered response to client [2025/04/09 07:48:31.601208, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2407441)] Handling async request: DOMAIN_INFO [2025/04/09 07:48:31.601235, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2407441]: domain_info [ADPROTOCOLX] [2025/04/09 07:48:31.601274, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2407441):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:48:31.601331, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2407441):DOMAIN_INFO]: delivered response to client [2025/04/09 07:48:31.601485, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2407441)] Handling async request: PING_DC [2025/04/09 07:48:31.601538, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:48:56.588935, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:776(winbind_client_activity) winbind_client_activity[2407441:PING_DC]: client has closed connection - removing client [2025/04/09 07:48:56.589144, 2, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:886(remove_client) final write to client failed: Broken pipe [2025/04/09 07:48:56.668909, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:48:56.669147, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:56.669218, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408149)]: request interface version (version = 32) [2025/04/09 07:48:56.669299, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408149):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:56.669430, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:48:56.669456, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2408149)]: ping [2025/04/09 07:48:56.669502, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408149):PING]: delivered response to client [2025/04/09 07:48:56.670564, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:48:56.690998, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:48:56.691082, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:56.691117, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408151)]: request interface version (version = 32) [2025/04/09 07:48:56.691162, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408151):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:56.691260, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:48:56.691285, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408151)]: request interface version (version = 32) [2025/04/09 07:48:56.691325, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408151):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:48:56.691420, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:48:56.691445, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2408151)]: request misc info [2025/04/09 07:48:56.691500, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408151):INFO]: delivered response to client [2025/04/09 07:48:56.691596, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:48:56.691621, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2408151)]: request netbios name [2025/04/09 07:48:56.691668, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408151):NETBIOS_NAME]: delivered response to client [2025/04/09 07:48:56.691763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:48:56.691788, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2408151)]: request domain name [2025/04/09 07:48:56.691827, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408151):DOMAIN_NAME]: delivered response to client [2025/04/09 07:48:56.691934, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2408151)] Handling async request: DOMAIN_INFO [2025/04/09 07:48:56.692017, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2408151]: domain_info [ADPROTOCOLX] [2025/04/09 07:48:56.692085, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2408151):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:48:56.692152, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408151):DOMAIN_INFO]: delivered response to client [2025/04/09 07:48:56.692269, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2408151)] Handling async request: PING_DC [2025/04/09 07:48:56.692366, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:48:58.009571, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b [2025/04/09 07:48:58.009664, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2398472 [2025/04/09 07:48:58.009720, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! [2025/04/09 07:49:01.604030, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:49:01.604152, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:49:01.604179, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:49:01.604204, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:49:01.604223, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:49:01.604255, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:49:09.213991, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) wb_child_request_orphaned: cleanup orphaned subreq[0x55cf8257eaf0] [2025/04/09 07:49:09.216445, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:09.216535, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2408151):PING_DC]: NT_STATUS_OK [2025/04/09 07:49:09.216600, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408151):PING_DC]: delivered response to client [2025/04/09 07:49:09.216655, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 12.524360 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:48:56.692267] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:49:09.216627] [12.524360] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_ping_dc_state] ../../source3/winbindd/winbindd_ping_dc.c:41 [2025/04/09 07:48:56.692302] ../../source3/winbindd/winbindd_ping_dc.c:112 [2025/04/09 07:49:09.216533] [12.524231] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_state] librpc/gen_ndr/ndr_winbind_c.c:4810 [2025/04/09 07:48:56.692327] librpc/gen_ndr/ndr_winbind_c.c:4871 [2025/04/09 07:49:09.216528] [12.524201] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_PingDc_r_state] librpc/gen_ndr/ndr_winbind_c.c:4726 [2025/04/09 07:48:56.692335] librpc/gen_ndr/ndr_winbind_c.c:4760 [2025/04/09 07:49:09.216526] [12.524191] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:48:56.692354] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:09.216515] [12.524161] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:48:56.692439] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:09.216404] [12.523965] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:48:56.692442] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:49:09.216402] [12.523960] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:48:56.692447] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:49:09.216401] [12.523954] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:09.214106] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:09.216399] [0.002293] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:09.214108] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:09.214109] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:09.214111] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:09.216394] [0.002283] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:09.214111] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:09.214170] [0.000059] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:09.214112] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:09.214168] [0.000056] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:09.214171] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:09.216393] [0.002222] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:09.214177] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:09.216392] [0.002215] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:49:09.216568] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:49:09.216599] [0.000031] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:09.216570] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:09.216594] [0.000024] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:49:09.217381, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:49:21.762049, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:969(remove_timed_out_clients) Client request timed out, shutting down sock 27, pid 2407132 [2025/04/09 07:49:21.762249, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:371(wb_child_request_cleanup) wb_child_request_cleanup: keep orphaned subreq[0x55cf825d5f00] [2025/04/09 07:49:25.786737, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:49:25.786978, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:25.787024, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408800)]: request interface version (version = 32) [2025/04/09 07:49:25.787080, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408800):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:25.787178, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:49:25.787211, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2408800)]: ping [2025/04/09 07:49:25.787258, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408800):PING]: delivered response to client [2025/04/09 07:49:25.787406, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:49:25.807784, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:49:25.807926, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:25.807990, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408802)]: request interface version (version = 32) [2025/04/09 07:49:25.808047, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408802):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:25.808163, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:25.808190, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408802)]: request interface version (version = 32) [2025/04/09 07:49:25.808233, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408802):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:25.808338, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:49:25.808374, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2408802)]: request misc info [2025/04/09 07:49:25.808419, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408802):INFO]: delivered response to client [2025/04/09 07:49:25.808518, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:49:25.808544, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2408802)]: request netbios name [2025/04/09 07:49:25.808599, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408802):NETBIOS_NAME]: delivered response to client [2025/04/09 07:49:25.808698, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:49:25.808724, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2408802)]: request domain name [2025/04/09 07:49:25.808764, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408802):DOMAIN_NAME]: delivered response to client [2025/04/09 07:49:25.808862, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2408802)] Handling async request: DOMAIN_INFO [2025/04/09 07:49:25.808898, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2408802]: domain_info [ADPROTOCOLX] [2025/04/09 07:49:25.808948, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2408802):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:49:25.809033, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408802):DOMAIN_INFO]: delivered response to client [2025/04/09 07:49:25.809138, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2408802)] Handling async request: PING_DC [2025/04/09 07:49:25.809185, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:25.812008, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:25.812090, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2408802):PING_DC]: NT_STATUS_OK [2025/04/09 07:49:25.812148, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408802):PING_DC]: delivered response to client [2025/04/09 07:49:25.812866, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:49:26.956692, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:49:26.956988, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:26.957022, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408815)]: request interface version (version = 32) [2025/04/09 07:49:26.957082, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408815):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:26.957197, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:26.957231, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408815)]: request interface version (version = 32) [2025/04/09 07:49:26.957273, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408815):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:26.957395, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:49:26.957423, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2408815)]: request misc info [2025/04/09 07:49:26.957467, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408815):INFO]: delivered response to client [2025/04/09 07:49:26.957566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:49:26.957592, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2408815)]: request netbios name [2025/04/09 07:49:26.957633, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408815):NETBIOS_NAME]: delivered response to client [2025/04/09 07:49:26.957740, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:49:26.957766, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2408815)]: request domain name [2025/04/09 07:49:26.957815, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408815):DOMAIN_NAME]: delivered response to client [2025/04/09 07:49:26.957913, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2408815)] Handling async request: DOMAIN_INFO [2025/04/09 07:49:26.957941, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2408815]: domain_info [ADPROTOCOLX] [2025/04/09 07:49:26.958009, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2408815):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:49:26.958064, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408815):DOMAIN_INFO]: delivered response to client [2025/04/09 07:49:26.958173, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2408815)] Handling async request: PING_DC [2025/04/09 07:49:26.958215, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:26.960570, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:26.960660, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2408815):PING_DC]: NT_STATUS_OK [2025/04/09 07:49:26.960708, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408815):PING_DC]: delivered response to client [2025/04/09 07:49:26.962031, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:49:26.964214, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:49:26.964293, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:26.964319, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2408816)]: request interface version (version = 32) [2025/04/09 07:49:26.964363, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2408816):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:26.964481, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2408816)] Handling async request: GETPWUID [2025/04/09 07:49:26.964522, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2408816)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:49:26.964571, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:49:26.964673, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:49:26.964713, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:49:26.964760, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:49:26.966456, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:49:26.966544, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:49:26.966566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:49:26.966591, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:49:26.966619, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:49:26.966645, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:49:31.595195, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:49:31.596387, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:31.596474, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408856)]: request interface version (version = 32) [2025/04/09 07:49:31.596546, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408856):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:31.596763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:49:31.596795, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2408856)]: ping [2025/04/09 07:49:31.596837, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408856):PING]: delivered response to client [2025/04/09 07:49:31.598882, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:49:31.610659, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:49:31.610798, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:49:31.610824, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:49:31.610850, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:49:31.610869, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:49:31.610893, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:49:31.618828, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:49:31.619538, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:31.619572, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408867)]: request interface version (version = 32) [2025/04/09 07:49:31.619619, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408867):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:31.619716, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:31.619742, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2408867)]: request interface version (version = 32) [2025/04/09 07:49:31.619787, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408867):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:31.619883, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:49:31.619908, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2408867)]: request misc info [2025/04/09 07:49:31.619974, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408867):INFO]: delivered response to client [2025/04/09 07:49:31.620078, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:49:31.620103, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2408867)]: request netbios name [2025/04/09 07:49:31.620144, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408867):NETBIOS_NAME]: delivered response to client [2025/04/09 07:49:31.620238, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:49:31.620263, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2408867)]: request domain name [2025/04/09 07:49:31.620302, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408867):DOMAIN_NAME]: delivered response to client [2025/04/09 07:49:31.620397, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2408867)] Handling async request: DOMAIN_INFO [2025/04/09 07:49:31.620424, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2408867]: domain_info [ADPROTOCOLX] [2025/04/09 07:49:31.620469, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2408867):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:49:31.620525, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408867):DOMAIN_INFO]: delivered response to client [2025/04/09 07:49:31.620628, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2408867)] Handling async request: PING_DC [2025/04/09 07:49:31.620677, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:31.626114, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:31.626185, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2408867):PING_DC]: NT_STATUS_OK [2025/04/09 07:49:31.626239, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2408867):PING_DC]: delivered response to client [2025/04/09 07:49:31.628636, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:49:34.868302, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 07:49:34.868445, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) Domain controller not found. Calling wb_dsgetdcname_send() to get it. [2025/04/09 07:49:34.868478, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) WB command dsgetdcname start. Search domain name adprotocolx and site name (null). [2025/04/09 07:49:34.868542, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:49:34.871711, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:49:34.871763, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:34.871854, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) WB command dsgetdcname for adprotocolx end. [2025/04/09 07:49:34.871879, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:137(wb_dsgetdcname_recv) Failed for adprotocolx with NT_STATUS_NO_LOGON_SERVERS. [2025/04/09 07:49:34.871914, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:49:34.871937, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:410(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:34.871991, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:34.872017, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2408816):GETPWUID]: NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:34.872075, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_NO_LOGON_SERVERS. [2025/04/09 07:49:34.872140, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2408816):GETPWUID]: delivered response to client [2025/04/09 07:49:34.872198, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 7.907688 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:49:26.964478] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:49:34.872166] [7.907688] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:49:26.964522] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:49:34.871989] [7.907467] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:259 [2025/04/09 07:49:26.964571] ../../source3/winbindd/wb_xids2sids.c:352 [2025/04/09 07:49:34.871909] [7.907338] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:49:26.964663] ../../source3/winbindd/winbindd_idmap.c:175 [2025/04/09 07:49:26.964663] [0.000000] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:26.964672] ../../source3/winbindd/wb_xids2sids.c:194 [2025/04/09 07:49:26.966587] [0.001915] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:26.964751] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:26.966542] [0.001791] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:26.964752] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:26.966541] [0.001789] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:26.964753] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:26.966540] [0.001787] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:26.964922] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:26.966451] [0.001529] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:26.964923] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:26.966451] [0.001528] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:26.964924] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:26.966448] [0.001524] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:26.964925] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:26.964928] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:26.964935] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:26.966444] [0.001509] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:26.964936] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:26.964998] [0.000062] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:26.964936] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:26.964989] [0.000053] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:26.965000] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:26.966443] [0.001443] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:26.965000] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:26.966441] [0.001441] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:26.966590] ../../source3/winbindd/wb_xids2sids.c:209 [2025/04/09 07:49:34.871900] [7.905310] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:26.966642] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:34.868443] [7.901801] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:26.966643] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:34.868434] [7.901791] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:26.966644] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:34.868431] [7.901787] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:26.966728] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:34.868285] [7.901557] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:26.966729] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:34.868282] [7.901553] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:26.966730] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:34.868265] [7.901535] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:26.966732] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:26.966735] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:26.966741] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:34.868230] [7.901489] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:26.966741] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:26.966768] [0.000027] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:26.966743] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:26.966766] [0.000023] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:26.966770] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:34.868229] [7.901459] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:26.966771] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:34.868220] [7.901449] -> TEVENT_REQ_DONE (2 0)) [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:49:34.868478] ../../source3/winbindd/wb_dsgetdcname.c:119 [2025/04/09 07:49:34.871853] [0.003375] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:49:34.868532] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:49:34.871847] [0.003315] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:49:34.868533] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:49:34.871846] [0.003313] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:34.868540] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:34.871844] [0.003304] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:34.868619] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:34.871760] [0.003141] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:34.868622] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:49:34.871757] [0.003135] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:49:34.868674] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:49:34.871659] [0.002985] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:34.868696] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:34.871657] [0.002961] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:34.868698] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:34.868699] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:34.868707] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:34.871651] [0.002944] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:34.868708] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:34.868743] [0.000035] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:34.868709] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:34.868741] [0.000032] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:34.868744] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:34.871650] [0.002906] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:34.868745] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:34.871648] [0.002903] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:49:34.872056] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:49:34.872139] [0.000083] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:34.872058] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:34.872074] [0.000016] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:49:34.876022, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:49:36.922637, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40c [2025/04/09 07:49:36.922719, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40c len 12 (num_fds:0) from 1:2405715 [2025/04/09 07:49:36.922763, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:126(winbind_msg_domain_offline) winbind_msg_domain_offline: Domain ADPROTOCOLX was online, change to offline now. [2025/04/09 07:49:40.065668, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:49:40.065805, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:40.065837, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409119)]: request interface version (version = 32) [2025/04/09 07:49:40.065884, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409119):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:40.066573, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:40.066620, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409119)]: request interface version (version = 32) [2025/04/09 07:49:40.066669, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409119):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:40.066764, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:49:40.066788, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2409119)]: request misc info [2025/04/09 07:49:40.066827, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409119):INFO]: delivered response to client [2025/04/09 07:49:40.066923, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:49:40.066947, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2409119)]: request netbios name [2025/04/09 07:49:40.067035, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409119):NETBIOS_NAME]: delivered response to client [2025/04/09 07:49:40.067143, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:49:40.067178, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2409119)]: request domain name [2025/04/09 07:49:40.067216, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409119):DOMAIN_NAME]: delivered response to client [2025/04/09 07:49:40.067309, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2409119)] Handling async request: DOMAIN_INFO [2025/04/09 07:49:40.067335, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2409119]: domain_info [ADPROTOCOLX] [2025/04/09 07:49:40.067407, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2409119):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:49:40.067468, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409119):DOMAIN_INFO]: delivered response to client [2025/04/09 07:49:40.067588, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2409119)] Handling async request: PING_DC [2025/04/09 07:49:40.067655, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:40.073197, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:40.073284, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2409119):PING_DC]: NT_STATUS_OK [2025/04/09 07:49:40.073341, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409119):PING_DC]: delivered response to client [2025/04/09 07:49:40.075113, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:49:40.076665, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:49:40.076743, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:40.076769, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2409130)]: request interface version (version = 32) [2025/04/09 07:49:40.076818, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2409130):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:40.076909, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2409130)] Handling async request: GETPWUID [2025/04/09 07:49:40.076936, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2409130)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:49:40.076992, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:49:40.077049, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:49:40.077075, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:49:40.077100, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:49:40.078069, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:49:40.078156, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:49:40.078178, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:49:40.078200, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:49:40.078219, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:49:40.078246, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:49:41.017314, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b [2025/04/09 07:49:41.017367, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2405105 [2025/04/09 07:49:41.017404, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was offline, marking as online now! [2025/04/09 07:49:41.022034, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) wb_child_request_orphaned: cleanup orphaned subreq[0x55cf825b5c00] [2025/04/09 07:49:46.594743, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:49:46.595110, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:46.595160, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409413)]: request interface version (version = 32) [2025/04/09 07:49:46.595224, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409413):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:46.595361, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:49:46.595387, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2409413)]: ping [2025/04/09 07:49:46.595435, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409413):PING]: delivered response to client [2025/04/09 07:49:46.596015, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:49:46.619721, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:49:46.619853, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:46.619882, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409420)]: request interface version (version = 32) [2025/04/09 07:49:46.619935, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409420):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:46.620768, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:46.620800, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409420)]: request interface version (version = 32) [2025/04/09 07:49:46.620850, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409420):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:46.620986, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:49:46.621018, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2409420)]: request misc info [2025/04/09 07:49:46.621076, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409420):INFO]: delivered response to client [2025/04/09 07:49:46.621179, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:49:46.621210, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2409420)]: request netbios name [2025/04/09 07:49:46.621252, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409420):NETBIOS_NAME]: delivered response to client [2025/04/09 07:49:46.621358, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:49:46.621384, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2409420)]: request domain name [2025/04/09 07:49:46.621425, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409420):DOMAIN_NAME]: delivered response to client [2025/04/09 07:49:46.621560, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2409420)] Handling async request: DOMAIN_INFO [2025/04/09 07:49:46.621614, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2409420]: domain_info [ADPROTOCOLX] [2025/04/09 07:49:46.621668, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2409420):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:49:46.621754, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409420):DOMAIN_INFO]: delivered response to client [2025/04/09 07:49:46.622074, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2409420)] Handling async request: PING_DC [2025/04/09 07:49:46.622142, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:46.625465, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:46.625538, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2409420):PING_DC]: NT_STATUS_OK [2025/04/09 07:49:46.625588, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409420):PING_DC]: delivered response to client [2025/04/09 07:49:46.627017, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:49:47.155841, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 07:49:47.156034, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) Domain controller not found. Calling wb_dsgetdcname_send() to get it. [2025/04/09 07:49:47.156080, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) WB command dsgetdcname start. Search domain name adprotocolx and site name (null). [2025/04/09 07:49:47.156150, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:49:47.159508, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:49:47.159547, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:47.159617, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) WB command dsgetdcname for adprotocolx end. [2025/04/09 07:49:47.159641, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:137(wb_dsgetdcname_recv) Failed for adprotocolx with NT_STATUS_NO_LOGON_SERVERS. [2025/04/09 07:49:47.159669, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:49:47.159690, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:410(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:47.159712, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:47.159745, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2409130):GETPWUID]: NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:47.159813, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_NO_LOGON_SERVERS. [2025/04/09 07:49:47.159852, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2409130):GETPWUID]: delivered response to client [2025/04/09 07:49:47.159913, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 7.082975 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:49:40.076907] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:49:47.159882] [7.082975] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:49:40.076936] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:49:47.159711] [7.082775] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:259 [2025/04/09 07:49:40.076991] ../../source3/winbindd/wb_xids2sids.c:352 [2025/04/09 07:49:47.159663] [7.082672] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:49:40.077044] ../../source3/winbindd/winbindd_idmap.c:175 [2025/04/09 07:49:40.077044] [0.000000] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:40.077049] ../../source3/winbindd/wb_xids2sids.c:194 [2025/04/09 07:49:40.078197] [0.001148] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:40.077096] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:40.078155] [0.001059] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:40.077097] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:40.078154] [0.001057] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:40.077098] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:40.078152] [0.001054] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:40.077216] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:40.078065] [0.000849] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:40.077217] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:40.078064] [0.000847] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:40.077218] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:40.078062] [0.000844] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:40.077219] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:40.077222] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:40.077233] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:40.078058] [0.000825] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:40.077234] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:40.077292] [0.000058] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:40.077234] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:40.077290] [0.000056] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:40.077293] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:40.078058] [0.000765] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:40.077294] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:40.078056] [0.000762] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:40.078199] ../../source3/winbindd/wb_xids2sids.c:209 [2025/04/09 07:49:47.159661] [7.081462] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:40.078244] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:47.156032] [7.077788] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:40.078244] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:47.156023] [7.077779] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:40.078245] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:47.155972] [7.077727] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:40.078324] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:47.155811] [7.077487] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:40.078325] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:47.155807] [7.077482] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:40.078326] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:47.155802] [7.077476] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:40.078327] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:40.078330] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:40.078336] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:47.155793] [7.077457] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:40.078337] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:40.078361] [0.000024] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:40.078337] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:40.078359] [0.000022] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:40.078362] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:47.155792] [7.077430] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:40.078364] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:47.155786] [7.077422] -> TEVENT_REQ_DONE (2 0)) [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:49:47.156079] ../../source3/winbindd/wb_dsgetdcname.c:119 [2025/04/09 07:49:47.159616] [0.003537] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:49:47.156142] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:49:47.159609] [0.003467] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:49:47.156144] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:49:47.159608] [0.003464] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:47.156146] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:47.159607] [0.003461] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:47.156232] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:47.159545] [0.003313] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:47.156235] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:49:47.159543] [0.003308] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:49:47.156270] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:49:47.159488] [0.003218] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:47.156277] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:47.159487] [0.003210] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:47.156280] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:47.156281] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:47.156288] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:47.159482] [0.003194] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:47.156289] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:47.156322] [0.000033] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:47.156291] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:47.156320] [0.000029] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:47.156324] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:47.159481] [0.003157] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:47.156324] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:47.159479] [0.003155] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:49:47.159775] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:49:47.159851] [0.000076] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:47.159776] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:47.159800] [0.000024] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:49:47.161799, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:49:52.344228, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:49:52.344382, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:52.344411, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409520)]: request interface version (version = 32) [2025/04/09 07:49:52.344464, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409520):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:52.344567, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:52.344593, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409520)]: request interface version (version = 32) [2025/04/09 07:49:52.344633, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409520):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:52.344738, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:49:52.344765, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2409520)]: request misc info [2025/04/09 07:49:52.344816, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409520):INFO]: delivered response to client [2025/04/09 07:49:52.344915, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:49:52.344940, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2409520)]: request netbios name [2025/04/09 07:49:52.345005, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409520):NETBIOS_NAME]: delivered response to client [2025/04/09 07:49:52.345105, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:49:52.345131, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2409520)]: request domain name [2025/04/09 07:49:52.345169, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409520):DOMAIN_NAME]: delivered response to client [2025/04/09 07:49:52.345263, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2409520)] Handling async request: DOMAIN_INFO [2025/04/09 07:49:52.345290, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2409520]: domain_info [ADPROTOCOLX] [2025/04/09 07:49:52.345321, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2409520):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:49:52.345369, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409520):DOMAIN_INFO]: delivered response to client [2025/04/09 07:49:52.345502, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2409520)] Handling async request: PING_DC [2025/04/09 07:49:52.345557, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:52.348526, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:52.348607, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2409520):PING_DC]: NT_STATUS_OK [2025/04/09 07:49:52.348668, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409520):PING_DC]: delivered response to client [2025/04/09 07:49:52.349897, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:49:52.352042, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:49:52.352129, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:49:52.352156, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2409521)]: request interface version (version = 32) [2025/04/09 07:49:52.352209, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2409521):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:49:52.352278, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2409521)] Handling async request: GETPWUID [2025/04/09 07:49:52.352305, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2409521)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:49:52.352350, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:49:52.352424, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:49:52.352460, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:49:52.352488, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:49:52.353400, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:49:52.353502, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:49:52.353527, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:49:52.353561, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:49:52.353591, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:49:52.353618, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:49:55.032478, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40c [2025/04/09 07:49:55.032527, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40c len 12 (num_fds:0) from 1:2405698 [2025/04/09 07:49:55.032571, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:126(winbind_msg_domain_offline) winbind_msg_domain_offline: Domain ADPROTOCOLX was online, change to offline now. [2025/04/09 07:49:59.444040, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 07:49:59.444155, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) Domain controller not found. Calling wb_dsgetdcname_send() to get it. [2025/04/09 07:49:59.444197, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) WB command dsgetdcname start. Search domain name adprotocolx and site name (null). [2025/04/09 07:49:59.444279, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:50:01.595669, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:50:01.595779, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:01.595805, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409729)]: request interface version (version = 32) [2025/04/09 07:50:01.595850, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409729):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:01.596030, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:50:01.596072, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2409729)]: ping [2025/04/09 07:50:01.596119, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409729):PING]: delivered response to client [2025/04/09 07:50:01.598251, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:50:01.616382, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 29 [2025/04/09 07:50:01.616436, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:50:01.616490, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:50:01.616519, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:50:01.616544, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:50:01.616562, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline [2025/04/09 07:50:01.616584, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:50:01.616607, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* [2025/04/09 07:50:01.616687, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com], timeout=[Wed Apr 9 07:47:34 AM 2025 EDT]) [2025/04/09 07:50:01.616735, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com], value=[c0000001], timeout=[Wed Apr 9 07:47:34 AM 2025 EDT]) [2025/04/09 07:50:01.616764, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com]) [2025/04/09 07:50:01.616851, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:50:55 AM 2025 EDT]) [2025/04/09 07:50:01.616880, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], value=[c0000194], timeout=[Wed Apr 9 07:50:55 AM 2025 EDT]) [2025/04/09 07:50:01.616906, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com]) [2025/04/09 07:50:01.617027, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX [2025/04/09 07:50:01.617058, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* [2025/04/09 07:50:01.617147, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com], timeout=[Wed Apr 9 07:47:34 AM 2025 EDT]) [2025/04/09 07:50:01.617177, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com], value=[c0000001], timeout=[Wed Apr 9 07:47:34 AM 2025 EDT]) [2025/04/09 07:50:01.617203, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com]) [2025/04/09 07:50:01.617264, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:50:55 AM 2025 EDT]) [2025/04/09 07:50:01.617301, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], value=[c0000194], timeout=[Wed Apr 9 07:50:55 AM 2025 EDT]) [2025/04/09 07:50:01.617328, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com]) [2025/04/09 07:50:01.617374, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM [2025/04/09 07:50:01.617417, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:01.617553, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:01.617597, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409740)]: request interface version (version = 32) [2025/04/09 07:50:01.617643, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409740):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:01.617740, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:01.617765, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2409740)]: request interface version (version = 32) [2025/04/09 07:50:01.617804, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409740):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:01.617897, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:50:01.617932, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2409740)]: request misc info [2025/04/09 07:50:01.618001, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409740):INFO]: delivered response to client [2025/04/09 07:50:01.618114, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:50:01.618139, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2409740)]: request netbios name [2025/04/09 07:50:01.618177, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409740):NETBIOS_NAME]: delivered response to client [2025/04/09 07:50:01.618266, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:50:01.618290, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2409740)]: request domain name [2025/04/09 07:50:01.618327, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409740):DOMAIN_NAME]: delivered response to client [2025/04/09 07:50:01.618416, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2409740)] Handling async request: DOMAIN_INFO [2025/04/09 07:50:01.618442, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2409740]: domain_info [ADPROTOCOLX] [2025/04/09 07:50:01.618481, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2409740):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:50:01.618522, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409740):DOMAIN_INFO]: delivered response to client [2025/04/09 07:50:01.618631, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2409740)] Handling async request: PING_DC [2025/04/09 07:50:01.618665, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:01.620839, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:01.620914, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com [2025/04/09 07:50:01.622737, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:01.622840, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2409740):PING_DC]: NT_STATUS_OK [2025/04/09 07:50:01.622899, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2409740):PING_DC]: delivered response to client [2025/04/09 07:50:01.624222, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 29, client exited [2025/04/09 07:50:14.466008, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:50:14.466138, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:14.466261, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) WB command dsgetdcname for adprotocolx end. [2025/04/09 07:50:14.466285, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:137(wb_dsgetdcname_recv) Failed for adprotocolx with NT_STATUS_NO_LOGON_SERVERS. [2025/04/09 07:50:14.466331, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:50:14.466364, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:410(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:14.466386, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:14.466423, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2409521):GETPWUID]: NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:14.466492, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_NO_LOGON_SERVERS. [2025/04/09 07:50:14.466525, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2409521):GETPWUID]: delivered response to client [2025/04/09 07:50:14.466593, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 22.114277 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:49:52.352276] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:50:14.466553] [22.114277] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:49:52.352305] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:50:14.466384] [22.114079] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:259 [2025/04/09 07:49:52.352350] ../../source3/winbindd/wb_xids2sids.c:352 [2025/04/09 07:50:14.466326] [22.113976] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:49:52.352414] ../../source3/winbindd/winbindd_idmap.c:175 [2025/04/09 07:49:52.352414] [0.000000] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:52.352423] ../../source3/winbindd/wb_xids2sids.c:194 [2025/04/09 07:49:52.353547] [0.001124] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:52.352484] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:52.353500] [0.001016] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:52.352485] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:52.353499] [0.001014] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:52.352487] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:52.353498] [0.001011] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:52.352603] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:52.353395] [0.000792] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:52.352605] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:52.353394] [0.000789] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:52.352605] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:52.353392] [0.000787] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:52.352606] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:52.352609] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:52.352617] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:52.353386] [0.000769] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:52.352617] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:52.352659] [0.000042] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:52.352618] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:52.352657] [0.000039] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:52.352661] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:52.353386] [0.000725] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:52.352661] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:52.353383] [0.000722] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:49:52.353560] ../../source3/winbindd/wb_xids2sids.c:209 [2025/04/09 07:50:14.466309] [22.112749] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:49:52.353614] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:49:59.444152] [7.090538] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:49:52.353615] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:49:59.444150] [7.090535] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:52.353617] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:49:59.444147] [7.090530] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:52.353703] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:49:59.444012] [7.090309] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:52.353705] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:49:59.444009] [7.090304] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:52.353705] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:49:59.444005] [7.090300] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:52.353707] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:52.353710] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:52.353717] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:49:59.443989] [7.090272] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:52.353717] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:52.353761] [0.000044] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:52.353728] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:52.353759] [0.000031] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:52.353763] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:49:59.443988] [7.090225] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:52.353764] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:49:59.443961] [7.090197] -> TEVENT_REQ_DONE (2 0)) [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:49:59.444196] ../../source3/winbindd/wb_dsgetdcname.c:119 [2025/04/09 07:50:14.466259] [15.022063] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:49:59.444273] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:50:14.466257] [15.021984] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:49:59.444275] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:50:14.466250] [15.021975] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:49:59.444277] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:50:14.466247] [15.021970] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:49:59.444362] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:50:14.466130] [15.021768] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:49:59.444363] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:50:14.466121] [15.021758] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:49:59.444404] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:50:14.465896] [15.021492] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:49:59.444410] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:50:14.465893] [15.021483] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:49:59.444411] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:49:59.444418] [0.000007] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:49:59.444426] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:50:14.465879] [15.021453] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:49:59.444427] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:49:59.444458] [0.000031] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:49:59.444428] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:49:59.444456] [0.000028] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:49:59.444459] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:50:14.465878] [15.021419] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:49:59.444460] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:50:14.465873] [15.021413] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:50:14.466459] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:50:14.466524] [0.000065] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:14.466461] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:14.466490] [0.000029] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:50:14.469950, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:50:16.605355, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:50:16.605519, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:16.605547, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410045)]: request interface version (version = 32) [2025/04/09 07:50:16.605607, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410045):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:16.607453, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:50:16.607486, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2410045)]: ping [2025/04/09 07:50:16.607535, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410045):PING]: delivered response to client [2025/04/09 07:50:16.611351, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:50:16.632234, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:50:16.632822, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:16.632853, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410053)]: request interface version (version = 32) [2025/04/09 07:50:16.632899, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410053):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:16.633053, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:16.633084, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410053)]: request interface version (version = 32) [2025/04/09 07:50:16.633126, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410053):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:16.633234, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:50:16.633260, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2410053)]: request misc info [2025/04/09 07:50:16.633301, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410053):INFO]: delivered response to client [2025/04/09 07:50:16.633396, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:50:16.633426, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2410053)]: request netbios name [2025/04/09 07:50:16.633465, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410053):NETBIOS_NAME]: delivered response to client [2025/04/09 07:50:16.633565, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:50:16.633590, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2410053)]: request domain name [2025/04/09 07:50:16.633629, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410053):DOMAIN_NAME]: delivered response to client [2025/04/09 07:50:16.633723, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2410053)] Handling async request: DOMAIN_INFO [2025/04/09 07:50:16.633757, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2410053]: domain_info [ADPROTOCOLX] [2025/04/09 07:50:16.633789, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2410053):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:50:16.633832, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410053):DOMAIN_INFO]: delivered response to client [2025/04/09 07:50:16.633947, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2410053)] Handling async request: PING_DC [2025/04/09 07:50:16.634010, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:16.639263, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:16.639336, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2410053):PING_DC]: NT_STATUS_OK [2025/04/09 07:50:16.639401, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410053):PING_DC]: delivered response to client [2025/04/09 07:50:16.642075, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:50:19.653219, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:50:19.653421, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:19.653457, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410136)]: request interface version (version = 32) [2025/04/09 07:50:19.653515, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410136):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:19.653662, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:19.653689, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410136)]: request interface version (version = 32) [2025/04/09 07:50:19.653731, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410136):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:19.653840, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:50:19.653865, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2410136)]: request misc info [2025/04/09 07:50:19.653916, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410136):INFO]: delivered response to client [2025/04/09 07:50:19.654030, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:50:19.654071, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2410136)]: request netbios name [2025/04/09 07:50:19.654126, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410136):NETBIOS_NAME]: delivered response to client [2025/04/09 07:50:19.654232, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:50:19.654268, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2410136)]: request domain name [2025/04/09 07:50:19.654312, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410136):DOMAIN_NAME]: delivered response to client [2025/04/09 07:50:19.654486, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2410136)] Handling async request: DOMAIN_INFO [2025/04/09 07:50:19.654516, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2410136]: domain_info [ADPROTOCOLX] [2025/04/09 07:50:19.654558, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2410136):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:50:19.654614, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410136):DOMAIN_INFO]: delivered response to client [2025/04/09 07:50:19.654729, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2410136)] Handling async request: PING_DC [2025/04/09 07:50:19.654767, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:19.658026, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:19.658099, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2410136):PING_DC]: NT_STATUS_OK [2025/04/09 07:50:19.658147, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410136):PING_DC]: delivered response to client [2025/04/09 07:50:19.659659, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:50:19.662192, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:50:19.662291, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:19.662318, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [nss_winbind (2410137)]: request interface version (version = 32) [2025/04/09 07:50:19.662362, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2410137):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:19.662466, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [nss_winbind (2410137)] Handling async request: GETPWUID [2025/04/09 07:50:19.662494, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:53(winbindd_getpwuid_send) [nss_winbind (2410137)] Winbind external command GETPWUID start. Search UID 10001. [2025/04/09 07:50:19.662519, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:265(wb_xids2sids_send) WB command xids2sids start. Looking up 1 XID(s). [2025/04/09 07:50:19.662608, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain GPFSNMBASH. [2025/04/09 07:50:19.662651, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:50:19.662686, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'GPFSNMBASH' domain_sid : S-1-5-21-421916222-1498683389-1809704761 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:50:19.664032, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_OK [2025/04/09 07:50:19.664132, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:166(wb_xids2sids_dom_done) Processing response for 1 xid(s). [2025/04/09 07:50:19.664156, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:189(wb_xids2sids_dom_done) 0: XID 10001 mapped to SID S-0-0. [2025/04/09 07:50:19.664179, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:66(wb_xids2sids_dom_send) Searching for 1 xid(s) in domain adprotocolx. [2025/04/09 07:50:19.664199, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:106(wb_xids2sids_dom_send) 0: XID 10001 will be looked up via dcerpc_wbint_UnixIDs2Sids_send(). [2025/04/09 07:50:19.664240, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids in: struct wbint_UnixIDs2Sids domain_name : * domain_name : 'adprotocolx' domain_sid : S-1-5-21-3967939894-2044440985-2694731363 num_ids : 0x00000001 (1) xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) [2025/04/09 07:50:27.091979, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_UnixIDs2Sids: struct wbint_UnixIDs2Sids out: struct wbint_UnixIDs2Sids xids: ARRAY(1) xids: struct unixid id : 0x00002711 (10001) type : ID_TYPE_UID (1) sids: ARRAY(1) sids : S-0-0 result : NT_STATUS_HOST_UNREACHABLE [2025/04/09 07:50:27.092109, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:148(wb_xids2sids_dom_done) Domain controller not found. Calling wb_dsgetdcname_send() to get it. [2025/04/09 07:50:27.092137, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:54(wb_dsgetdcname_send) WB command dsgetdcname start. Search domain name adprotocolx and site name (null). [2025/04/09 07:50:27.092177, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:50:27.101554, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:5108(wcache_store_ndr) wcache_store_ndr: could not fetch seqnum for domain ADPROTOCOLX [2025/04/09 07:50:27.101591, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:27.101658, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:133(wb_dsgetdcname_recv) WB command dsgetdcname for adprotocolx end. [2025/04/09 07:50:27.101692, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_dsgetdcname.c:137(wb_dsgetdcname_recv) Failed for adprotocolx with NT_STATUS_NO_LOGON_SERVERS. [2025/04/09 07:50:27.101715, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:408(wb_xids2sids_recv) WB command xids2sids end. [2025/04/09 07:50:27.101734, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/wb_xids2sids.c:410(wb_xids2sids_recv) wb_sids_to_xids failed: NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:27.101768, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:120(winbindd_getpwuid_recv) Could not convert sid (NULL SID): NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:27.101790, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [nss_winbind(2410137):GETPWUID]: NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:27.101860, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_getpwuid.c:78(winbindd_getpwuid_uid2sid_done) Failed with NT_STATUS_NO_LOGON_SERVERS. [2025/04/09 07:50:27.101901, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [nss_winbind(2410137):GETPWUID]: delivered response to client [2025/04/09 07:50:27.101976, 0, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:823(winbind_client_processed) winbind_client_processed: request took 7.439462 seconds [struct process_request_state] ../../source3/winbindd/winbindd.c:439 [2025/04/09 07:50:19.662463] ../../source3/winbindd/winbindd.c:619 [2025/04/09 07:50:27.101925] [7.439462] -> TEVENT_REQ_DONE (2 0)) [struct winbindd_getpwuid_state] ../../source3/winbindd/winbindd_getpwuid.c:43 [2025/04/09 07:50:19.662493] ../../source3/winbindd/winbindd_getpwuid.c:77 [2025/04/09 07:50:27.101766] [7.439273] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct wb_xids2sids_state] ../../source3/winbindd/wb_xids2sids.c:259 [2025/04/09 07:50:19.662519] ../../source3/winbindd/wb_xids2sids.c:352 [2025/04/09 07:50:27.101714] [7.439195] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct wb_parent_idmap_setup_state] ../../source3/winbindd/winbindd_idmap.c:164 [2025/04/09 07:50:19.662601] ../../source3/winbindd/winbindd_idmap.c:175 [2025/04/09 07:50:19.662602] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:50:19.662607] ../../source3/winbindd/wb_xids2sids.c:194 [2025/04/09 07:50:19.664176] [0.001569] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:50:19.662682] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:50:19.664131] [0.001449] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:50:19.662683] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:50:19.664130] [0.001447] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:50:19.662684] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:50:19.664128] [0.001444] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:50:19.662790] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:50:19.664026] [0.001236] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:50:19.662798] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:50:19.664025] [0.001227] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:50:19.662798] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:50:19.664023] [0.001225] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:50:19.662800] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:50:19.662803] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:50:19.662826] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:50:19.664018] [0.001192] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:50:19.662826] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:50:19.662862] [0.000036] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:19.662827] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:19.662860] [0.000033] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:50:19.662863] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:50:19.664017] [0.001154] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:50:19.662863] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:50:19.664015] [0.001152] -> TEVENT_REQ_DONE (2 0)) [struct wb_xids2sids_dom_state] ../../source3/winbindd/wb_xids2sids.c:59 [2025/04/09 07:50:19.664179] ../../source3/winbindd/wb_xids2sids.c:209 [2025/04/09 07:50:27.101712] [7.437533] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct dcerpc_wbint_UnixIDs2Sids_state] librpc/gen_ndr/ndr_winbind_c.c:1254 [2025/04/09 07:50:19.664226] librpc/gen_ndr/ndr_winbind_c.c:1333 [2025/04/09 07:50:27.092107] [7.427881] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_UnixIDs2Sids_r_state] librpc/gen_ndr/ndr_winbind_c.c:1166 [2025/04/09 07:50:19.664227] librpc/gen_ndr/ndr_winbind_c.c:1200 [2025/04/09 07:50:27.092105] [7.427878] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:50:19.664238] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:50:27.092102] [7.427864] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:50:19.664344] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:50:27.091935] [7.427591] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:50:19.664346] ../../source3/winbindd/winbindd_dual_ndr.c:175 [2025/04/09 07:50:27.091933] [7.427587] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:50:19.664346] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:50:27.091929] [7.427583] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:50:19.664348] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:50:19.664351] [0.000003] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:50:19.664357] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:50:27.091906] [7.427549] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:50:19.664358] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:50:19.664391] [0.000033] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:19.664358] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:19.664389] [0.000031] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:50:19.664393] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:50:27.091905] [7.427512] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:50:19.664394] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:50:27.091900] [7.427506] -> TEVENT_REQ_DONE (2 0)) [struct wb_dsgetdcname_state] ../../source3/winbindd/wb_dsgetdcname.c:46 [2025/04/09 07:50:27.092136] ../../source3/winbindd/wb_dsgetdcname.c:119 [2025/04/09 07:50:27.101657] [0.009521] -> TEVENT_REQ_USER_ERROR (3 10483072397370982494)) [struct dcerpc_wbint_DsGetDcName_state] librpc/gen_ndr/ndr_winbind_c.c:3942 [2025/04/09 07:50:27.092171] librpc/gen_ndr/ndr_winbind_c.c:4007 [2025/04/09 07:50:27.101656] [0.009485] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_wbint_DsGetDcName_r_state] librpc/gen_ndr/ndr_winbind_c.c:3854 [2025/04/09 07:50:27.092173] librpc/gen_ndr/ndr_winbind_c.c:3888 [2025/04/09 07:50:27.101655] [0.009482] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_call_state] ../../librpc/rpc/binding_handle.c:371 [2025/04/09 07:50:27.092174] ../../librpc/rpc/binding_handle.c:520 [2025/04/09 07:50:27.101653] [0.009479] -> TEVENT_REQ_DONE (2 0)) [struct dcerpc_binding_handle_raw_call_state] ../../librpc/rpc/binding_handle.c:149 [2025/04/09 07:50:27.092248] ../../librpc/rpc/binding_handle.c:203 [2025/04/09 07:50:27.101589] [0.009341] -> TEVENT_REQ_DONE (2 0)) [struct wbint_bh_raw_call_state] ../../source3/winbindd/winbindd_dual_ndr.c:94 [2025/04/09 07:50:27.092250] ../../source3/winbindd/winbindd_dual_ndr.c:209 [2025/04/09 07:50:27.101587] [0.009337] -> TEVENT_REQ_DONE (2 0)) [struct wb_domain_request_state] ../../source3/winbindd/winbindd_dual.c:508 [2025/04/09 07:50:27.092286] ../../source3/winbindd/winbindd_dual.c:745 [2025/04/09 07:50:27.101539] [0.009253] -> TEVENT_REQ_DONE (2 0)) [struct wb_child_request_state] ../../source3/winbindd/winbindd_dual.c:204 [2025/04/09 07:50:27.092293] ../../source3/winbindd/winbindd_dual.c:306 [2025/04/09 07:50:27.101537] [0.009244] -> TEVENT_REQ_DONE (2 0)) [struct tevent_queue_wait_state] ../../lib/tevent/tevent_queue.c:409 [2025/04/09 07:50:27.092295] ../../lib/tevent/tevent_queue.c:429 [2025/04/09 07:50:27.092296] [0.000001] -> TEVENT_REQ_DONE (2 0)) [struct wb_simple_trans_state] ../../nsswitch/wb_reqtrans.c:375 [2025/04/09 07:50:27.092309] ../../nsswitch/wb_reqtrans.c:432 [2025/04/09 07:50:27.101531] [0.009222] -> TEVENT_REQ_DONE (2 0)) [struct req_write_state] ../../nsswitch/wb_reqtrans.c:158 [2025/04/09 07:50:27.092315] ../../nsswitch/wb_reqtrans.c:194 [2025/04/09 07:50:27.092354] [0.000039] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:27.092317] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:27.092352] [0.000035] -> TEVENT_REQ_DONE (2 0)) [struct resp_read_state] ../../nsswitch/wb_reqtrans.c:222 [2025/04/09 07:50:27.092357] ../../nsswitch/wb_reqtrans.c:275 [2025/04/09 07:50:27.101530] [0.009173] -> TEVENT_REQ_DONE (2 0)) [struct read_packet_state] ../../lib/async_req/async_sock.c:468 [2025/04/09 07:50:27.092358] ../../lib/async_req/async_sock.c:556 [2025/04/09 07:50:27.101528] [0.009170] -> TEVENT_REQ_DONE (2 0)) [struct resp_write_state] ../../nsswitch/wb_reqtrans.c:307 [2025/04/09 07:50:27.101824] ../../nsswitch/wb_reqtrans.c:344 [2025/04/09 07:50:27.101899] [0.000075] -> TEVENT_REQ_DONE (2 0)) [struct writev_state] ../../lib/async_req/async_sock.c:268 [2025/04/09 07:50:27.101826] ../../lib/async_req/async_sock.c:376 [2025/04/09 07:50:27.101850] [0.000024] -> TEVENT_REQ_DONE (2 0)) [2025/04/09 07:50:27.105607, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:50:31.597017, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:50:31.597185, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:31.597229, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410359)]: request interface version (version = 32) [2025/04/09 07:50:31.597280, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410359):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:31.597401, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:50:31.597436, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2410359)]: ping [2025/04/09 07:50:31.597488, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410359):PING]: delivered response to client [2025/04/09 07:50:31.599217, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:50:31.619937, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:50:31.620023, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:50:31.620180, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:50:31.620207, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:50:31.620246, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:50:31.620267, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline [2025/04/09 07:50:31.620291, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:50:31.620314, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* [2025/04/09 07:50:31.620450, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:51:24 AM 2025 EDT]) [2025/04/09 07:50:31.620512, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], value=[c0000017], timeout=[Wed Apr 9 07:51:24 AM 2025 EDT]) [2025/04/09 07:50:31.620543, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com]) [2025/04/09 07:50:31.620659, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX [2025/04/09 07:50:31.620685, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* [2025/04/09 07:50:31.620818, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:51:24 AM 2025 EDT]) [2025/04/09 07:50:31.620849, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], value=[c0000017], timeout=[Wed Apr 9 07:51:24 AM 2025 EDT]) [2025/04/09 07:50:31.620876, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com]) [2025/04/09 07:50:31.620925, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM [2025/04/09 07:50:31.620994, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:31.621131, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:31.621157, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410368)]: request interface version (version = 32) [2025/04/09 07:50:31.621205, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410368):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:31.622331, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:31.622361, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410368)]: request interface version (version = 32) [2025/04/09 07:50:31.622404, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410368):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:31.622531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:50:31.622569, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2410368)]: request misc info [2025/04/09 07:50:31.622609, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410368):INFO]: delivered response to client [2025/04/09 07:50:31.622716, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:50:31.622742, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2410368)]: request netbios name [2025/04/09 07:50:31.622793, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410368):NETBIOS_NAME]: delivered response to client [2025/04/09 07:50:31.623945, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:31.624027, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com [2025/04/09 07:50:31.624115, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:50:31.624141, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2410368)]: request domain name [2025/04/09 07:50:31.624187, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410368):DOMAIN_NAME]: delivered response to client [2025/04/09 07:50:31.624285, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2410368)] Handling async request: DOMAIN_INFO [2025/04/09 07:50:31.624312, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2410368]: domain_info [ADPROTOCOLX] [2025/04/09 07:50:31.624341, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2410368):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:50:31.624383, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410368):DOMAIN_INFO]: delivered response to client [2025/04/09 07:50:31.624503, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2410368)] Handling async request: PING_DC [2025/04/09 07:50:31.624536, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:31.626801, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:31.626880, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2410368):PING_DC]: NT_STATUS_OK [2025/04/09 07:50:31.626950, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410368):PING_DC]: delivered response to client [2025/04/09 07:50:31.629827, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:50:46.589219, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:50:46.589429, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:46.589467, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410802)]: request interface version (version = 32) [2025/04/09 07:50:46.589535, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410802):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:46.590490, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:50:46.590521, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2410802)]: ping [2025/04/09 07:50:46.590575, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410802):PING]: delivered response to client [2025/04/09 07:50:46.595044, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:50:46.622086, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:50:46.622201, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:46.622238, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410807)]: request interface version (version = 32) [2025/04/09 07:50:46.622288, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410807):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:46.626945, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:50:46.626996, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2410807)]: request interface version (version = 32) [2025/04/09 07:50:46.627050, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410807):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:50:46.627817, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:50:46.627846, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2410807)]: request misc info [2025/04/09 07:50:46.627913, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410807):INFO]: delivered response to client [2025/04/09 07:50:46.630747, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:50:46.630784, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2410807)]: request netbios name [2025/04/09 07:50:46.630836, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410807):NETBIOS_NAME]: delivered response to client [2025/04/09 07:50:46.630936, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:50:46.630983, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2410807)]: request domain name [2025/04/09 07:50:46.631027, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410807):DOMAIN_NAME]: delivered response to client [2025/04/09 07:50:46.631145, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2410807)] Handling async request: DOMAIN_INFO [2025/04/09 07:50:46.631177, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2410807]: domain_info [ADPROTOCOLX] [2025/04/09 07:50:46.631233, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2410807):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:50:46.631292, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410807):DOMAIN_INFO]: delivered response to client [2025/04/09 07:50:46.632016, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2410807)] Handling async request: PING_DC [2025/04/09 07:50:46.632106, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:46.635817, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:46.635899, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2410807):PING_DC]: NT_STATUS_OK [2025/04/09 07:50:46.635967, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2410807):PING_DC]: delivered response to client [2025/04/09 07:50:46.637360, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:01.586275, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:51:01.586489, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:01.586523, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411105)]: request interface version (version = 32) [2025/04/09 07:51:01.586588, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411105):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:01.587193, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:51:01.587245, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2411105)]: ping [2025/04/09 07:51:01.587318, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411105):PING]: delivered response to client [2025/04/09 07:51:01.593820, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:01.620718, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:51:01.620825, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:01.620851, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411111)]: request interface version (version = 32) [2025/04/09 07:51:01.620897, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411111):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:01.621031, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:01.621060, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411111)]: request interface version (version = 32) [2025/04/09 07:51:01.621102, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411111):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:01.621140, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:51:01.621202, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:51:01.621232, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:51:01.621257, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:51:01.621276, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline [2025/04/09 07:51:01.621298, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:51:01.621342, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* [2025/04/09 07:51:01.621688, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX [2025/04/09 07:51:01.621715, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* [2025/04/09 07:51:01.621872, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM [2025/04/09 07:51:01.621943, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:51:01.622170, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:51:01.622202, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2411111)]: request misc info [2025/04/09 07:51:01.622251, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411111):INFO]: delivered response to client [2025/04/09 07:51:01.622345, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:51:01.622370, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2411111)]: request netbios name [2025/04/09 07:51:01.622409, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411111):NETBIOS_NAME]: delivered response to client [2025/04/09 07:51:01.622501, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:51:01.622526, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2411111)]: request domain name [2025/04/09 07:51:01.622566, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411111):DOMAIN_NAME]: delivered response to client [2025/04/09 07:51:01.623826, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2411111)] Handling async request: DOMAIN_INFO [2025/04/09 07:51:01.623870, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2411111]: domain_info [ADPROTOCOLX] [2025/04/09 07:51:01.623918, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2411111):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:51:01.623999, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411111):DOMAIN_INFO]: delivered response to client [2025/04/09 07:51:01.624128, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2411111)] Handling async request: PING_DC [2025/04/09 07:51:01.624170, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:51:01.626615, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:51:01.626698, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com [2025/04/09 07:51:01.626757, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:51:01.626832, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2411111):PING_DC]: NT_STATUS_OK [2025/04/09 07:51:01.626877, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411111):PING_DC]: delivered response to client [2025/04/09 07:51:01.628257, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:07.032461, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b [2025/04/09 07:51:07.032536, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2405698 [2025/04/09 07:51:07.032583, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was offline, marking as online now! [2025/04/09 07:51:07.042212, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) wb_child_request_orphaned: cleanup orphaned subreq[0x55cf8259d020] [2025/04/09 07:51:16.601693, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:51:16.601849, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:16.601876, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411417)]: request interface version (version = 32) [2025/04/09 07:51:16.601923, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411417):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:16.602239, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:51:16.602270, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2411417)]: ping [2025/04/09 07:51:16.602311, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411417):PING]: delivered response to client [2025/04/09 07:51:16.604360, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:16.627104, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:51:16.628042, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:16.628090, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411424)]: request interface version (version = 32) [2025/04/09 07:51:16.628141, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411424):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:16.628253, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:16.628279, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411424)]: request interface version (version = 32) [2025/04/09 07:51:16.628317, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411424):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:16.628427, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:51:16.628450, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2411424)]: request misc info [2025/04/09 07:51:16.628489, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411424):INFO]: delivered response to client [2025/04/09 07:51:16.628579, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:51:16.628603, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2411424)]: request netbios name [2025/04/09 07:51:16.628641, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411424):NETBIOS_NAME]: delivered response to client [2025/04/09 07:51:16.628774, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:51:16.628798, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2411424)]: request domain name [2025/04/09 07:51:16.628836, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411424):DOMAIN_NAME]: delivered response to client [2025/04/09 07:51:16.628990, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2411424)] Handling async request: DOMAIN_INFO [2025/04/09 07:51:16.629021, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2411424]: domain_info [ADPROTOCOLX] [2025/04/09 07:51:16.629067, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2411424):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:51:16.629121, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411424):DOMAIN_INFO]: delivered response to client [2025/04/09 07:51:16.629270, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2411424)] Handling async request: PING_DC [2025/04/09 07:51:16.629324, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:51:16.634659, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:51:16.634743, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2411424):PING_DC]: NT_STATUS_OK [2025/04/09 07:51:16.634792, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411424):PING_DC]: delivered response to client [2025/04/09 07:51:16.637813, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:31.616791, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:51:31.616926, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:31.616999, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411727)]: request interface version (version = 32) [2025/04/09 07:51:31.617064, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411727):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:31.617220, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:51:31.617245, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2411727)]: ping [2025/04/09 07:51:31.617288, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411727):PING]: delivered response to client [2025/04/09 07:51:31.618489, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:31.626099, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:51:31.626184, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:51:31.626210, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:51:31.626236, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:51:31.626256, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:51:31.626286, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:51:31.639926, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:51:31.640049, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:31.640077, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411736)]: request interface version (version = 32) [2025/04/09 07:51:31.640132, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411736):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:31.640237, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:31.640263, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2411736)]: request interface version (version = 32) [2025/04/09 07:51:31.640304, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411736):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:31.640400, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:51:31.640425, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2411736)]: request misc info [2025/04/09 07:51:31.640483, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411736):INFO]: delivered response to client [2025/04/09 07:51:31.640590, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:51:31.640622, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2411736)]: request netbios name [2025/04/09 07:51:31.640692, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411736):NETBIOS_NAME]: delivered response to client [2025/04/09 07:51:31.640820, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:51:31.640847, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2411736)]: request domain name [2025/04/09 07:51:31.640887, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411736):DOMAIN_NAME]: delivered response to client [2025/04/09 07:51:31.641030, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2411736)] Handling async request: DOMAIN_INFO [2025/04/09 07:51:31.641071, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2411736]: domain_info [ADPROTOCOLX] [2025/04/09 07:51:31.641126, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2411736):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:51:31.641172, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411736):DOMAIN_INFO]: delivered response to client [2025/04/09 07:51:31.641272, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2411736)] Handling async request: PING_DC [2025/04/09 07:51:31.641314, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:51:31.646310, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:51:31.646379, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2411736):PING_DC]: NT_STATUS_OK [2025/04/09 07:51:31.646427, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2411736):PING_DC]: delivered response to client [2025/04/09 07:51:31.649199, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:47.105711, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:51:47.105930, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:47.105988, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412183)]: request interface version (version = 32) [2025/04/09 07:51:47.106043, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412183):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:47.106200, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:51:47.106227, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2412183)]: ping [2025/04/09 07:51:47.106268, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412183):PING]: delivered response to client [2025/04/09 07:51:47.107444, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:47.128245, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:51:47.128353, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:47.128381, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412189)]: request interface version (version = 32) [2025/04/09 07:51:47.128427, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412189):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:47.128531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:51:47.128557, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412189)]: request interface version (version = 32) [2025/04/09 07:51:47.128600, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412189):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:51:47.128698, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:51:47.128735, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2412189)]: request misc info [2025/04/09 07:51:47.128780, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412189):INFO]: delivered response to client [2025/04/09 07:51:47.128877, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:51:47.128903, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2412189)]: request netbios name [2025/04/09 07:51:47.128944, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412189):NETBIOS_NAME]: delivered response to client [2025/04/09 07:51:47.129076, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:51:47.129103, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2412189)]: request domain name [2025/04/09 07:51:47.129143, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412189):DOMAIN_NAME]: delivered response to client [2025/04/09 07:51:47.129244, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2412189)] Handling async request: DOMAIN_INFO [2025/04/09 07:51:47.129272, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2412189]: domain_info [ADPROTOCOLX] [2025/04/09 07:51:47.129351, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2412189):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:51:47.129417, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412189):DOMAIN_INFO]: delivered response to client [2025/04/09 07:51:47.129521, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2412189)] Handling async request: PING_DC [2025/04/09 07:51:47.129594, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:51:47.134374, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:51:47.134453, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2412189):PING_DC]: NT_STATUS_OK [2025/04/09 07:51:47.134528, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412189):PING_DC]: delivered response to client [2025/04/09 07:51:47.135019, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:51:50.042140, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40b [2025/04/09 07:51:50.042259, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40b len 12 (num_fds:0) from 1:2398754 [2025/04/09 07:51:50.042314, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:149(winbind_msg_domain_online) winbind_msg_domain_online: Domain ADPROTOCOLX was online, marking as online now! [2025/04/09 07:52:01.608408, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:52:01.608575, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:01.608610, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412341)]: request interface version (version = 32) [2025/04/09 07:52:01.608668, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412341):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:01.610054, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:52:01.610097, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2412341)]: ping [2025/04/09 07:52:01.610147, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412341):PING]: delivered response to client [2025/04/09 07:52:01.611385, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:52:01.627017, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:52:01.627089, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:52:01.627117, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:52:01.627143, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:52:01.627162, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:52:01.627186, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:52:01.632940, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:52:01.633062, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:01.633090, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412347)]: request interface version (version = 32) [2025/04/09 07:52:01.633137, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412347):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:01.634558, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:01.634592, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412347)]: request interface version (version = 32) [2025/04/09 07:52:01.634639, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412347):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:01.634748, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:52:01.634790, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2412347)]: request misc info [2025/04/09 07:52:01.634834, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412347):INFO]: delivered response to client [2025/04/09 07:52:01.635331, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:52:01.635364, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2412347)]: request netbios name [2025/04/09 07:52:01.635416, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412347):NETBIOS_NAME]: delivered response to client [2025/04/09 07:52:01.635517, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:52:01.635544, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2412347)]: request domain name [2025/04/09 07:52:01.635584, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412347):DOMAIN_NAME]: delivered response to client [2025/04/09 07:52:01.635690, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2412347)] Handling async request: DOMAIN_INFO [2025/04/09 07:52:01.635725, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2412347]: domain_info [ADPROTOCOLX] [2025/04/09 07:52:01.635755, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2412347):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:52:01.635817, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412347):DOMAIN_INFO]: delivered response to client [2025/04/09 07:52:01.635923, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2412347)] Handling async request: PING_DC [2025/04/09 07:52:01.636003, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:52:01.640211, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:52:01.640282, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2412347):PING_DC]: NT_STATUS_OK [2025/04/09 07:52:01.640341, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412347):PING_DC]: delivered response to client [2025/04/09 07:52:01.641942, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:52:05.045526, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) wb_child_request_orphaned: cleanup orphaned subreq[0x55cf825d5f00] [2025/04/09 07:52:16.634669, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:52:16.634908, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:16.634945, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412662)]: request interface version (version = 32) [2025/04/09 07:52:16.635059, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412662):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:16.642292, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:52:16.642347, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2412662)]: ping [2025/04/09 07:52:16.642397, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412662):PING]: delivered response to client [2025/04/09 07:52:16.648291, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:52:16.668103, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:52:16.668271, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:16.668301, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412676)]: request interface version (version = 32) [2025/04/09 07:52:16.668346, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412676):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:16.668442, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:16.668469, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412676)]: request interface version (version = 32) [2025/04/09 07:52:16.668509, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412676):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:16.668606, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:52:16.668632, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2412676)]: request misc info [2025/04/09 07:52:16.668686, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412676):INFO]: delivered response to client [2025/04/09 07:52:16.668811, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:52:16.668838, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2412676)]: request netbios name [2025/04/09 07:52:16.668891, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412676):NETBIOS_NAME]: delivered response to client [2025/04/09 07:52:16.669048, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:52:16.669079, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2412676)]: request domain name [2025/04/09 07:52:16.669121, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412676):DOMAIN_NAME]: delivered response to client [2025/04/09 07:52:16.669229, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2412676)] Handling async request: DOMAIN_INFO [2025/04/09 07:52:16.669271, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2412676]: domain_info [ADPROTOCOLX] [2025/04/09 07:52:16.669344, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2412676):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:52:16.669404, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412676):DOMAIN_INFO]: delivered response to client [2025/04/09 07:52:16.669518, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2412676)] Handling async request: PING_DC [2025/04/09 07:52:16.669580, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:52:16.672500, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:52:16.672581, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2412676):PING_DC]: NT_STATUS_OK [2025/04/09 07:52:16.672633, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412676):PING_DC]: delivered response to client [2025/04/09 07:52:16.673946, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:52:31.613060, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:52:31.618721, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:31.618761, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412969)]: request interface version (version = 32) [2025/04/09 07:52:31.618811, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412969):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:31.618931, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:52:31.618983, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2412969)]: ping [2025/04/09 07:52:31.619028, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412969):PING]: delivered response to client [2025/04/09 07:52:31.624888, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:52:31.635813, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:52:31.635904, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:52:31.635944, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:52:31.635991, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:52:31.636013, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is online [2025/04/09 07:52:31.636037, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:52:31.645212, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:52:31.646307, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:31.646341, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412980)]: request interface version (version = 32) [2025/04/09 07:52:31.646392, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412980):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:31.646516, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:31.646543, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2412980)]: request interface version (version = 32) [2025/04/09 07:52:31.646584, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412980):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:31.646679, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:52:31.646704, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2412980)]: request misc info [2025/04/09 07:52:31.646766, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412980):INFO]: delivered response to client [2025/04/09 07:52:31.647177, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:52:31.647210, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2412980)]: request netbios name [2025/04/09 07:52:31.647263, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412980):NETBIOS_NAME]: delivered response to client [2025/04/09 07:52:31.647356, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:52:31.647406, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2412980)]: request domain name [2025/04/09 07:52:31.647447, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412980):DOMAIN_NAME]: delivered response to client [2025/04/09 07:52:31.647550, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2412980)] Handling async request: DOMAIN_INFO [2025/04/09 07:52:31.647577, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2412980]: domain_info [ADPROTOCOLX] [2025/04/09 07:52:31.647624, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2412980):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:52:31.647669, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412980):DOMAIN_INFO]: delivered response to client [2025/04/09 07:52:31.647777, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2412980)] Handling async request: PING_DC [2025/04/09 07:52:31.647833, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:52:31.650691, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:52:31.650775, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2412980):PING_DC]: NT_STATUS_OK [2025/04/09 07:52:31.650832, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2412980):PING_DC]: delivered response to client [2025/04/09 07:52:31.654124, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:52:33.045458, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source4/lib/messaging/messaging.c:806(imessaging_dgm_recv) imessaging_dgm_recv: dst 1:2398430 matches my id: 1:2398430, type=0x40c [2025/04/09 07:52:33.045540, 10, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/lib/messages.c:423(messaging_recv_cb) messaging_recv_cb: Received message 0x40c len 12 (num_fds:0) from 1:2405715 [2025/04/09 07:52:33.045592, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:126(winbind_msg_domain_offline) winbind_msg_domain_offline: Domain ADPROTOCOLX was online, change to offline now. [2025/04/09 07:52:33.045663, 1, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:314(wb_child_request_orphaned) wb_child_request_orphaned: cleanup orphaned subreq[0x55cf825d1cc0] [2025/04/09 07:52:46.627121, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:52:46.628253, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:46.628289, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2413274)]: request interface version (version = 32) [2025/04/09 07:52:46.628338, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413274):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:46.628471, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:52:46.628497, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2413274)]: ping [2025/04/09 07:52:46.628536, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413274):PING]: delivered response to client [2025/04/09 07:52:46.630646, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:52:46.649394, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:52:46.649483, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:46.649509, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2413282)]: request interface version (version = 32) [2025/04/09 07:52:46.649553, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413282):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:46.649657, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:52:46.649682, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2413282)]: request interface version (version = 32) [2025/04/09 07:52:46.649739, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413282):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:52:46.649841, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:52:46.649865, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2413282)]: request misc info [2025/04/09 07:52:46.649916, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413282):INFO]: delivered response to client [2025/04/09 07:52:46.650030, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:52:46.650058, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2413282)]: request netbios name [2025/04/09 07:52:46.650118, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413282):NETBIOS_NAME]: delivered response to client [2025/04/09 07:52:46.650215, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:52:46.650239, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2413282)]: request domain name [2025/04/09 07:52:46.650277, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413282):DOMAIN_NAME]: delivered response to client [2025/04/09 07:52:46.650368, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2413282)] Handling async request: DOMAIN_INFO [2025/04/09 07:52:46.650394, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2413282]: domain_info [ADPROTOCOLX] [2025/04/09 07:52:46.650441, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2413282):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:52:46.650486, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413282):DOMAIN_INFO]: delivered response to client [2025/04/09 07:52:46.650582, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2413282)] Handling async request: PING_DC [2025/04/09 07:52:46.650618, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:52:46.654184, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:52:46.654253, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2413282):PING_DC]: NT_STATUS_OK [2025/04/09 07:52:46.654301, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413282):PING_DC]: delivered response to client [2025/04/09 07:52:46.656673, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:53:01.616058, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:53:01.616266, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:01.616294, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2413715)]: request interface version (version = 32) [2025/04/09 07:53:01.616339, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413715):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:01.616468, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:53:01.616493, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2413715)]: ping [2025/04/09 07:53:01.616531, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413715):PING]: delivered response to client [2025/04/09 07:53:01.618605, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:53:01.645030, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:53:01.645136, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:53:01.645240, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:53:01.645265, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:53:01.645289, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:53:01.645308, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline [2025/04/09 07:53:01.645330, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:53:01.645355, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* [2025/04/09 07:53:01.645627, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:53:33 AM 2025 EDT]) [2025/04/09 07:53:01.645692, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com], value=[c000020d], timeout=[Wed Apr 9 07:53:33 AM 2025 EDT]) [2025/04/09 07:53:01.645723, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com]) [2025/04/09 07:53:01.645886, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX [2025/04/09 07:53:01.645913, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* [2025/04/09 07:53:01.646083, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:649(gencache_iterate_blobs_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], timeout=[Wed Apr 9 07:53:33 AM 2025 EDT]) [2025/04/09 07:53:01.646141, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:721(gencache_iterate_fn) Calling function with arguments (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com], value=[c000020d], timeout=[Wed Apr 9 07:53:33 AM 2025 EDT]) [2025/04/09 07:53:01.646171, 10, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com]) [2025/04/09 07:53:01.646220, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM [2025/04/09 07:53:01.646301, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:01.646455, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:01.646481, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2413720)]: request interface version (version = 32) [2025/04/09 07:53:01.646524, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413720):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:01.647033, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:01.647064, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2413720)]: request interface version (version = 32) [2025/04/09 07:53:01.647106, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413720):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:01.647200, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:53:01.647234, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2413720)]: request misc info [2025/04/09 07:53:01.647276, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413720):INFO]: delivered response to client [2025/04/09 07:53:01.647707, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:53:01.647735, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2413720)]: request netbios name [2025/04/09 07:53:01.647782, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413720):NETBIOS_NAME]: delivered response to client [2025/04/09 07:53:01.647876, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:53:01.647900, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2413720)]: request domain name [2025/04/09 07:53:01.647938, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413720):DOMAIN_NAME]: delivered response to client [2025/04/09 07:53:01.648061, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2413720)] Handling async request: DOMAIN_INFO [2025/04/09 07:53:01.648088, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2413720]: domain_info [ADPROTOCOLX] [2025/04/09 07:53:01.648128, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2413720):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:53:01.648180, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413720):DOMAIN_INFO]: delivered response to client [2025/04/09 07:53:01.648277, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2413720)] Handling async request: PING_DC [2025/04/09 07:53:01.648317, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:01.653217, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:01.653284, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2413720):PING_DC]: NT_STATUS_OK [2025/04/09 07:53:01.653330, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2413720):PING_DC]: delivered response to client [2025/04/09 07:53:01.653397, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:01.653467, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com [2025/04/09 07:53:01.657165, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:53:16.641264, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:53:16.642311, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:16.642357, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2414025)]: request interface version (version = 32) [2025/04/09 07:53:16.642421, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414025):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:16.642536, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:53:16.642562, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2414025)]: ping [2025/04/09 07:53:16.642601, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414025):PING]: delivered response to client [2025/04/09 07:53:16.644792, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:53:16.664616, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:53:16.664759, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:16.664786, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2414034)]: request interface version (version = 32) [2025/04/09 07:53:16.664841, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414034):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:16.664944, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:16.664996, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2414034)]: request interface version (version = 32) [2025/04/09 07:53:16.665039, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414034):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:16.665139, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:53:16.665181, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2414034)]: request misc info [2025/04/09 07:53:16.665245, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414034):INFO]: delivered response to client [2025/04/09 07:53:16.665389, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:53:16.665414, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2414034)]: request netbios name [2025/04/09 07:53:16.665460, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414034):NETBIOS_NAME]: delivered response to client [2025/04/09 07:53:16.665550, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:53:16.665574, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2414034)]: request domain name [2025/04/09 07:53:16.665612, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414034):DOMAIN_NAME]: delivered response to client [2025/04/09 07:53:16.665703, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2414034)] Handling async request: DOMAIN_INFO [2025/04/09 07:53:16.665729, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2414034]: domain_info [ADPROTOCOLX] [2025/04/09 07:53:16.665791, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2414034):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:53:16.665847, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414034):DOMAIN_INFO]: delivered response to client [2025/04/09 07:53:16.665943, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2414034)] Handling async request: PING_DC [2025/04/09 07:53:16.666030, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:16.669754, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:16.669831, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2414034):PING_DC]: NT_STATUS_OK [2025/04/09 07:53:16.669887, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414034):PING_DC]: delivered response to client [2025/04/09 07:53:16.672656, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:53:31.641086, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:53:31.641286, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:31.641319, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2414326)]: request interface version (version = 32) [2025/04/09 07:53:31.641383, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414326):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:31.641932, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn PING [2025/04/09 07:53:31.642006, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:333(winbindd_ping) winbindd_ping: [wbinfo (2414326)]: ping [2025/04/09 07:53:31.642065, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414326):PING]: delivered response to client [2025/04/09 07:53:31.644696, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited [2025/04/09 07:53:31.655342, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain BUILTIN is online [2025/04/09 07:53:31.655615, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:53:31.655651, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain GPFSNMBASH is online [2025/04/09 07:53:31.655678, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:53:31.655698, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:715(winbindd_ping_offline_domains) winbindd_ping_offline_domains: Domain ADPROTOCOLX is offline [2025/04/09 07:53:31.655721, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:53:31.655773, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX,* [2025/04/09 07:53:31.656171, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX [2025/04/09 07:53:31.656205, 5, pid=2398430, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:669(gencache_iterate_blobs) Searching cache keys with pattern NEG_CONN_CACHE/ADPROTOCOLX.COM,* [2025/04/09 07:53:31.656357, 8, pid=2398430, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:222(flush_negative_conn_cache_for_domain) flush_negative_conn_cache_for_domain: flushed domain ADPROTOCOLX.COM [2025/04/09 07:53:31.656445, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:31.663997, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:31.664072, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_util.c:780(wbd_ping_dc_done) wbd_ping_dc_done: dcerpc_wbint_PingDc_recv() succeeded, domain: ADPROTOCOLX, dc-name: windc2.adprotocolx.com [2025/04/09 07:53:31.673526, 5, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:677(new_connection) Accepted client socket 27 [2025/04/09 07:53:31.673600, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:31.673624, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2414343)]: request interface version (version = 32) [2025/04/09 07:53:31.673667, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414343):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:31.673759, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INTERFACE_VERSION [2025/04/09 07:53:31.673784, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:358(winbindd_interface_version) winbindd_interface_version: [wbinfo (2414343)]: request interface version (version = 32) [2025/04/09 07:53:31.673826, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414343):INTERFACE_VERSION]: delivered response to client [2025/04/09 07:53:31.673918, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn INFO [2025/04/09 07:53:31.673942, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:344(winbindd_info) winbindd_info: [wbinfo (2414343)]: request misc info [2025/04/09 07:53:31.674019, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414343):INFO]: delivered response to client [2025/04/09 07:53:31.674114, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn NETBIOS_NAME [2025/04/09 07:53:31.674139, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:382(winbindd_netbios_name) winbindd_netbios_name: [wbinfo (2414343)]: request netbios name [2025/04/09 07:53:31.674177, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414343):NETBIOS_NAME]: delivered response to client [2025/04/09 07:53:31.674268, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:526(process_request_send) process_request_send: process_request: request fn DOMAIN_NAME [2025/04/09 07:53:31.674292, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_misc.c:370(winbindd_domain_name) winbindd_domain_name: [wbinfo (2414343)]: request domain name [2025/04/09 07:53:31.674335, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414343):DOMAIN_NAME]: delivered response to client [2025/04/09 07:53:31.674427, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2414343)] Handling async request: DOMAIN_INFO [2025/04/09 07:53:31.674471, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_domain_info.c:50(winbindd_domain_info_send) [2414343]: domain_info [ADPROTOCOLX] [2025/04/09 07:53:31.674517, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2414343):DOMAIN_INFO]: NT_STATUS_OK [2025/04/09 07:53:31.674561, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414343):DOMAIN_INFO]: delivered response to client [2025/04/09 07:53:31.674672, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:500(process_request_send) process_request_send: [wbinfo (2414343)] Handling async request: PING_DC [2025/04/09 07:53:31.674712, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:31.676763, 1, pid=2398430, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:31.676828, 3, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:568(process_request_done) process_request_done: [wbinfo(2414343):PING_DC]: NT_STATUS_OK [2025/04/09 07:53:31.676874, 10, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:612(process_request_written) process_request_written: [wbinfo(2414343):PING_DC]: delivered response to client [2025/04/09 07:53:31.679607, 6, pid=2398430, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd.c:726(winbind_client_request_read) closing socket 27, client exited Logs name: log.wb-ADPROTOCOLX.scenario3 ======================== [2025/04/09 07:45:31.561055, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:45:31.561123, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:45:31.561278, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:31.561449, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:45:31.561625, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001b (27) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:31.561845, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:31.562017, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:31.562126, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:31.565688, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:45:31.565741, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000001b (27) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] DB 9B D5 1D BF 78 1B D6 CC AE 64 E9 43 6D 5C 15 .....x.. ..d.Cm\. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 02 2B C4 94 BA AD D0 4D B7 C5 B4 C6 85 FF 9A 7B .+.....M .......{ [0030] 73 EC B6 E9 A5 8F C3 2D 00 00 00 00 00 00 00 00 s......- ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:45:31.566039, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:31.566065, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:45:31.566084, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:31.566120, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:45:31.566143, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:45:31.566170, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:45:31.566200, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:45:31.566304, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:45:31.566335, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:31.566406, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:45:31.566427, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:45:44.814224, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:45:44.814337, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:45:44.814439, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:44.814542, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:45:44.814663, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000001c (28) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:44.814882, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:44.815056, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:44.815134, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:44.816169, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:45:44.816217, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000001c (28) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 7D 48 09 30 32 C3 86 A8 8C E4 67 33 09 C1 AE 04 }H.02... ..g3.... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 08 24 67 39 3E 7A F2 20 6F 84 74 FC D8 3D AD A7 .$g9>z. o.t..=.. [0030] 11 B8 44 5C 56 98 91 E5 00 00 00 00 00 00 00 00 ..D\V... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:45:44.816488, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:44.816511, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:45:44.816531, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:44.816563, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:45:44.816585, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:45:44.816613, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:45:44.816644, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:45:44.816732, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:45:44.816755, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:44.816814, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:45:44.816834, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:45:44.832707, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:45:44.832756, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:45:44.832780, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:45:44.832841, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:44.832921, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:45:44.832975, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:45:44.833013, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:45:44.833040, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:45:44.833077, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:203(winbindd_domain_init_backend) winbindd_domain_init_backend: Setting MS-RPC methods for domain ADPROTOCOLX [2025/04/09 07:45:44.833114, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:45:44.833547, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:44.834803, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 07:45:44.834870, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc1.adprotocolx.com auth_type 9, auth_level 6 [2025/04/09 07:45:44.834912, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 07:45:44.835009, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 07:45:44.841421, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55cf82595480]: subreq: 0x55cf825a79f0 [2025/04/09 07:45:44.841454, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55cf825cca90]: subreq: 0x55cf8258ff90 [2025/04/09 07:45:44.841488, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55cf82595480]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825a79f0/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] [2025/04/09 07:45:44.841578, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55cf825cca90]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf8258ff90/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf82590170)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] [2025/04/09 07:45:44.841618, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=2887 [0000] 60 82 0B 43 06 06 2B 06 01 05 05 02 A0 82 0B 37 `..C..+. .......7 [0010] 30 82 0B 33 A0 24 30 22 06 09 2A 86 48 82 F7 12 0..3.$0" ..*.H... [0020] 01 02 02 06 09 2A 86 48 86 F7 12 01 02 02 06 0A .....*.H ........ [0030] 2B 06 01 04 01 82 37 02 02 0A A2 82 0B 09 04 82 +.....7. ........ [0040] 0B 05 6E 82 0B 01 30 82 0A FD A0 03 02 01 05 A1 ..n...0. ........ [0050] 03 02 01 0E A2 07 03 05 00 20 00 00 00 A3 82 04 ........ . ...... [0060] 4C 61 82 04 48 30 82 04 44 A0 03 02 01 05 A1 11 La..H0.. D....... [0070] 1B 0F 41 44 50 52 4F 54 4F 43 4F 4C 58 2E 43 4F ..ADPROT OCOLX.CO [0080] 4D A2 29 30 27 A0 03 02 01 01 A1 20 30 1E 1B 04 M.)0'... ... 0... [0090] 68 6F 73 74 1B 16 77 69 6E 64 63 31 2E 61 64 70 host..wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 2E 63 6F 6D A3 82 03 FD rotocolx .com.... [00B0] 30 82 03 F9 A0 03 02 01 12 A1 03 02 01 03 A2 82 0....... ........ [00C0] 03 EB 04 82 03 E7 06 1F 8F 84 74 CE 99 4A 3D 11 ........ ..t..J=. [00D0] 93 20 46 0C AA A0 44 62 76 31 3E FA D7 52 8C EA . F...Db v1>..R.. [00E0] 8D F3 05 CE A6 76 84 C4 2C BC DB 1D 92 97 B5 F6 .....v.. ,....... [00F0] BF 7B 85 BF EF 76 1B 99 1F CA BB 30 0A C0 B7 45 .{...v.. ...0...E [0100] D7 81 FF 33 26 AD 92 6D 08 95 8C 6F 2E D3 ED 1B ...3&..m ...o.... [0110] 48 8E 7D E2 AD 61 FB 69 C8 04 F1 90 DF 10 80 61 H.}..a.i .......a [0120] 55 40 95 9B D6 48 55 D4 A9 E8 88 5A 60 BA C3 6B U@...HU. ...Z`..k [0130] 77 ED 93 29 A7 85 A5 96 61 BD 66 0F AD 0F 32 80 w..).... a.f...2. [0140] EA A5 01 D7 31 F6 4A 8C A6 16 E8 F6 3D 98 E6 BE ....1.J. ....=... [0150] B8 FA 0F 88 7F 00 67 C5 A9 9E F8 BC C6 43 FD 18 ......g. .....C.. [0160] 68 FF 95 F0 19 CB D0 4F 33 BA D6 33 BE 4A A4 E3 h......O 3..3.J.. [0170] 96 00 D3 04 CA 7A CA 37 25 07 CF 19 52 82 CD 4F .....z.7 %...R..O [0180] 2F E8 F5 B9 EB 1B 53 1D FB 52 77 65 8F 25 86 95 /.....S. .Rwe.%.. [0190] F0 25 A9 FB 67 2F 56 12 41 58 E5 5A BB 73 7B A5 .%..g/V. AX.Z.s{. [01A0] 9D 75 CF 52 38 53 22 66 19 8C 2B DE BA FE 98 86 .u.R8S"f ..+..... [01B0] 51 A9 12 61 52 28 34 F1 A4 5B 60 ED C5 44 95 11 Q..aR(4. .[`..D.. [01C0] 42 FD E5 23 80 50 77 22 7A 2E 45 CD 92 3B A2 1B B..#.Pw" z.E..;.. [01D0] 25 E9 DB 19 FC 17 11 9E 3A CA 6C 91 14 58 39 D5 %....... :.l..X9. [01E0] BC 14 F2 4D F6 90 B8 55 79 C7 7A 16 70 03 B5 74 ...M...U y.z.p..t [01F0] 1B 1E 14 4E 20 E5 D0 99 4C CA A2 60 4F FB 70 7F ...N ... L..`O.p. [0200] F2 09 33 91 F4 83 B1 1B D0 A2 02 A7 66 F0 93 24 ..3..... ....f..$ [0210] C5 FE C8 A0 A7 65 14 1C 0D 8F 59 C1 5D 6C 1B 70 .....e.. ..Y.]l.p [0220] 89 31 C7 6F D2 E4 5F 04 C1 8D 3D 19 74 84 B5 2B .1.o.._. ..=.t..+ [0230] 16 2F 81 E1 03 3A 1B 8C 9C 93 04 03 06 06 22 2D ./...:.. ......"- [0240] 9B C1 32 0B B6 AD 01 70 BD 81 F0 4B 2A 3B B5 79 ..2....p ...K*;.y [0250] 28 78 2D CC 31 1E BB 73 BB 93 CA 5E 23 0D 8D 2C (x-.1..s ...^#.., [0260] DE D5 DC 79 1F 71 DA 9C 80 5C 02 BA C4 8F DB 9B ...y.q.. .\...... [0270] E2 6F 16 35 B3 8C CD CF 4B 82 50 BB 81 92 E1 BD .o.5.... K.P..... [0280] 42 19 03 2A 41 A8 B2 4C CA 58 97 71 93 8F 16 58 B..*A..L .X.q...X [0290] 14 39 03 D2 EC 9A 99 78 82 70 3A 94 E5 F2 AB CB .9.....x .p:..... [02A0] FA 04 0E 70 35 D0 04 F7 26 A7 9E 83 D6 0A 03 8A ...p5... &....... [02B0] 2C 49 76 C3 03 C2 FA E2 02 DE 5D 72 9E BA A0 AD ,Iv..... ..]r.... [02C0] CE 0F BD F2 FE C4 00 27 43 06 D7 6D AB 08 C3 9B .......' C..m.... [02D0] D3 16 44 A9 79 46 60 1D A4 96 FF 89 FA 0E 21 F3 ..D.yF`. ......!. [02E0] 32 89 B7 5E BB 5E 1A 64 0E 72 D2 4E 97 F2 27 48 2..^.^.d .r.N..'H [02F0] 24 4A 85 C9 87 04 9F 12 E1 A0 A6 B4 71 0E 34 0B $J...... ....q.4. [0300] 2A 66 48 52 F5 0A 26 10 C4 2B 74 A3 B8 87 74 6C *fHR..&. .+t...tl [0310] C5 BB 40 A1 5C F1 E4 20 90 AC DF D8 A2 50 EE 65 ..@.\.. .....P.e [0320] CC 40 56 2E AF 93 39 00 21 CF F5 CD 82 96 E7 57 .@V...9. !......W [0330] E7 92 6F 69 A3 CF 9D CB E7 81 11 10 E4 DA 25 8B ..oi.... ......%. [0340] EA 1A 9E 66 5B F8 A3 1F 27 48 86 F1 39 5E DB 56 ...f[... 'H..9^.V [0350] E2 7A 3A 7F 0B E9 2F ED 65 89 ED EF 65 D3 C8 8B .z:.../. e...e... [0360] 79 35 C8 DB F1 D0 57 98 17 02 0C D8 CE AE 98 D4 y5....W. ........ [0370] DC 74 24 64 A8 34 13 EB 8B BD 07 AA 6A 1D BE 8D .t$d.4.. ....j... [0380] A3 48 22 C8 29 E2 EF CC 44 98 5D C5 6C 5C 70 DB .H".)... D.].l\p. [0390] 1F 75 FD D8 50 9B 9F 7A 35 26 1D B1 11 2B 00 AB .u..P..z 5&...+.. [03A0] 91 25 F0 C5 70 01 E5 D4 DF 3C 7D E5 50 69 C1 95 .%..p... .<}.Pi.. [03B0] E6 2E BE 86 CF 50 57 F8 BE 5B 71 4D 09 AF C2 16 .....PW. .[qM.... [03C0] D5 55 86 D7 79 B6 6D F1 24 69 D9 13 65 64 E7 41 .U..y.m. $i..ed.A [03D0] 37 01 72 B3 BF B0 7A CB BE 5A D0 9D 0B AA 41 BF 7.r...z. .Z....A. [03E0] 5B B5 05 05 20 95 DB 9D 5E 4E BC 4F 05 0F BE 08 [... ... ^N.O.... [03F0] E1 DC 08 CB 70 16 F4 5F 20 85 77 7A 06 43 EC B2 ....p.._ .wz.C.. [0400] A6 6D 1D F1 01 0E 14 8A 9D 27 2F E0 E2 BD 5C CF .m...... .'/...\. [0410] C3 5A 8F 63 81 43 CF 87 5E EC E8 10 57 5C 26 5A .Z.c.C.. ^...W\&Z [0420] 77 30 12 AC 51 C5 A8 84 FC 74 54 C0 A6 51 04 0E w0..Q... .tT..Q.. [0430] AB 03 14 66 9C 5F C9 B4 85 47 4B 76 AF BC 14 48 ...f._.. .GKv...H [0440] F2 E2 38 FB E4 E2 8C DE 5E 99 15 72 A4 39 9B 4D ..8..... ^..r.9.M [0450] 4E 31 DE CE 98 72 33 73 8F D4 3A C2 7F 3F 03 D3 N1...r3s ..:..?.. [0460] 04 52 27 FA 01 E6 65 10 D3 88 FF 65 8C B8 AE 36 .R'...e. ...e...6 [0470] E7 BD 11 28 F6 43 B2 41 4A BD 90 18 3C 09 A9 22 ...(.C.A J...<.." [0480] B9 2E 8A BD 41 39 00 5E 4B 56 0F B4 E5 05 87 49 ....A9.^ KV.....I [0490] 71 9F 00 C1 F7 BD B0 6B 9D 5B A0 C1 B8 34 0D F6 q......k .[...4.. [04A0] 87 41 8B 4A 03 CC 6B A5 2F D2 80 C3 6E A4 82 06 .A.J..k. /...n... [04B0] 96 30 82 06 92 A0 03 02 01 12 A2 82 06 89 04 82 .0...... ........ [04C0] 06 85 83 10 A4 96 24 2E CC 42 D3 F6 59 19 6F 2F ......$. .B..Y.o/ [04D0] CF 30 EF E3 CA 03 C2 C8 73 73 36 B5 A8 C4 55 CD .0...... ss6...U. [04E0] 6B CA 52 C1 4C F2 10 33 6A 94 A0 6E B1 94 1C B3 k.R.L..3 j..n.... [04F0] 39 ED 13 E3 D7 72 60 2A 09 D8 13 35 60 9E CF 18 9....r`* ...5`... [0500] 97 E7 AA E2 D7 D6 58 5B 82 29 B2 D6 DE 12 C4 B8 ......X[ .)...... [0510] DB 32 38 99 55 79 B0 C2 B1 9F 6F 03 E2 3B 53 17 .28.Uy.. ..o..;S. [0520] C6 26 BE 8A EA B2 E1 55 F7 A6 FE 86 0F 06 73 91 .&.....U ......s. [0530] 6B B1 4D 04 F1 D1 96 DE FF 61 C2 DC 91 5E 6D 1F k.M..... .a...^m. [0540] 9C 9C 87 90 03 E7 28 69 92 C6 C4 54 54 39 75 7A ......(i ...TT9uz [0550] 7B F2 4A 3B C2 D7 EE 53 3B FE 86 AB 05 94 65 75 {.J;...S ;.....eu [0560] 81 B3 2A 2F 64 0A 0A CB C6 88 F3 4E 3D 59 9B 78 ..*/d... ...N=Y.x [0570] 87 0A AE 93 A6 F2 E9 7B 13 45 17 B6 73 20 83 EC .......{ .E..s .. [0580] AB 23 3A 4B 1D CF 55 5D F5 49 C4 DF B9 01 C5 5D .#:K..U] .I.....] [0590] A3 5A 08 C8 22 82 CC 77 68 E0 11 BD 2A C6 B1 8A .Z.."..w h...*... [05A0] 55 E9 22 BC 5E 16 91 62 69 62 13 FC 41 10 29 73 U.".^..b ib..A.)s [05B0] EE E3 E4 94 CF 5D 3B FF AF 21 E6 8A AA 63 15 20 .....];. .!...c. [05C0] C3 F5 6D 66 3D BA 63 55 4C 60 0B CB A7 93 53 A3 ..mf=.cU L`....S. [05D0] A6 C4 CE 49 D8 11 39 F8 08 DC A6 BF C9 46 69 58 ...I..9. .....FiX [05E0] 91 E8 88 DE 15 C0 33 52 DF 25 2C A1 08 03 34 57 ......3R .%,...4W [05F0] 2C E4 BA 05 CC D4 92 90 04 C0 A3 FC A2 D0 44 43 ,....... ......DC [0600] 34 BF EF 2B 24 41 82 83 A9 CA 0B 9E DD C9 7F 37 4..+$A.. .......7 [0610] D0 65 B2 B3 70 58 FA 41 81 B9 1F E7 39 8E A0 70 .e..pX.A ....9..p [0620] C5 BA E6 FF BA 98 35 EA 1A 27 46 19 3A 5B 31 EF ......5. .'F.:[1. [0630] 3C 95 B2 FE 83 4F E4 8B 2D D1 E1 F4 5E D4 AA 49 <....O.. -...^..I [0640] E0 14 D8 22 B6 34 18 C5 C9 F4 8E 77 2D E9 EC 56 ...".4.. ...w-..V [0650] 39 CF 44 71 9E 51 21 21 52 07 6F 94 52 7A EF F3 9.Dq.Q!! R.o.Rz.. [0660] 00 D0 42 5F 56 43 CF 3E 3A CC 88 D1 AC FC 12 66 ..B_VC.> :......f [0670] BE A0 BB 40 BF 52 46 68 12 0F 07 6D 81 1F 25 55 ...@.RFh ...m..%U [0680] 71 49 90 ED AE 14 2D 6C D5 BB DE A9 36 DB 26 1C qI....-l ....6.&. [0690] 76 C3 13 C5 BD AB A5 CC C6 6C EB F7 27 9A A4 5D v....... .l..'..] [06A0] ED 98 88 F5 FD 07 EE D3 71 22 1F 03 03 68 A3 4A ........ q"...h.J [06B0] D0 68 60 75 C8 94 C8 0A 58 0F 8B 13 03 18 C6 11 .h`u.... X....... [06C0] FC C4 E8 E8 7B 2A 8C 30 94 7A 45 EA D9 FB D8 0C ....{*.0 .zE..... [06D0] 93 E5 07 3A 20 68 66 96 93 F5 BE B4 73 7E D4 70 ...: hf. ....s~.p [06E0] 93 71 8C C7 FC 58 27 FF B1 1B 2C 85 9E 51 3B 07 .q...X'. ..,..Q;. [06F0] B9 1A D2 4C DB 7A D2 D1 28 61 55 D9 6F B2 45 E2 ...L.z.. (aU.o.E. [0700] FD 94 8E C7 81 66 C0 AB 3A 1B B3 C5 D9 CA B5 93 .....f.. :....... [0710] 79 56 26 8E 05 50 68 AC D8 D4 5E 84 5C 64 B3 62 yV&..Ph. ..^.\d.b [0720] 84 81 55 06 DF 51 F6 0E 1B 41 A5 DA 12 95 9F AB ..U..Q.. .A...... [0730] 2C C1 3F 5B E4 D6 1F 76 CD 55 70 CD 07 1D CC 7D ,.?[...v .Up....} [0740] DE 5F 2F DE 7C 98 1B 3B 5E 27 D0 7E 95 46 54 77 ._/.|..; ^'.~.FTw [0750] AA B9 17 21 C7 AB F8 32 5A D1 1C D0 8A DA B2 FB ...!...2 Z....... [0760] 05 CB FC CE 08 B0 83 05 C7 85 A1 E4 9C 96 03 D7 ........ ........ [0770] BD BA CF 83 8D D7 71 21 8B 0C 08 AC 38 AA 87 EC ......q! ....8... [0780] 84 91 DB 29 66 0C A1 14 23 1D BB E6 78 92 1A 51 ...)f... #...x..Q [0790] 0F 55 70 14 20 60 56 E5 EB B1 C8 B3 3E 78 49 DB .Up. `V. ....>xI. [07A0] 5A EE 61 B4 74 FE 8C 7D A5 45 A2 59 35 EA B0 78 Z.a.t..} .E.Y5..x [07B0] 2A 6E 03 12 05 0F 60 69 C6 C0 79 4A 09 AD 1F 06 *n....`i ..yJ.... [07C0] 46 1B 3C 10 CB 99 FC E0 E5 E4 B0 57 32 5E B9 E0 F.<..... ...W2^.. [07D0] E4 9D F7 F2 BD 5A A9 57 12 37 25 79 24 2E 84 74 .....Z.W .7%y$..t [07E0] 20 8A 50 01 76 5E B8 A5 63 73 D1 08 88 50 EA 65 .P.v^.. cs...P.e [07F0] D1 48 ED 0C B8 4B 76 71 54 89 1D D6 AF 36 59 9B .H...Kvq T....6Y. [0800] 7D 7C F2 C6 A6 E8 33 ED 1D BE 05 45 AB 7C 13 22 }|....3. ...E.|." [0810] F3 3D 06 10 BE EB 1E 7D 02 12 6F E5 6F 28 3D 8B .=.....} ..o.o(=. [0820] FB 34 E4 53 B1 C0 D2 6C 09 1A 90 D6 01 7E 9C 39 .4.S...l .....~.9 [0830] 60 86 02 A1 FE 56 D4 65 C3 AB 36 9E 99 EF 9D 6D `....V.e ..6....m [0840] 6C 5C 8D EA 2D 12 ED 25 B2 32 37 E4 CF D4 4A 83 l\..-..% .27...J. [0850] E2 C8 8D 89 FB E6 AC C2 82 B4 77 F7 A3 EB EF 6F ........ ..w....o [0860] 4A 91 62 C2 CE 81 4E 6B 40 CD 30 14 67 46 7B 8D J.b...Nk @.0.gF{. [0870] 8F 8D 2E 6C 77 DF 99 2A DA C2 C7 30 33 15 18 2E ...lw..* ...03... [0880] B7 1A 2B 21 66 37 6E FA 37 9A 08 A7 C1 51 06 EA ..+!f7n. 7....Q.. [0890] C3 AE 7C 00 A8 E8 2E 33 CE 25 B7 C3 CF 4F 62 76 ..|....3 .%...Obv [08A0] 46 5F DC 1D B8 1F 68 31 5C 71 93 E1 02 8B 3C F7 F_....h1 \q....<. [08B0] 07 9C F4 3C EF E7 A2 AB 65 2F DD 79 E0 8B 50 C0 ...<.... e/.y..P. [08C0] E2 3D A9 B8 1A 52 F0 DE 4A 72 B9 88 0C DF 49 ED .=...R.. Jr....I. [08D0] ED AE C4 7F F5 1D B3 D9 76 6F 57 B4 7B B1 36 A5 ........ voW.{.6. [08E0] 10 53 54 65 4F 26 34 20 58 D5 EE 22 1B F8 6F 8F .STeO&4 X.."..o. [08F0] 7F B3 77 06 27 86 62 AE 9A C3 D5 AD 1A 90 14 82 ..w.'.b. ........ [0900] 3B 92 B4 02 3B 48 B6 05 BB B7 DA A8 20 DB DC B6 ;...;H.. .... ... [0910] 93 EB 0E 08 0C 6B B2 3D DE F7 B4 A9 1B 8F B8 21 .....k.= .......! [0920] 85 BA 2D A6 50 92 AD 99 65 08 D3 3B 36 6D BE A8 ..-.P... e..;6m.. [0930] 89 EA D3 2A A0 E6 7C D2 71 20 31 12 0A 89 68 5A ...*..|. q 1...hZ [0940] CF 4F 28 07 BB E3 89 94 10 07 2B 4F A1 A4 C3 74 .O(..... ..+O...t [0950] CF 83 D8 B6 37 D6 13 00 53 8B 8B 5C 86 FA 76 2B ....7... S..\..v+ [0960] 53 C0 96 39 29 E3 7E FA 89 24 14 23 39 3D 67 D8 S..9).~. .$.#9=g. [0970] 3A 11 38 51 19 DE CB 1E 84 B4 96 09 92 D0 01 E1 :.8Q.... ........ [0980] 49 D5 64 B6 33 42 5B EC 7F 9A 84 57 02 1A 93 EF I.d.3B[. ...W.... [0990] DC AF 92 7B 7F D5 71 0E 0B 71 CE 48 D7 A8 5B 88 ...{..q. .q.H..[. [09A0] 11 31 9A 59 99 4C 49 0A 4E D2 27 81 95 42 7F E1 .1.Y.LI. N.'..B.. [09B0] D4 46 D3 BD 12 9E 8E 40 4B 1A AE 54 54 53 26 C4 .F.....@ K..TTS&. [09C0] 41 CF 08 48 97 2F F7 3D FA 64 85 89 B4 23 D4 15 A..H./.= .d...#.. [09D0] F1 27 86 B7 FF 1F D2 83 1D BF A3 8E BB 95 F6 90 .'...... ........ [09E0] A5 A7 0D 52 DF C0 71 93 CD EA 5A 76 51 FD 27 07 ...R..q. ..ZvQ.'. [09F0] A7 6E 6C B7 4D 01 5C 29 3D 99 51 2E 84 1B 86 22 .nl.M.\) =.Q...." [0A00] 95 45 A9 5A 3C 81 31 E0 62 73 BE 8A DB 8B AF 25 .E.Z<.1. bs.....% [0A10] 2A 64 53 B4 A0 8A 25 6C 6F D2 2C B4 2C B1 15 EE *dS...%l o.,.,... [0A20] 0A 5D DC 49 53 6A 1F 4E 3E 8A 14 4D F9 85 F6 92 .].ISj.N >..M.... [0A30] A1 14 C9 00 7E 30 CD 21 48 3B 80 27 F3 A3 0D CE ....~0.! H;.'.... [0A40] B2 30 F6 21 56 A5 5B 65 3A 75 39 B3 0F A9 3E 48 .0.!V.[e :u9...>H [0A50] 14 1A D3 00 1B 52 C4 64 6E AD E0 DD 61 08 33 4D .....R.d n...a.3M [0A60] 3F 26 4C BB 95 48 AA BD 0F 9D 0A 8B C1 00 DA DC ?&L..H.. ........ [0A70] AF 14 4C 05 7A 17 F6 73 0D 02 65 BA 47 C4 D0 73 ..L.z..s ..e.G..s [0A80] FC 06 40 6B 2C 01 BB A6 D4 EF E7 42 0E 1F 1D 78 ..@k,... ...B...x [0A90] FD CD B9 A5 F7 D8 0D 6B 01 B2 47 19 82 61 C1 DB .......k ..G..a.. [0AA0] 64 EF 93 7D AA A7 DB C6 50 67 2B B5 83 F4 3B 54 d..}.... Pg+...;T [0AB0] 47 D9 C7 75 A1 03 FF 21 2B EE 11 B7 D1 A4 E9 1D G..u...! +....... [0AC0] 0C 05 7E 4C 3E B9 8A EB 7A 13 76 9F D6 B8 4F 64 ..~L>... z.v...Od [0AD0] A2 F8 F2 EF EE C8 5B 67 EA 08 02 93 AE 90 EF A2 ......[g ........ [0AE0] 43 FF 12 49 9F 88 2D 08 89 23 67 5A 68 9E 18 1E C..I..-. .#gZh... [0AF0] 51 59 2F B7 48 50 7E 8D 4E 31 0B E9 1C CB 39 AA QY/.HP~. N1....9. [0B00] CB 69 88 8E 6C 45 2C C7 F5 E7 85 F5 2A E3 52 45 .i..lE,. ....*.RE [0B10] 55 C3 26 B1 ED 40 03 D5 2C 52 00 28 BB FD B3 E4 U.&..@.. ,R.(.... [0B20] 61 2E 60 25 94 0F 62 DC 80 DD A0 D7 4B 30 64 FE a.`%..b. ....K0d. [0B30] 0F FF DD 23 4F D4 AF 96 08 F1 0F 8A 5F BF 09 89 ...#O... ...._... [0B40] 86 C5 1B 7A DE 60 C1 ...z.`. [2025/04/09 07:45:44.844652, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0b97 (2967) auth_length : 0x0b47 (2887) call_id : 0x0000001d (29) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=2895 [0000] 09 06 00 00 01 00 00 00 60 82 0B 43 06 06 2B 06 ........ `..C..+. [0010] 01 05 05 02 A0 82 0B 37 30 82 0B 33 A0 24 30 22 .......7 0..3.$0" [0020] 06 09 2A 86 48 82 F7 12 01 02 02 06 09 2A 86 48 ..*.H... .....*.H [0030] 86 F7 12 01 02 02 06 0A 2B 06 01 04 01 82 37 02 ........ +.....7. [0040] 02 0A A2 82 0B 09 04 82 0B 05 6E 82 0B 01 30 82 ........ ..n...0. [0050] 0A FD A0 03 02 01 05 A1 03 02 01 0E A2 07 03 05 ........ ........ [0060] 00 20 00 00 00 A3 82 04 4C 61 82 04 48 30 82 04 . ...... La..H0.. [0070] 44 A0 03 02 01 05 A1 11 1B 0F 41 44 50 52 4F 54 D....... ..ADPROT [0080] 4F 43 4F 4C 58 2E 43 4F 4D A2 29 30 27 A0 03 02 OCOLX.CO M.)0'... [0090] 01 01 A1 20 30 1E 1B 04 68 6F 73 74 1B 16 77 69 ... 0... host..wi [00A0] 6E 64 63 31 2E 61 64 70 72 6F 74 6F 63 6F 6C 78 ndc1.adp rotocolx [00B0] 2E 63 6F 6D A3 82 03 FD 30 82 03 F9 A0 03 02 01 .com.... 0....... [00C0] 12 A1 03 02 01 03 A2 82 03 EB 04 82 03 E7 06 1F ........ ........ [00D0] 8F 84 74 CE 99 4A 3D 11 93 20 46 0C AA A0 44 62 ..t..J=. . F...Db [00E0] 76 31 3E FA D7 52 8C EA 8D F3 05 CE A6 76 84 C4 v1>..R.. .....v.. [00F0] 2C BC DB 1D 92 97 B5 F6 BF 7B 85 BF EF 76 1B 99 ,....... .{...v.. [0100] 1F CA BB 30 0A C0 B7 45 D7 81 FF 33 26 AD 92 6D ...0...E ...3&..m [0110] 08 95 8C 6F 2E D3 ED 1B 48 8E 7D E2 AD 61 FB 69 ...o.... H.}..a.i [0120] C8 04 F1 90 DF 10 80 61 55 40 95 9B D6 48 55 D4 .......a U@...HU. [0130] A9 E8 88 5A 60 BA C3 6B 77 ED 93 29 A7 85 A5 96 ...Z`..k w..).... [0140] 61 BD 66 0F AD 0F 32 80 EA A5 01 D7 31 F6 4A 8C a.f...2. ....1.J. [0150] A6 16 E8 F6 3D 98 E6 BE B8 FA 0F 88 7F 00 67 C5 ....=... ......g. [0160] A9 9E F8 BC C6 43 FD 18 68 FF 95 F0 19 CB D0 4F .....C.. h......O [0170] 33 BA D6 33 BE 4A A4 E3 96 00 D3 04 CA 7A CA 37 3..3.J.. .....z.7 [0180] 25 07 CF 19 52 82 CD 4F 2F E8 F5 B9 EB 1B 53 1D %...R..O /.....S. [0190] FB 52 77 65 8F 25 86 95 F0 25 A9 FB 67 2F 56 12 .Rwe.%.. .%..g/V. [01A0] 41 58 E5 5A BB 73 7B A5 9D 75 CF 52 38 53 22 66 AX.Z.s{. .u.R8S"f [01B0] 19 8C 2B DE BA FE 98 86 51 A9 12 61 52 28 34 F1 ..+..... Q..aR(4. [01C0] A4 5B 60 ED C5 44 95 11 42 FD E5 23 80 50 77 22 .[`..D.. B..#.Pw" [01D0] 7A 2E 45 CD 92 3B A2 1B 25 E9 DB 19 FC 17 11 9E z.E..;.. %....... [01E0] 3A CA 6C 91 14 58 39 D5 BC 14 F2 4D F6 90 B8 55 :.l..X9. ...M...U [01F0] 79 C7 7A 16 70 03 B5 74 1B 1E 14 4E 20 E5 D0 99 y.z.p..t ...N ... [0200] 4C CA A2 60 4F FB 70 7F F2 09 33 91 F4 83 B1 1B L..`O.p. ..3..... [0210] D0 A2 02 A7 66 F0 93 24 C5 FE C8 A0 A7 65 14 1C ....f..$ .....e.. [0220] 0D 8F 59 C1 5D 6C 1B 70 89 31 C7 6F D2 E4 5F 04 ..Y.]l.p .1.o.._. [0230] C1 8D 3D 19 74 84 B5 2B 16 2F 81 E1 03 3A 1B 8C ..=.t..+ ./...:.. [0240] 9C 93 04 03 06 06 22 2D 9B C1 32 0B B6 AD 01 70 ......"- ..2....p [0250] BD 81 F0 4B 2A 3B B5 79 28 78 2D CC 31 1E BB 73 ...K*;.y (x-.1..s [0260] BB 93 CA 5E 23 0D 8D 2C DE D5 DC 79 1F 71 DA 9C ...^#.., ...y.q.. [0270] 80 5C 02 BA C4 8F DB 9B E2 6F 16 35 B3 8C CD CF .\...... .o.5.... [0280] 4B 82 50 BB 81 92 E1 BD 42 19 03 2A 41 A8 B2 4C K.P..... B..*A..L [0290] CA 58 97 71 93 8F 16 58 14 39 03 D2 EC 9A 99 78 .X.q...X .9.....x [02A0] 82 70 3A 94 E5 F2 AB CB FA 04 0E 70 35 D0 04 F7 .p:..... ...p5... [02B0] 26 A7 9E 83 D6 0A 03 8A 2C 49 76 C3 03 C2 FA E2 &....... ,Iv..... [02C0] 02 DE 5D 72 9E BA A0 AD CE 0F BD F2 FE C4 00 27 ..]r.... .......' [02D0] 43 06 D7 6D AB 08 C3 9B D3 16 44 A9 79 46 60 1D C..m.... ..D.yF`. [02E0] A4 96 FF 89 FA 0E 21 F3 32 89 B7 5E BB 5E 1A 64 ......!. 2..^.^.d [02F0] 0E 72 D2 4E 97 F2 27 48 24 4A 85 C9 87 04 9F 12 .r.N..'H $J...... [0300] E1 A0 A6 B4 71 0E 34 0B 2A 66 48 52 F5 0A 26 10 ....q.4. *fHR..&. [0310] C4 2B 74 A3 B8 87 74 6C C5 BB 40 A1 5C F1 E4 20 .+t...tl ..@.\.. [0320] 90 AC DF D8 A2 50 EE 65 CC 40 56 2E AF 93 39 00 .....P.e .@V...9. [0330] 21 CF F5 CD 82 96 E7 57 E7 92 6F 69 A3 CF 9D CB !......W ..oi.... [0340] E7 81 11 10 E4 DA 25 8B EA 1A 9E 66 5B F8 A3 1F ......%. ...f[... [0350] 27 48 86 F1 39 5E DB 56 E2 7A 3A 7F 0B E9 2F ED 'H..9^.V .z:.../. [0360] 65 89 ED EF 65 D3 C8 8B 79 35 C8 DB F1 D0 57 98 e...e... y5....W. [0370] 17 02 0C D8 CE AE 98 D4 DC 74 24 64 A8 34 13 EB ........ .t$d.4.. [0380] 8B BD 07 AA 6A 1D BE 8D A3 48 22 C8 29 E2 EF CC ....j... .H".)... [0390] 44 98 5D C5 6C 5C 70 DB 1F 75 FD D8 50 9B 9F 7A D.].l\p. .u..P..z [03A0] 35 26 1D B1 11 2B 00 AB 91 25 F0 C5 70 01 E5 D4 5&...+.. .%..p... [03B0] DF 3C 7D E5 50 69 C1 95 E6 2E BE 86 CF 50 57 F8 .<}.Pi.. .....PW. [03C0] BE 5B 71 4D 09 AF C2 16 D5 55 86 D7 79 B6 6D F1 .[qM.... .U..y.m. [03D0] 24 69 D9 13 65 64 E7 41 37 01 72 B3 BF B0 7A CB $i..ed.A 7.r...z. [03E0] BE 5A D0 9D 0B AA 41 BF 5B B5 05 05 20 95 DB 9D .Z....A. [... ... [03F0] 5E 4E BC 4F 05 0F BE 08 E1 DC 08 CB 70 16 F4 5F ^N.O.... ....p.._ [0400] 20 85 77 7A 06 43 EC B2 A6 6D 1D F1 01 0E 14 8A .wz.C.. .m...... [0410] 9D 27 2F E0 E2 BD 5C CF C3 5A 8F 63 81 43 CF 87 .'/...\. .Z.c.C.. [0420] 5E EC E8 10 57 5C 26 5A 77 30 12 AC 51 C5 A8 84 ^...W\&Z w0..Q... [0430] FC 74 54 C0 A6 51 04 0E AB 03 14 66 9C 5F C9 B4 .tT..Q.. ...f._.. [0440] 85 47 4B 76 AF BC 14 48 F2 E2 38 FB E4 E2 8C DE .GKv...H ..8..... [0450] 5E 99 15 72 A4 39 9B 4D 4E 31 DE CE 98 72 33 73 ^..r.9.M N1...r3s [0460] 8F D4 3A C2 7F 3F 03 D3 04 52 27 FA 01 E6 65 10 ..:..?.. .R'...e. [0470] D3 88 FF 65 8C B8 AE 36 E7 BD 11 28 F6 43 B2 41 ...e...6 ...(.C.A [0480] 4A BD 90 18 3C 09 A9 22 B9 2E 8A BD 41 39 00 5E J...<.." ....A9.^ [0490] 4B 56 0F B4 E5 05 87 49 71 9F 00 C1 F7 BD B0 6B KV.....I q......k [04A0] 9D 5B A0 C1 B8 34 0D F6 87 41 8B 4A 03 CC 6B A5 .[...4.. .A.J..k. [04B0] 2F D2 80 C3 6E A4 82 06 96 30 82 06 92 A0 03 02 /...n... .0...... [04C0] 01 12 A2 82 06 89 04 82 06 85 83 10 A4 96 24 2E ........ ......$. [04D0] CC 42 D3 F6 59 19 6F 2F CF 30 EF E3 CA 03 C2 C8 .B..Y.o/ .0...... [04E0] 73 73 36 B5 A8 C4 55 CD 6B CA 52 C1 4C F2 10 33 ss6...U. k.R.L..3 [04F0] 6A 94 A0 6E B1 94 1C B3 39 ED 13 E3 D7 72 60 2A j..n.... 9....r`* [0500] 09 D8 13 35 60 9E CF 18 97 E7 AA E2 D7 D6 58 5B ...5`... ......X[ [0510] 82 29 B2 D6 DE 12 C4 B8 DB 32 38 99 55 79 B0 C2 .)...... .28.Uy.. [0520] B1 9F 6F 03 E2 3B 53 17 C6 26 BE 8A EA B2 E1 55 ..o..;S. .&.....U [0530] F7 A6 FE 86 0F 06 73 91 6B B1 4D 04 F1 D1 96 DE ......s. k.M..... [0540] FF 61 C2 DC 91 5E 6D 1F 9C 9C 87 90 03 E7 28 69 .a...^m. ......(i [0550] 92 C6 C4 54 54 39 75 7A 7B F2 4A 3B C2 D7 EE 53 ...TT9uz {.J;...S [0560] 3B FE 86 AB 05 94 65 75 81 B3 2A 2F 64 0A 0A CB ;.....eu ..*/d... [0570] C6 88 F3 4E 3D 59 9B 78 87 0A AE 93 A6 F2 E9 7B ...N=Y.x .......{ [0580] 13 45 17 B6 73 20 83 EC AB 23 3A 4B 1D CF 55 5D .E..s .. .#:K..U] [0590] F5 49 C4 DF B9 01 C5 5D A3 5A 08 C8 22 82 CC 77 .I.....] .Z.."..w [05A0] 68 E0 11 BD 2A C6 B1 8A 55 E9 22 BC 5E 16 91 62 h...*... U.".^..b [05B0] 69 62 13 FC 41 10 29 73 EE E3 E4 94 CF 5D 3B FF ib..A.)s .....];. [05C0] AF 21 E6 8A AA 63 15 20 C3 F5 6D 66 3D BA 63 55 .!...c. ..mf=.cU [05D0] 4C 60 0B CB A7 93 53 A3 A6 C4 CE 49 D8 11 39 F8 L`....S. ...I..9. [05E0] 08 DC A6 BF C9 46 69 58 91 E8 88 DE 15 C0 33 52 .....FiX ......3R [05F0] DF 25 2C A1 08 03 34 57 2C E4 BA 05 CC D4 92 90 .%,...4W ,....... [0600] 04 C0 A3 FC A2 D0 44 43 34 BF EF 2B 24 41 82 83 ......DC 4..+$A.. [0610] A9 CA 0B 9E DD C9 7F 37 D0 65 B2 B3 70 58 FA 41 .......7 .e..pX.A [0620] 81 B9 1F E7 39 8E A0 70 C5 BA E6 FF BA 98 35 EA ....9..p ......5. [0630] 1A 27 46 19 3A 5B 31 EF 3C 95 B2 FE 83 4F E4 8B .'F.:[1. <....O.. [0640] 2D D1 E1 F4 5E D4 AA 49 E0 14 D8 22 B6 34 18 C5 -...^..I ...".4.. [0650] C9 F4 8E 77 2D E9 EC 56 39 CF 44 71 9E 51 21 21 ...w-..V 9.Dq.Q!! [0660] 52 07 6F 94 52 7A EF F3 00 D0 42 5F 56 43 CF 3E R.o.Rz.. ..B_VC.> [0670] 3A CC 88 D1 AC FC 12 66 BE A0 BB 40 BF 52 46 68 :......f ...@.RFh [0680] 12 0F 07 6D 81 1F 25 55 71 49 90 ED AE 14 2D 6C ...m..%U qI....-l [0690] D5 BB DE A9 36 DB 26 1C 76 C3 13 C5 BD AB A5 CC ....6.&. v....... [06A0] C6 6C EB F7 27 9A A4 5D ED 98 88 F5 FD 07 EE D3 .l..'..] ........ [06B0] 71 22 1F 03 03 68 A3 4A D0 68 60 75 C8 94 C8 0A q"...h.J .h`u.... [06C0] 58 0F 8B 13 03 18 C6 11 FC C4 E8 E8 7B 2A 8C 30 X....... ....{*.0 [06D0] 94 7A 45 EA D9 FB D8 0C 93 E5 07 3A 20 68 66 96 .zE..... ...: hf. [06E0] 93 F5 BE B4 73 7E D4 70 93 71 8C C7 FC 58 27 FF ....s~.p .q...X'. [06F0] B1 1B 2C 85 9E 51 3B 07 B9 1A D2 4C DB 7A D2 D1 ..,..Q;. ...L.z.. [0700] 28 61 55 D9 6F B2 45 E2 FD 94 8E C7 81 66 C0 AB (aU.o.E. .....f.. [0710] 3A 1B B3 C5 D9 CA B5 93 79 56 26 8E 05 50 68 AC :....... yV&..Ph. [0720] D8 D4 5E 84 5C 64 B3 62 84 81 55 06 DF 51 F6 0E ..^.\d.b ..U..Q.. [0730] 1B 41 A5 DA 12 95 9F AB 2C C1 3F 5B E4 D6 1F 76 .A...... ,.?[...v [0740] CD 55 70 CD 07 1D CC 7D DE 5F 2F DE 7C 98 1B 3B .Up....} ._/.|..; [0750] 5E 27 D0 7E 95 46 54 77 AA B9 17 21 C7 AB F8 32 ^'.~.FTw ...!...2 [0760] 5A D1 1C D0 8A DA B2 FB 05 CB FC CE 08 B0 83 05 Z....... ........ [0770] C7 85 A1 E4 9C 96 03 D7 BD BA CF 83 8D D7 71 21 ........ ......q! [0780] 8B 0C 08 AC 38 AA 87 EC 84 91 DB 29 66 0C A1 14 ....8... ...)f... [0790] 23 1D BB E6 78 92 1A 51 0F 55 70 14 20 60 56 E5 #...x..Q .Up. `V. [07A0] EB B1 C8 B3 3E 78 49 DB 5A EE 61 B4 74 FE 8C 7D ....>xI. Z.a.t..} [07B0] A5 45 A2 59 35 EA B0 78 2A 6E 03 12 05 0F 60 69 .E.Y5..x *n....`i [07C0] C6 C0 79 4A 09 AD 1F 06 46 1B 3C 10 CB 99 FC E0 ..yJ.... F.<..... [07D0] E5 E4 B0 57 32 5E B9 E0 E4 9D F7 F2 BD 5A A9 57 ...W2^.. .....Z.W [07E0] 12 37 25 79 24 2E 84 74 20 8A 50 01 76 5E B8 A5 .7%y$..t .P.v^.. [07F0] 63 73 D1 08 88 50 EA 65 D1 48 ED 0C B8 4B 76 71 cs...P.e .H...Kvq [0800] 54 89 1D D6 AF 36 59 9B 7D 7C F2 C6 A6 E8 33 ED T....6Y. }|....3. [0810] 1D BE 05 45 AB 7C 13 22 F3 3D 06 10 BE EB 1E 7D ...E.|." .=.....} [0820] 02 12 6F E5 6F 28 3D 8B FB 34 E4 53 B1 C0 D2 6C ..o.o(=. .4.S...l [0830] 09 1A 90 D6 01 7E 9C 39 60 86 02 A1 FE 56 D4 65 .....~.9 `....V.e [0840] C3 AB 36 9E 99 EF 9D 6D 6C 5C 8D EA 2D 12 ED 25 ..6....m l\..-..% [0850] B2 32 37 E4 CF D4 4A 83 E2 C8 8D 89 FB E6 AC C2 .27...J. ........ [0860] 82 B4 77 F7 A3 EB EF 6F 4A 91 62 C2 CE 81 4E 6B ..w....o J.b...Nk [0870] 40 CD 30 14 67 46 7B 8D 8F 8D 2E 6C 77 DF 99 2A @.0.gF{. ...lw..* [0880] DA C2 C7 30 33 15 18 2E B7 1A 2B 21 66 37 6E FA ...03... ..+!f7n. [0890] 37 9A 08 A7 C1 51 06 EA C3 AE 7C 00 A8 E8 2E 33 7....Q.. ..|....3 [08A0] CE 25 B7 C3 CF 4F 62 76 46 5F DC 1D B8 1F 68 31 .%...Obv F_....h1 [08B0] 5C 71 93 E1 02 8B 3C F7 07 9C F4 3C EF E7 A2 AB \q....<. ...<.... [08C0] 65 2F DD 79 E0 8B 50 C0 E2 3D A9 B8 1A 52 F0 DE e/.y..P. .=...R.. [08D0] 4A 72 B9 88 0C DF 49 ED ED AE C4 7F F5 1D B3 D9 Jr....I. ........ [08E0] 76 6F 57 B4 7B B1 36 A5 10 53 54 65 4F 26 34 20 voW.{.6. .STeO&4 [08F0] 58 D5 EE 22 1B F8 6F 8F 7F B3 77 06 27 86 62 AE X.."..o. ..w.'.b. [0900] 9A C3 D5 AD 1A 90 14 82 3B 92 B4 02 3B 48 B6 05 ........ ;...;H.. [0910] BB B7 DA A8 20 DB DC B6 93 EB 0E 08 0C 6B B2 3D .... ... .....k.= [0920] DE F7 B4 A9 1B 8F B8 21 85 BA 2D A6 50 92 AD 99 .......! ..-.P... [0930] 65 08 D3 3B 36 6D BE A8 89 EA D3 2A A0 E6 7C D2 e..;6m.. ...*..|. [0940] 71 20 31 12 0A 89 68 5A CF 4F 28 07 BB E3 89 94 q 1...hZ .O(..... [0950] 10 07 2B 4F A1 A4 C3 74 CF 83 D8 B6 37 D6 13 00 ..+O...t ....7... [0960] 53 8B 8B 5C 86 FA 76 2B 53 C0 96 39 29 E3 7E FA S..\..v+ S..9).~. [0970] 89 24 14 23 39 3D 67 D8 3A 11 38 51 19 DE CB 1E .$.#9=g. :.8Q.... [0980] 84 B4 96 09 92 D0 01 E1 49 D5 64 B6 33 42 5B EC ........ I.d.3B[. [0990] 7F 9A 84 57 02 1A 93 EF DC AF 92 7B 7F D5 71 0E ...W.... ...{..q. [09A0] 0B 71 CE 48 D7 A8 5B 88 11 31 9A 59 99 4C 49 0A .q.H..[. .1.Y.LI. [09B0] 4E D2 27 81 95 42 7F E1 D4 46 D3 BD 12 9E 8E 40 N.'..B.. .F.....@ [09C0] 4B 1A AE 54 54 53 26 C4 41 CF 08 48 97 2F F7 3D K..TTS&. A..H./.= [09D0] FA 64 85 89 B4 23 D4 15 F1 27 86 B7 FF 1F D2 83 .d...#.. .'...... [09E0] 1D BF A3 8E BB 95 F6 90 A5 A7 0D 52 DF C0 71 93 ........ ...R..q. [09F0] CD EA 5A 76 51 FD 27 07 A7 6E 6C B7 4D 01 5C 29 ..ZvQ.'. .nl.M.\) [0A00] 3D 99 51 2E 84 1B 86 22 95 45 A9 5A 3C 81 31 E0 =.Q...." .E.Z<.1. [0A10] 62 73 BE 8A DB 8B AF 25 2A 64 53 B4 A0 8A 25 6C bs.....% *dS...%l [0A20] 6F D2 2C B4 2C B1 15 EE 0A 5D DC 49 53 6A 1F 4E o.,.,... .].ISj.N [0A30] 3E 8A 14 4D F9 85 F6 92 A1 14 C9 00 7E 30 CD 21 >..M.... ....~0.! [0A40] 48 3B 80 27 F3 A3 0D CE B2 30 F6 21 56 A5 5B 65 H;.'.... .0.!V.[e [0A50] 3A 75 39 B3 0F A9 3E 48 14 1A D3 00 1B 52 C4 64 :u9...>H .....R.d [0A60] 6E AD E0 DD 61 08 33 4D 3F 26 4C BB 95 48 AA BD n...a.3M ?&L..H.. [0A70] 0F 9D 0A 8B C1 00 DA DC AF 14 4C 05 7A 17 F6 73 ........ ..L.z..s [0A80] 0D 02 65 BA 47 C4 D0 73 FC 06 40 6B 2C 01 BB A6 ..e.G..s ..@k,... [0A90] D4 EF E7 42 0E 1F 1D 78 FD CD B9 A5 F7 D8 0D 6B ...B...x .......k [0AA0] 01 B2 47 19 82 61 C1 DB 64 EF 93 7D AA A7 DB C6 ..G..a.. d..}.... [0AB0] 50 67 2B B5 83 F4 3B 54 47 D9 C7 75 A1 03 FF 21 Pg+...;T G..u...! [0AC0] 2B EE 11 B7 D1 A4 E9 1D 0C 05 7E 4C 3E B9 8A EB +....... ..~L>... [0AD0] 7A 13 76 9F D6 B8 4F 64 A2 F8 F2 EF EE C8 5B 67 z.v...Od ......[g [0AE0] EA 08 02 93 AE 90 EF A2 43 FF 12 49 9F 88 2D 08 ........ C..I..-. [0AF0] 89 23 67 5A 68 9E 18 1E 51 59 2F B7 48 50 7E 8D .#gZh... QY/.HP~. [0B00] 4E 31 0B E9 1C CB 39 AA CB 69 88 8E 6C 45 2C C7 N1....9. .i..lE,. [0B10] F5 E7 85 F5 2A E3 52 45 55 C3 26 B1 ED 40 03 D5 ....*.RE U.&..@.. [0B20] 2C 52 00 28 BB FD B3 E4 61 2E 60 25 94 0F 62 DC ,R.(.... a.`%..b. [0B30] 80 DD A0 D7 4B 30 64 FE 0F FF DD 23 4F D4 AF 96 ....K0d. ...#O... [0B40] 08 F1 0F 8A 5F BF 09 89 86 C5 1B 7A DE 60 C1 ...._... ...z.`. [2025/04/09 07:45:44.847990, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:44.848129, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:44.849865, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 230 [2025/04/09 07:45:44.850078, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x00f6 (246) auth_length : 0x00aa (170) call_id : 0x0000001d (29) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b60 (2912) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] D1 11 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=178 [0000] 09 06 00 00 01 00 00 00 A1 81 A7 30 81 A4 A0 03 ........ ...0.... [0010] 0A 01 01 A1 0B 06 09 2A 86 48 82 F7 12 01 02 02 .......* .H...... [0020] A2 81 8F 04 81 8C 6F 81 89 30 81 86 A0 03 02 01 ......o. .0...... [0030] 05 A1 03 02 01 0F A2 7A 30 78 A0 03 02 01 12 A2 .......z 0x...... [0040] 71 04 6F E7 58 8B 0F A5 24 B4 83 7B A2 28 39 FC q.o.X... $..{.(9. [0050] FE D6 2D 1F 95 A5 29 96 1C AB 15 B2 9C F5 D2 69 ..-...). .......i [0060] DC EF 60 BE FB 32 06 D8 CE 81 B5 0B EF EC 04 6D ..`..2.. .......m [0070] D3 53 DA D7 62 49 30 23 7D 1C 59 AC D8 9D 0C 2E .S..bI0# }.Y..... [0080] A3 8B 6B F6 42 10 AC 7B 70 A5 6B 1A 1E AF AF 54 ..k.B..{ p.k....T [0090] 45 4D 1D 8C C5 D3 8C FC B6 02 74 E0 78 68 CF A1 EM...... ..t.xh.. [00A0] 38 53 CB 5C F4 77 E3 FB 9A 2E BD F0 FD 5D ED B1 8S.\.w.. .....].. [00B0] 2B D9 +. [2025/04/09 07:45:44.850595, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 246 at offset 0: NT_STATUS_OK [2025/04/09 07:45:44.850624, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 246 bytes. [2025/04/09 07:45:44.850651, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:45:44.850674, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:45:44.851038, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55cf82595480]: subreq: 0x55cf825a79f0 [2025/04/09 07:45:44.851069, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55cf825cca90]: subreq: 0x55cf826034d0 [2025/04/09 07:45:44.851098, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55cf82595480]: NT_STATUS_OK tevent_req[0x55cf825a79f0/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:994] [2025/04/09 07:45:44.851206, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55cf825cca90]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf826034d0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf826036b0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] [2025/04/09 07:45:44.851259, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=135 [0000] A1 81 84 30 81 81 A2 5F 04 5D 6F 5B 30 59 A0 03 ...0..._ .]o[0Y.. [0010] 02 01 05 A1 03 02 01 0F A2 4D 30 4B A0 03 02 01 ........ .M0K.... [0020] 12 A2 44 04 42 EF 31 D7 65 30 45 83 1A 45 3E C4 ..D.B.1. e0E..E>. [0030] 74 D0 D3 62 58 1A 48 BB B2 78 3B 06 05 0B E8 48 t..bX.H. .x;....H [0040] 8C 02 A7 2A 63 5C 38 E2 D7 20 B8 CE B5 94 A2 9A ...*c\8. . ...... [0050] 69 E8 49 32 90 DF AB 02 EF 76 7E 3E DD 2A 69 DE i.I2.... .v~>.*i. [0060] E9 F4 F3 C8 58 F8 3C A3 1E 04 1C 04 04 04 FF FF ....X.<. ........ [0070] FF FF FF 00 00 00 00 0C 8A 7B 01 18 09 75 3C 67 ........ .{...u. t..bX.H. [0040] B2 78 3B 06 05 0B E8 48 8C 02 A7 2A 63 5C 38 E2 .x;....H ...*c\8. [0050] D7 20 B8 CE B5 94 A2 9A 69 E8 49 32 90 DF AB 02 . ...... i.I2.... [0060] EF 76 7E 3E DD 2A 69 DE E9 F4 F3 C8 58 F8 3C A3 .v~>.*i. ....X.<. [0070] 1E 04 1C 04 04 04 FF FF FF FF FF 00 00 00 00 0C ........ ........ [0080] 8A 7B 01 18 09 75 3C 67 FB 67 6E 7B B2 BC 8E .{...upkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_ALTER_RESP (15) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0069 (105) auth_length : 0x0029 (41) call_id : 0x0000001d (29) u : union dcerpc_payload(case 15) alter_resp: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b60 (2912) secondary_address_size : 0x0000 (0) secondary_address : '' _pad1 : DATA_BLOB length=2 [0000] 5C 70 \p num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=49 [0000] 09 06 00 00 01 00 00 00 A1 27 30 25 A0 03 0A 01 ........ .'0%.... [0010] 00 A3 1E 04 1C 04 04 05 FF FF FF FF FF 00 00 00 ........ ........ [0020] 00 13 FD 8B C6 D7 F6 59 9F F4 8B 2A D3 7C 5A CC .......Y ...*.|Z. [0030] 9E . [2025/04/09 07:45:44.853461, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 105 at offset 0: NT_STATUS_OK [2025/04/09 07:45:44.853485, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 105 bytes. [2025/04/09 07:45:44.853508, 4, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1665(check_bind_response) Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly) [2025/04/09 07:45:44.853528, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:45:44.853549, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:45:44.853656, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55cf825cca90]: subreq: 0x55cf826028e0 [2025/04/09 07:45:44.853702, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55cf825cca90]: NT_STATUS_OK tevent_req[0x55cf826028e0/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf82602ac0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] [2025/04/09 07:45:44.853775, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3486(cli_rpc_pipe_open_with_creds) cli_rpc_pipe_open_with_creds: opened pipe lsarpc to machine windc1.adprotocolx.com and bound as user ADPROTOCOLX\GPFSNMBASH$. [2025/04/09 07:45:44.853847, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:2980(cm_connect_lsa) cm_connect_lsa: connected to LSA pipe for domain ADPROTOCOLX using NTLMSSP authenticated pipe: user ADPROTOCOLX\GPFSNMBASH$ [2025/04/09 07:45:44.853921, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy in: struct lsa_OpenPolicy system_name : * system_name : 0x005c (92) attr : * attr: struct lsa_ObjectAttribute len : 0x00000018 (24) root_dir : NULL object_name : NULL attributes : 0x00000000 (0) sec_desc : NULL sec_qos : * sec_qos: struct lsa_QosInfo len : 0x0000000c (12) impersonation_level : LSA_SECURITY_IMPERSONATION (2) context_mode : 0x01 (1) effective_only : 0x00 (0) access_mask : 0x02000000 (33554432) 0: LSA_POLICY_VIEW_LOCAL_INFORMATION 0: LSA_POLICY_VIEW_AUDIT_INFORMATION 0: LSA_POLICY_GET_PRIVATE_INFORMATION 0: LSA_POLICY_TRUST_ADMIN 0: LSA_POLICY_CREATE_ACCOUNT 0: LSA_POLICY_CREATE_SECRET 0: LSA_POLICY_CREATE_PRIVILEGE 0: LSA_POLICY_SET_DEFAULT_QUOTA_LIMITS 0: LSA_POLICY_SET_AUDIT_REQUIREMENTS 0: LSA_POLICY_AUDIT_LOG_ADMIN 0: LSA_POLICY_SERVER_ADMIN 0: LSA_POLICY_LOOKUP_NAMES 0: LSA_POLICY_NOTIFICATION [2025/04/09 07:45:44.854219, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345778-1234-abcd-ef00-0123456789ab if_version : 0x00000000 (0) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:45:44.854451, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x004c (76) call_id : 0x0000001e (30) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x0006 (6) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:44.854642, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:44.854751, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) Sealed 112 bytes, and got 76 bytes header/signature. [2025/04/09 07:45:44.854798, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:44.854846, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:44.856793, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 124 [2025/04/09 07:45:44.856881, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x008c (140) auth_length : 0x004c (76) call_id : 0x0000001e (30) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000018 (24) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=116 [0000] 88 F6 C8 DC 49 E0 F2 C0 83 5A 84 84 97 DA 92 76 ....I... .Z.....v [0010] 29 F2 1B 33 74 0E F4 3B 73 62 EF F4 88 91 99 13 )..3t..; sb...... [0020] 09 06 08 00 01 00 00 00 05 04 07 FF 00 10 00 1C ........ ........ [0030] 00 00 00 00 13 FD 8B C7 BF C6 0C 7C A7 48 F2 29 ........ ...|.H.) [0040] CA 1F C9 B1 7D 46 24 0C A2 12 7B 64 AA D1 37 99 ....}F$. ..{d..7. [0050] BC C4 AC DA 38 B4 7E 74 B5 44 FB A8 2B B5 65 37 ....8.~t .D..+.e7 [0060] 35 78 F3 5E A6 E5 D9 71 C4 AD B1 95 5D 13 E6 6F 5x.^...q ....]..o [0070] 04 60 C1 E6 .`.. [2025/04/09 07:45:44.857230, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:44.857255, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:45:44.857275, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:44.857359, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:306(gssapi_unseal_packet) Unsealed 32 bytes, with 76 bytes header/signature. [2025/04/09 07:45:44.857386, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 140, data_len 24 [2025/04/09 07:45:44.857406, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 140 at offset 0: NT_STATUS_OK [2025/04/09 07:45:44.857427, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 24 bytes. [2025/04/09 07:45:44.857460, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_OpenPolicy: struct lsa_OpenPolicy out: struct lsa_OpenPolicy handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 result : NT_STATUS_OK [2025/04/09 07:45:44.857591, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:458(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:45:44.857655, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids in: struct lsa_LookupSids handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) [2025/04/09 07:45:44.857886, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x004c (76) call_id : 0x0000001f (31) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000054 (84) context_id : 0x0000 (0) opnum : 0x000f (15) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:44.858103, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:44.858205, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) Sealed 96 bytes, and got 76 bytes header/signature. [2025/04/09 07:45:44.858232, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:44.858272, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:44.859271, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 268 [2025/04/09 07:45:44.859327, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x011c (284) auth_length : 0x004c (76) call_id : 0x0000001f (31) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a4 (164) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=260 [0000] F1 91 57 59 F1 73 C9 F4 46 5D 2F A0 55 3E EC FC ..WY.s.. F]/.U>.. [0010] 3B E7 BC DD 8C 17 F1 4C 1A DF 78 88 01 B3 FB 63 ;......L ..x....c [0020] 58 EE 80 16 AE 06 90 6C 37 72 7B CE 85 8F CF B4 X......l 7r{..... [0030] EF DD 72 67 7D EE 49 60 00 AD 04 78 96 37 48 0E ..rg}.I` ...x.7H. [0040] 4C 3A C2 70 9F D4 EE 1D F3 00 EF E0 D8 8D BD 20 L:.p.... ....... [0050] 90 8A 70 19 EE 14 E5 40 20 5F 1E 3E F0 0B 9C 1E ..p....@ _.>.... [0060] C5 CC 32 68 7E EA 40 C3 AC 5C 15 3D F5 BF 5A 1F ..2h~.@. .\.=..Z. [0070] E0 A9 D8 A7 D3 93 71 4F 2B 8A B1 D2 BD 26 FE D1 ......qO +....&.. [0080] 4E C4 CF D2 E0 84 92 27 4D CC 3C D8 23 96 25 17 N......' M.<.#.%. [0090] 43 70 D3 BC 80 A8 EC 68 BE AD D2 FE 56 00 08 17 Cp.....h ....V... [00A0] 1C 41 45 AE 11 C0 0F 60 EA 08 11 44 F8 A9 6C 9E .AE....` ...D..l. [00B0] 09 06 0C 00 01 00 00 00 05 04 07 FF 00 10 00 1C ........ ........ [00C0] 00 00 00 00 13 FD 8B C8 CA 55 8B 59 76 74 30 79 ........ .U.Yvt0y [00D0] 18 78 69 4C E2 2F B1 B0 A0 E3 CA 22 17 41 84 2D .xiL./.. ...".A.- [00E0] CA 52 E2 D7 A5 19 A4 B7 91 7F A6 76 11 6D 46 41 .R...... ...v.mFA [00F0] 98 89 DD A7 44 9B A2 9B 3E 2C 70 E2 67 9A 52 99 ....D... >,p.g.R. [0100] D0 78 DC F8 .x.. [2025/04/09 07:45:44.859807, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:44.859831, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 12 [2025/04/09 07:45:44.859851, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:44.859899, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:306(gssapi_unseal_packet) Unsealed 176 bytes, with 76 bytes header/signature. [2025/04/09 07:45:44.859923, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 284, data_len 164 [2025/04/09 07:45:44.859942, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 284 at offset 0: NT_STATUS_OK [2025/04/09 07:45:44.859998, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 164 bytes. [2025/04/09 07:45:44.860103, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids out: struct lsa_LookupSids domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:45:44.860399, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:300(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:45:44.860430, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:45:44.860480, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:50:44 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:45:44.860572, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:50:44 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:45:44.860615, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:45:44.860763, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:45:44.860786, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:45:46.581182, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:45:46.581241, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:45:46.581337, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:46.581427, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:45:46.581520, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000020 (32) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:46.581822, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:46.581925, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:46.582025, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:46.582932, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:45:46.583013, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000020 (32) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] EB 5D 03 88 62 27 3F AB 1C 18 72 0D 8C 60 7C 0A .]..b'?. ..r..`|. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 47 22 9E ED 60 52 69 2A 37 BE 9C 2E 5B AD 43 65 G"..`Ri* 7...[.Ce [0030] FF 78 69 2B E9 40 77 45 00 00 00 00 00 00 00 00 .xi+.@wE ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:45:46.583333, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:46.583359, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:45:46.583379, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:46.583419, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:45:46.583442, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:45:46.583462, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:45:46.583491, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:45:46.583568, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:45:46.583590, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:46.583650, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:45:46.583671, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:45:50.333977, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:45:50.334041, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:45:50.334121, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:50.334204, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:45:50.334289, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000021 (33) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:50.334477, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:50.334575, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:50.334625, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:50.336277, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:45:50.336332, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000021 (33) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 36 E4 03 AA 2C 4F F9 DE C5 65 6C 63 37 E0 E7 B4 6...,O.. .elc7... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 28 CD C0 36 DB A3 29 4E 3E AE 86 CA 37 AB 8C E1 (..6..)N >...7... [0030] 70 0A 4C B4 79 B5 A5 1E 00 00 00 00 00 00 00 00 p.L.y... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:45:50.336611, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:50.336634, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:45:50.336653, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:50.336691, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:45:50.336713, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:45:50.336731, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:45:50.336757, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:45:50.336834, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:45:50.336856, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:50.336912, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:45:50.336932, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:45:50.346471, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:45:50.346510, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:45:50.346531, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:45:50.346568, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:50.346618, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:45:50.346648, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:45:50.346669, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:45:50.346686, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:45:50.346704, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 07:45:50.346728, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:458(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:45:50.346759, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids in: struct lsa_LookupSids handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) [2025/04/09 07:45:50.346931, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x004c (76) call_id : 0x00000022 (34) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000054 (84) context_id : 0x0000 (0) opnum : 0x000f (15) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:50.347150, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:50.347263, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) Sealed 96 bytes, and got 76 bytes header/signature. [2025/04/09 07:45:50.347292, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:50.347335, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:50.348613, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 268 [2025/04/09 07:45:50.348663, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x011c (284) auth_length : 0x004c (76) call_id : 0x00000022 (34) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a4 (164) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=260 [0000] F3 A7 58 B6 D0 3E 38 E0 3A DE 2A 08 11 3C E5 7C ..X..>8. :.*..<.| [0010] CF 5A E5 39 7B 67 D8 DC D0 BD 19 BD 6E 79 F8 6A .Z.9{g.. ....ny.j [0020] 69 6D 60 81 83 2C BD 4B 8F 8F A7 E2 EC D3 48 6A im`..,.K ......Hj [0030] 7B B8 34 DA 2B 00 7A 7D FB 34 62 0C 42 AB C5 26 {.4.+.z} .4b.B..& [0040] A4 76 6B 86 A7 A0 02 A8 FF 80 1B 57 BD 6B AE 27 .vk..... ...W.k.' [0050] 11 24 A3 CE F5 E7 F3 16 B2 43 58 D9 9D 00 D9 59 .$...... .CX....Y [0060] D8 35 96 66 CB EC AE 6F D0 FE E6 96 C9 A2 CB 69 .5.f...o .......i [0070] F2 4D BA 4C 48 12 9D AB 0C 9C FA BC CD 98 82 63 .M.LH... .......c [0080] 4D E7 91 81 86 F5 43 9D CE 20 CF F1 E8 9A DD 47 M.....C. . .....G [0090] DD 61 28 E6 EB 3C E9 87 F3 E1 63 F7 97 78 EC 61 .a(..<.. ..c..x.a [00A0] C8 F1 8D AF 10 7E E0 34 B2 09 A4 36 DC AF 5F E2 .....~.4 ...6.._. [00B0] 09 06 0C 00 01 00 00 00 05 04 07 FF 00 10 00 1C ........ ........ [00C0] 00 00 00 00 13 FD 8B C9 23 9A 3A B6 4A 7A E4 DE ........ #.:.Jz.. [00D0] CC 9E AF 28 C6 9F A1 68 F9 77 8A 52 4C DA 96 B7 ...(...h .w.RL... [00E0] 2A 82 F3 EA C0 2A 11 EF 21 35 43 CB 14 28 AE 44 *....*.. !5C..(.D [00F0] FA E1 B9 71 D3 90 4A FC 66 7B 1A 1F 9E 1D B2 C6 ...q..J. f{...... [0100] CE 05 77 F2 ..w. [2025/04/09 07:45:50.349196, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:50.349220, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 12 [2025/04/09 07:45:50.349239, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:50.349274, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:306(gssapi_unseal_packet) Unsealed 176 bytes, with 76 bytes header/signature. [2025/04/09 07:45:50.349297, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 284, data_len 164 [2025/04/09 07:45:50.349315, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 284 at offset 0: NT_STATUS_OK [2025/04/09 07:45:50.349333, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 164 bytes. [2025/04/09 07:45:50.349366, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids out: struct lsa_LookupSids domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:45:50.349599, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:300(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:45:50.349624, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:45:50.349657, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:50:50 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:45:50.349700, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:50:50 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:45:50.349733, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:45:50.349828, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:45:50.349849, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:45:55.798221, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:45:55.798286, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:45:55.798367, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:45:55.798444, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:45:55.798530, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000023 (35) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:55.798717, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:55.798831, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:55.798900, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:55.799940, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:45:55.800020, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000023 (35) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] B4 D3 CF 50 B0 FA BA 80 DC CF 98 3F 5C E0 1E 6E ...P.... ...?\..n [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 07 FF B5 50 95 E2 98 59 57 D5 68 3B 8D 47 95 47 ...P...Y W.h;.G.G [0030] 0F DD E0 D3 3A D0 4E ED 80 AA 3F F6 DB AE DB 01 ....:.N. ..?..... [0040] 80 6A 5B CD 5B A9 DB 01 00 00 00 00 00 00 00 00 .j[.[... ........ [2025/04/09 07:45:55.800326, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:55.800353, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:45:55.800377, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:55.800408, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:45:55.800429, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:45:55.800463, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:45:55.800490, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:45:55.800557, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:45:55.800577, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:45:55.800633, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:45:55.800652, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:45:55.809513, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 28 extra bytes [2025/04/09 07:45:55.809557, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:45:55.809578, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_LookupSid (domain 'ADPROTOCOLX') [2025/04/09 07:45:55.809615, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid in: struct wbint_LookupSid sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 [2025/04/09 07:45:55.809675, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:45:55.809722, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/namemap_cache.c:162(namemap_cache_find_sid) namemap_cache_find_sid: gencache_parse(SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104) failed [2025/04/09 07:45:55.809753, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1944(wcache_sid_to_name) wcache_sid_to_name: namemap_cache_find_name failed [2025/04/09 07:45:55.809772, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:1981(wb_cache_sid_to_name) wb_cache_sid_to_name: sid_to_name: [Cached] - doing backend query for name for domain ADPROTOCOLX [2025/04/09 07:45:55.809790, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:309(msrpc_sid_to_name) msrpc_sid_to_name: S-1-5-21-3967939894-2044440985-2694731363-1104 for domain ADPROTOCOLX [2025/04/09 07:45:55.809821, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:458(dcerpc_lsa_lookup_sids_generic) rpccli_lsa_lookup_sids: processing items 0 -- 0 of 1. [2025/04/09 07:45:55.809855, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids in: struct lsa_LookupSids handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 sids : * sids: struct lsa_SidArray num_sids : 0x00000001 (1) sids : * sids: ARRAY(1) sids: struct lsa_SidPtr sid : * sid : S-1-5-21-3967939894-2044440985-2694731363-1104 names : * names: struct lsa_TransNameArray count : 0x00000000 (0) names : NULL level : LSA_LOOKUP_NAMES_DOMAINS_ONLY (2) count : * count : 0x00000000 (0) [2025/04/09 07:45:55.810055, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x004c (76) call_id : 0x00000024 (36) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000054 (84) context_id : 0x0000 (0) opnum : 0x000f (15) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:45:55.810255, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:45:55.810366, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) Sealed 96 bytes, and got 76 bytes header/signature. [2025/04/09 07:45:55.810393, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:45:55.810425, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:45:55.811340, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 268 [2025/04/09 07:45:55.811392, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x011c (284) auth_length : 0x004c (76) call_id : 0x00000024 (36) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x000000a4 (164) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=260 [0000] 11 D7 17 36 B5 5F D2 5D F5 1A DA 91 2E CE 42 19 ...6._.] ......B. [0010] 3E B1 7D 15 DF 25 7D 73 83 69 04 3B 14 31 A5 86 >.}..%}s .i.;.1.. [0020] 54 30 14 59 3E 97 4A 20 17 5D FC B0 F0 79 87 94 T0.Y>.J .]...y.. [0030] 24 DB 62 00 31 48 2C 11 C6 8D 58 47 D3 29 AA C0 $.b.1H,. ..XG.).. [0040] 15 BA 12 24 8C 04 40 E8 D1 DF EB 45 E6 81 7F 0E ...$..@. ...E.... [0050] 26 44 48 20 93 00 77 03 CC 99 47 03 8F 89 14 80 &DH ..w. ..G..... [0060] 4B 38 6F D7 F0 7A 2E E6 13 4C CB 61 F0 9D 43 2F K8o..z.. .L.a..C/ [0070] 40 59 62 D1 56 C0 B0 0A 2A 6C BB 67 86 96 BD 8D @Yb.V... *l.g.... [0080] 69 23 CE BA 88 E1 69 85 4A 7E C6 1E 33 D3 37 5E i#....i. J~..3.7^ [0090] DA 89 70 4A 81 0B A6 4E D3 C8 8C BE E8 50 61 B4 ..pJ...N .....Pa. [00A0] F3 7B 8A 43 85 1E F9 FE 0C 41 DB 28 1A 4A 14 B2 .{.C.... .A.(.J.. [00B0] 09 06 0C 00 01 00 00 00 05 04 07 FF 00 10 00 1C ........ ........ [00C0] 00 00 00 00 13 FD 8B CA 19 D2 57 A6 09 A3 98 B8 ........ ..W..... [00D0] 15 C3 4A 04 D4 22 D7 FD 42 F6 6A D1 78 72 AC 20 ..J..".. B.j.xr. [00E0] B7 11 B3 C8 AB 30 28 86 2B F7 CC 36 FC A1 3A A4 .....0(. +..6..:. [00F0] 43 81 8D 18 02 02 AF 1B B3 31 2E 3A 63 FB F8 51 C....... .1.:c..Q [0100] 30 EF 6F D6 0.o. [2025/04/09 07:45:55.811896, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:45:55.811919, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 12 [2025/04/09 07:45:55.811943, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:45:55.812012, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:306(gssapi_unseal_packet) Unsealed 176 bytes, with 76 bytes header/signature. [2025/04/09 07:45:55.812037, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 284, data_len 164 [2025/04/09 07:45:55.812055, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 284 at offset 0: NT_STATUS_OK [2025/04/09 07:45:55.812077, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 164 bytes. [2025/04/09 07:45:55.812112, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_LookupSids: struct lsa_LookupSids out: struct lsa_LookupSids domains : * domains : * domains: struct lsa_RefDomainList count : 0x00000001 (1) domains : * domains: ARRAY(1) domains: struct lsa_DomainInfo name: struct lsa_StringLarge length : 0x0016 (22) size : 0x0018 (24) string : * string : 'ADPROTOCOLX' sid : * sid : S-1-5-21-3967939894-2044440985-2694731363 max_size : 0x00000020 (32) names : * names: struct lsa_TransNameArray count : 0x00000001 (1) names : * names: ARRAY(1) names: struct lsa_TranslatedName sid_type : SID_NAME_USER (1) name: struct lsa_String length : 0x0014 (20) size : 0x0014 (20) string : * string : 'adxuser191' sid_index : 0x00000000 (0) count : * count : 0x00000001 (1) result : NT_STATUS_OK [2025/04/09 07:45:55.812355, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/rpc_client/cli_lsarpc.c:300(dcerpc_lsa_lookup_sids_noalloc) LSA_LOOKUPSIDS returned status: 'NT_STATUS_OK', result: 'NT_STATUS_OK', mapped count = 1' [2025/04/09 07:45:55.812378, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_msrpc.c:329(msrpc_sid_to_name) Mapped sid to [ADPROTOCOLX]\[adxuser191] [2025/04/09 07:45:55.812413, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SID2NAME/S-1-5-21-3967939894-2044440985-2694731363-1104] and timeout=[Wed Apr 9 07:50:55 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:45:55.812462, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NAME2SID/ADPROTOCOLX\ADXUSER191] and timeout=[Wed Apr 9 07:50:55 AM 2025 EDT] (300 seconds ahead) [2025/04/09 07:45:55.812497, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_LookupSid: struct wbint_LookupSid out: struct wbint_LookupSid type : * type : SID_NAME_USER (1) domain : * domain : * domain : 'ADPROTOCOLX' name : * name : * name : 'adxuser191' result : NT_STATUS_OK [2025/04/09 07:45:55.812581, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:45:55.812602, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4072 bytes to parent [2025/04/09 07:46:01.286825, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:46:01.286897, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:46:01.287056, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:46:01.287179, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:46:01.287287, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000025 (37) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:46:01.287488, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:46:01.287597, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:46:01.287668, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:46:01.289219, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:46:01.289273, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000025 (37) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 40 6A 0E 1E 9B D7 83 1B 27 FF 08 13 D2 BE 96 39 @j...... '......9 [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 36 08 F0 50 32 EE 6D 5E 6E EA AF 85 DB C7 95 58 6..P2.m^ n......X [0030] 30 1D E4 27 06 13 3D 92 00 00 00 00 00 00 00 00 0..'..=. ........ [0040] 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:46:01.289528, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:46:01.289552, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:46:01.289575, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:46:01.289609, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:46:01.289632, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:46:01.289651, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:46:01.289686, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:46:01.289781, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:46:01.289804, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:46:01.289867, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:46:01.289887, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:46:01.573613, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:46:01.573659, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:46:01.573729, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:46:01.573801, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:46:01.573887, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000026 (38) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:46:01.574145, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:46:01.574249, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:46:01.574305, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:46:01.575120, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:46:01.575175, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000026 (38) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] FB 81 52 2B 77 B9 CD 19 92 87 48 83 D0 F7 B2 44 ..R+w... ..H....D [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 2E 80 F3 23 D3 54 F9 03 86 96 75 D4 0A F3 37 15 ...#.T.. ..u...7. [0030] 76 AB 69 8E 0C 55 8D 84 BF C6 0C 7C A7 48 F2 29 v.i..U.. ...|.H.) [0040] CA 1F C9 B1 7D 46 24 0C A2 12 7B 64 AA D1 37 99 ....}F$. ..{d..7. [2025/04/09 07:46:01.575436, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:46:01.575466, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:46:01.575486, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:46:01.575520, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:46:01.575542, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:46:01.575562, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc1.adprotocolx.com returned 12 bytes. [2025/04/09 07:46:01.575599, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:46:01.575683, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:46:01.575707, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc1.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:46:01.575766, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:46:01.575787, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:46:16.310135, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 36 extra bytes [2025/04/09 07:46:16.310247, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:46:16.310289, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') [2025/04/09 07:46:16.310429, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:46:16.310589, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName in: struct netr_GetAnyDCName logon_server : * logon_server : 'windc1.adprotocolx.com' domainname : * domainname : 'adprotocolx' [2025/04/09 07:46:16.310707, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000027 (39) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x000d (13) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:46:16.310903, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:46:16.311050, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:46:16.311155, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:46:16.567617, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:46:16.567764, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:46:16.568019, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:46:16.568320, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc1.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:46:16.568446, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:46:16.568668, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000006 (6) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000088 (136) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:46:16.568859, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:46:16.568997, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:46:16.569105, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:46:26.576209, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:46:27.577517, 1, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/tstream_smbXcli_np.c:139(tstream_smbXcli_np_destructor) tstream_smbXcli_np_destructor: cli_close failed on pipe netlogon. Error was NT_STATUS_IO_TIMEOUT [2025/04/09 07:46:27.577760, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) cli_api_pipe failed: NT_STATUS_IO_TIMEOUT [2025/04/09 07:46:27.577830, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 10000 (ms) to 1000 (ms). [2025/04/09 07:46:27.577939, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 1000 (ms) to 500 (ms). [2025/04/09 07:46:27.578055, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 500 (ms) to 500 (ms). [2025/04/09 07:46:27.578157, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:46:28.079017, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1956(connection_ok) connection_ok: Connection to windc1.adprotocolx.com for domain ADPROTOCOLX is not connected [2025/04/09 07:46:28.079118, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1770(cm_open_connection) Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. [2025/04/09 07:46:28.079157, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) Attempt 0/3: DC 'windc1.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 07:46:28.079180, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 07:46:28.079275, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc1.adprotocolx.com" for "ADPROTOCOLX" domain [2025/04/09 07:46:28.079302, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc1.adprotocolx.com [2025/04/09 07:46:28.079325, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1446(connect_preferred_dc) connect_preferred_dc: saf_servername is 'windc1.adprotocolx.com' for domain ADPROTOCOLX [2025/04/09 07:46:28.079361, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:46:28.079391, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc1.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:46:28.079441, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc1.adprotocolx.com#20 found. [2025/04/09 07:46:28.079487, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:28.079524, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.92'. [2025/04/09 07:46:28.079576, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.92'. [2025/04/09 07:46:28.079613, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.92 (realm: ADPROTOCOLX.COM) [2025/04/09 07:46:34.082211, 2, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/cldap.c:417(ads_cldap_netlogon) ads_cldap_netlogon: did not get a reply [2025/04/09 07:46:34.082303, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:387(ads_try_connect) ads_try_connect: ads_cldap_netlogon_5(10.28.1.92, ADPROTOCOLX.COM) failed. [2025/04/09 07:46:34.082398, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc1.adprotocolx.com] and timeout=[Wed Apr 9 07:47:34 AM 2025 EDT] (60 seconds ahead) [2025/04/09 07:46:34.082546, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX (windc1.adprotocolx.com) to failed conn cache [2025/04/09 07:46:34.082619, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) [2025/04/09 07:46:34.082655, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) [2025/04/09 07:46:34.082691, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [ADPROTOCOLX] [2025/04/09 07:46:34.082721, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc1.adprotocolx.com] and timeout=[Wed Apr 9 07:47:34 AM 2025 EDT] (60 seconds ahead) [2025/04/09 07:46:34.082773, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX.COM (windc1.adprotocolx.com) to failed conn cache [2025/04/09 07:46:34.082797, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 07:46:34.082827, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 07:46:34.082860, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [ADPROTOCOLX.COM] [2025/04/09 07:46:34.082889, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1549(find_dc) Retrieving a list of IP addresses for DCs. [2025/04/09 07:46:34.082950, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:46:34.083037, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) ads_dc_name: domain=ADPROTOCOLX [2025/04/09 07:46:34.083089, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:46:34.083115, 6, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'ADPROTOCOLX.COM' [2025/04/09 07:46:34.083135, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) [2025/04/09 07:46:34.083174, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:46:34.083199, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:46:34.083223, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) [2025/04/09 07:46:34.083276, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/ADPROTOCOLX.COM#1C] and timeout=[Wed Dec 31 07:00:00 PM 1969 EST] (-1744199194 seconds in the past) [2025/04/09 07:46:34.083331, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:324(namecache_fetch) namecache_fetch: no entry for ADPROTOCOLX.COM#1C found. [2025/04/09 07:46:34.083377, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2509(resolve_ads) resolve_ads: Attempting to resolve DCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:46:34.083438, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _ldap._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:46:34.083562, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:46:34.083592, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:34.083842, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] F3 E4 01 00 00 01 00 00 00 00 00 00 05 5F 6C 64 ........ ....._ld [0010] 61 70 04 5F 74 63 70 17 44 65 66 61 75 6C 74 2D ap._tcp. Default- [0020] 46 69 72 73 74 2D 53 69 74 65 2D 4E 61 6D 65 06 First-Si te-Name. [0030] 5F 73 69 74 65 73 02 64 63 06 5F 6D 73 64 63 73 _sites.d c._msdcs [0040] 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 03 43 4F 4D .ADPROTO COLX.COM [0050] 00 00 21 00 01 ..!.. [2025/04/09 07:46:35.085199, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:46:35.085281, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:46:35.085308, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:35.085436, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] BC 33 01 00 00 01 00 00 00 00 00 00 05 5F 6C 64 .3...... ....._ld [0010] 61 70 04 5F 74 63 70 17 44 65 66 61 75 6C 74 2D ap._tcp. Default- [0020] 46 69 72 73 74 2D 53 69 74 65 2D 4E 61 6D 65 06 First-Si te-Name. [0030] 5F 73 69 74 65 73 02 64 63 06 5F 6D 73 64 63 73 _sites.d c._msdcs [0040] 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 03 43 4F 4D .ADPROTO COLX.COM [0050] 00 00 21 00 01 ..!.. [2025/04/09 07:46:35.085577, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:46:35.086112, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] BC 33 85 80 00 01 00 02 00 00 00 06 05 5F 6C 64 .3...... ....._ld [0010] 61 70 04 5F 74 63 70 17 44 65 66 61 75 6C 74 2D ap._tcp. Default- [0020] 46 69 72 73 74 2D 53 69 74 65 2D 4E 61 6D 65 06 First-Si te-Name. [0030] 5F 73 69 74 65 73 02 64 63 06 5F 6D 73 64 63 73 _sites.d c._msdcs [0040] 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 03 43 4F 4D .ADPROTO COLX.COM [0050] 00 00 21 00 01 C0 0C 00 21 00 01 00 00 02 58 00 ..!..... !.....X. [0060] 1E 00 00 00 64 01 85 06 77 69 6E 64 63 32 0B 61 ....d... windc2.a [0070] 64 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 dprotoco lx.com.. [0080] 0C 00 21 00 01 00 00 02 58 00 1E 00 00 00 64 01 ..!..... X.....d. [0090] 85 06 77 69 6E 64 63 31 0B 61 64 70 72 6F 74 6F ..windc1 .adproto [00A0] 63 6F 6C 78 03 63 6F 6D 00 C0 67 00 01 00 01 00 colx.com ..g..... [00B0] 00 0E 10 00 04 0A 1C 01 5D C0 67 00 01 00 01 00 ........ ].g..... [00C0] 00 0E 10 00 04 C0 A8 7A CE C0 67 00 1C 00 01 00 .......z ..g..... [00D0] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. [00E0] D7 81 C8 0F 00 C0 91 00 01 00 01 00 00 0E 10 00 ........ ........ [00F0] 04 0A 1C 01 5C C0 91 00 01 00 01 00 00 0E 10 00 ....\... ........ [0100] 04 C0 A8 7A 85 C0 91 00 1C 00 01 00 00 0E 10 00 ...z.... ........ [0110] 10 20 01 01 92 00 00 00 00 65 6A 03 48 28 E1 00 . ...... .ej.H(.. [0120] D1 . [2025/04/09 07:46:35.086544, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:46:35.086575, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:46:35.086594, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:35.086613, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:46:35.086638, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:46:35.086656, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:35.086677, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:35.086696, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 6 addresses for ADPROTOCOLX.COM#1c: 10.28.1.93,192.168.122.206,[2001:192::c973:d0d7:81c8:f00],10.28.1.92,192.168.122.133,[2001:192::656a:348:28e1:d1] [2025/04/09 07:46:35.086745, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/ADPROTOCOLX.COM#1C] and timeout=[Wed Apr 9 07:57:35 AM 2025 EDT] (660 seconds ahead) internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:35.086837, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:46:35.086868, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:46:35.086899, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:46:35.086936, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:35.087010, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:46:35.087044, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:46:35.087086, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:35.087107, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:35.087138, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:46:35.087160, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:35.087189, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:46:35.087215, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:46:35.087239, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:46:35.087262, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:46:35.087286, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:35.087318, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:35.087340, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) cldap_ping_list: Try to create 6 netlogon connections for domain 'ADPROTOCOLX.COM' (provided count of addresses was 6). [2025/04/09 07:46:35.088353, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:46:35.088779, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:46:35.088806, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477604 seconds ahead) [2025/04/09 07:46:35.088848, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:46:35.088868, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477604 seconds ahead) [2025/04/09 07:46:35.088901, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) cldap_ping_list: realm[ADPROTOCOLX.COM]: selected 10.28.1.93 => windc2.adprotocolx.com [2025/04/09 07:46:35.088921, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:46:35.089279, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:46:35.089316, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:46:35.089341, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:46:35.089418, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:46:35.089447, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:46:35.089469, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:46:35.089487, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:46:35.089529, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:46:35.089551, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:46:35.089699, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:46:35.089723, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:35.089801, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 1D 9F 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:46:36.091008, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:46:36.091092, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:46:36.091116, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:36.091246, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 04 54 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .T...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:46:36.091364, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:46:36.091973, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 04 54 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .T...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. [0120] D7 81 C8 0F 00 ..... [2025/04/09 07:46:36.092355, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:46:36.092384, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:46:36.092403, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:36.092423, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:46:36.092441, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:46:36.092458, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:36.092479, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:36.092539, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:46:36.092577, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:46:36.092600, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:46:36.092622, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:36.092643, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:46:36.092664, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:46:36.092685, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:36.092703, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:36.092725, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:46:36.092742, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:36.092765, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:46:36.092789, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:46:36.092810, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:46:36.092828, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:46:36.092850, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:46:36.092868, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:46:36.092938, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:46:36.092988, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:36.093059, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] B3 91 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:46:37.094247, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:46:37.094359, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:46:37.094388, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:37.094585, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 75 2D 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 u-...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:46:37.094700, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:46:37.095244, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 75 2D 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 u-...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s [0100] D0 D7 81 C8 0F 00 ...... [2025/04/09 07:46:37.095612, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:46:37.095643, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:46:37.095663, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:37.095684, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:46:37.095703, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:46:37.095721, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:37.095743, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:37.095801, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:46:37.095835, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:46:37.095859, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:46:37.095881, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:37.095904, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:46:37.095926, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:46:37.095948, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:37.096023, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:37.096046, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:46:37.096065, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:37.096100, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:46:37.096125, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:46:37.297771, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:46:40.097438, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:46:40.097619, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:46:40.097665, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 [2025/04/09 07:46:40.097718, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:46:40.097739, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) [2025/04/09 07:46:40.097764, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:46:40.097787, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:46:40.097806, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) [2025/04/09 07:46:40.097831, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:46:40.097866, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:40.097886, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:46:40.097909, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:46:40.097945, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:46:40.097999, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:40.098035, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:46:40.098057, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:46:40.098079, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:40.098097, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:40.098116, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:46:40.098144, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:40.098181, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:46:40.098213, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:46:40.098257, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:46:40.098307, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:46:40.098334, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:40.098408, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:40.098446, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename NULL) [2025/04/09 07:46:40.098481, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:46:40.098503, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:46:40.098522, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename (null)) [2025/04/09 07:46:40.098557, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:46:40.098592, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:40.098659, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:46:40.098701, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:46:40.098729, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:46:40.098761, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:40.098782, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:46:40.098803, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:46:40.098823, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:40.098841, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:40.098859, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:46:40.098876, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:40.098901, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:46:40.098923, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:46:40.098944, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:46:40.098998, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:46:40.099055, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:40.099081, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:40.099112, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1553(find_dc) Retrieved IP addresses for 6 DCs. [2025/04/09 07:46:40.099148, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1574(find_dc) Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). [2025/04/09 07:46:40.099246, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 445 [2025/04/09 07:46:40.100019, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1589(find_dc) Successfully connected to DC '10.28.1.93'. [2025/04/09 07:46:40.100065, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. [2025/04/09 07:46:40.100109, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.93'. [2025/04/09 07:46:40.100134, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) [2025/04/09 07:46:40.100814, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:46:40.101210, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:46:40.101250, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477599 seconds ahead) [2025/04/09 07:46:40.101300, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:46:40.101321, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477599 seconds ahead) [2025/04/09 07:46:40.101358, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:46:40.101382, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 [2025/04/09 07:46:40.101406, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:57:40 AM 2025 EDT] (660 seconds ahead) [2025/04/09 07:46:40.101462, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f1fc [2025/04/09 07:46:40.101486, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:46:40.101508, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:46:40.101551, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:46:40.101582, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:46:40.101619, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:46:40.101649, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:46:40.101670, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:46:40.101690, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:46:40.101745, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:46:40.101766, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:40.101826, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 72 5C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 r\...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:46:41.103078, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:46:41.103162, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:46:41.103186, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:41.103302, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 08 5C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .\...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:46:41.103423, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:46:41.103918, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 08 5C 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .\...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 07:46:41.104320, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:46:41.104351, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:46:41.104370, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:41.104400, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:46:41.104419, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:46:41.104437, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:41.104462, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:41.104506, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:46:41.104546, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:46:41.104569, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:46:41.104591, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:41.104634, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:46:41.104660, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:46:41.104683, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:41.104702, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:41.104732, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:46:41.104749, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:41.104771, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:46:41.104796, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:46:41.104818, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:46:41.104836, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:46:41.104857, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:46:41.104881, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:46:41.104952, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:46:41.105020, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:41.105094, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 6F CF 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 o....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:46:42.106038, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:46:42.106109, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:46:42.106136, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:46:42.106243, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] A3 5A 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .Z...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:46:42.106344, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:46:42.106713, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] A3 5A 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .Z...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej [0100] 03 48 28 E1 00 D1 .H(... [2025/04/09 07:46:42.107084, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:46:42.107126, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:46:42.107156, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:42.107179, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:46:42.107199, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:46:42.107218, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:42.107241, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:42.107289, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:46:42.107323, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:46:42.107348, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:46:42.107372, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:46:42.107399, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:46:42.107421, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:46:42.107445, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:42.107465, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:46:42.107486, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:46:42.107505, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:46:42.107530, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:46:42.107554, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:46:42.208821, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:46:45.108821, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:46:45.109066, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:46:45.109167, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200105] [2025/04/09 07:46:45.109200, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:01:45 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:46:45.109249, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200105] [2025/04/09 07:46:45.109270, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:01:45 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:46:45.109301, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' [2025/04/09 07:46:45.109337, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 07:46:45.109625, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). [2025/04/09 07:46:45.109762, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1019(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:46:45.111205, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:861(cm_prepare_connection) connecting to windc2.adprotocolx.com (ADPROTOCOLX, ADPROTOCOLX.COM) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] [2025/04/09 07:46:45.111267, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com [2025/04/09 07:46:45.111517, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] [2025/04/09 07:46:45.111612, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199205.111493: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:46:45.112882, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199205.111495: Sending unauthenticated request [2025/04/09 07:46:45.112940, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199205.111496: Sending request (182 bytes) to ADPROTOCOLX.COM [2025/04/09 07:46:45.113271, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199205.111497: Resolving hostname 10.28.1.93 [2025/04/09 07:46:45.113479, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199205.111498: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 07:46:45.114492, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199205.111499: Received answer (219 bytes) from dgram 10.28.1.93:88 [2025/04/09 07:46:45.114594, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199205.111500: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:46:50.118703, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199210.118683: No URI records found [2025/04/09 07:46:50.119065, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199210.118684: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. [2025/04/09 07:46:51.346546, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:46:52.347871, 1, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/tstream_smbXcli_np.c:139(tstream_smbXcli_np_destructor) tstream_smbXcli_np_destructor: cli_close failed on pipe netlogon. Error was NT_STATUS_IO_TIMEOUT [2025/04/09 07:46:52.348076, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) cli_api_pipe failed: NT_STATUS_IO_TIMEOUT [2025/04/09 07:46:52.348195, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 10000 (ms) to 1000 (ms). [2025/04/09 07:46:52.348276, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) lsa_Close: struct lsa_Close in: struct lsa_Close handle : * handle: struct policy_handle handle_type : 0x00000000 (0) uuid : 6e8dc765-78dc-49fb-8b33-05975741f636 [2025/04/09 07:46:52.348448, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x004c (76) call_id : 0x00000028 (40) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000014 (20) context_id : 0x0000 (0) opnum : 0x0000 (0) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:46:52.348684, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SPNEGO (9) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:46:52.349092, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/kerberos/gssapi_helper.c:209(gssapi_seal_packet) Sealed 32 bytes, and got 76 bytes header/signature. [2025/04/09 07:46:52.349141, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc1.adprotocolx.com [2025/04/09 07:46:52.349204, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:46:55.125075, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199215.125063: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:46:58.195697, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195681: No SRV records found [2025/04/09 07:46:58.195795, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195682: Response was not from master KDC [2025/04/09 07:46:58.195887, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195683: Received error from KDC: -1765328359/Additional pre-authentication required [2025/04/09 07:46:58.196079, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195686: Preauthenticating using KDC method data [2025/04/09 07:46:58.196123, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195687: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) [2025/04/09 07:46:58.196163, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195688: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:46:58.200235, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195689: AS key obtained for encrypted timestamp: aes256-cts/C8D8 [2025/04/09 07:46:58.200312, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195691: Encrypted timestamp (for 1744210003.931221): plain 301AA011180F32303235303430393134343634335AA10502030E3595, encrypted 484453365B41F286ADC256916C113D9F9BF7E81782D91E17ACCF99F8148FDC19CB1E023B3386B7D3146B949A40571F81F9220BBD92C1F36A [2025/04/09 07:46:58.200358, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195692: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [2025/04/09 07:46:58.200385, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195693: Produced preauth for next request: PA-ENC-TIMESTAMP (2) [2025/04/09 07:46:58.200454, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195694: Sending request (261 bytes) to ADPROTOCOLX.COM [2025/04/09 07:46:58.200545, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195695: Resolving hostname 10.28.1.93 [2025/04/09 07:46:58.200665, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195696: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 07:46:58.203587, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195697: Received answer (102 bytes) from dgram 10.28.1.93:88 [2025/04/09 07:46:58.203689, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199218.195698: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:47:01.267995, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199221.267940: No URI records found [2025/04/09 07:47:01.268179, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199221.267941: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. [2025/04/09 07:47:02.359510, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:47:03.360713, 1, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/tstream_smbXcli_np.c:139(tstream_smbXcli_np_destructor) tstream_smbXcli_np_destructor: cli_close failed on pipe lsarpc. Error was NT_STATUS_IO_TIMEOUT [2025/04/09 07:47:03.360808, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) cli_api_pipe failed: NT_STATUS_IO_TIMEOUT [2025/04/09 07:47:03.361299, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 1000 (ms) to 500 (ms). [2025/04/09 07:47:03.361344, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc1.adprotocolx.com' from 500 (ms) to 500 (ms). [2025/04/09 07:47:03.361423, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:47:03.862190, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1956(connection_ok) connection_ok: Connection to windc1.adprotocolx.com for domain ADPROTOCOLX is not connected [2025/04/09 07:47:03.862263, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1770(cm_open_connection) Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. [2025/04/09 07:47:03.862287, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) Attempt 0/3: DC 'windc1.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 07:47:03.862306, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 07:47:03.862372, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX" domain [2025/04/09 07:47:03.862400, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc2.adprotocolx.com [2025/04/09 07:47:03.862421, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1446(connect_preferred_dc) connect_preferred_dc: saf_servername is 'windc2.adprotocolx.com' for domain ADPROTOCOLX [2025/04/09 07:47:03.862464, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:03.862490, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:47:03.862528, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:47:03.862559, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:03.862587, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. [2025/04/09 07:47:03.862612, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.93'. [2025/04/09 07:47:03.862644, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) [2025/04/09 07:47:03.863554, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:47:03.863926, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:47:03.863977, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477576 seconds ahead) [2025/04/09 07:47:03.864061, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:47:03.864085, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477576 seconds ahead) [2025/04/09 07:47:03.864124, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:47:03.864153, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 [2025/04/09 07:47:03.864178, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:58:03 AM 2025 EDT] (660 seconds ahead) [2025/04/09 07:47:03.864222, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f1fc [2025/04/09 07:47:03.864250, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:47:03.864273, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:03.864322, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:47:03.864350, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:03.864374, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc2.adprotocolx.com, *" [2025/04/09 07:47:03.864396, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:47:03.864418, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:47:03.864450, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:47:03.864525, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:47:03.864550, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:03.864622, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 0E 34 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .4...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:47:04.339669, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199224.339646: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:47:04.865818, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:47:04.865919, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:47:04.865945, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:04.866153, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] CB 23 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .#...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:47:04.866296, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:47:04.866903, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] CB 23 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .#...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. [0120] D7 81 C8 0F 00 ..... [2025/04/09 07:47:04.867330, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:47:04.867361, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:47:04.867381, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:04.867411, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:47:04.867446, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:47:04.867465, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:04.867487, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:04.867551, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:04.867606, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:04.867636, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:47:04.867660, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:47:04.867685, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:04.867709, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:04.867733, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:04.867754, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:04.867776, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:04.867798, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:04.867818, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:04.867839, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:04.867858, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:04.867877, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:04.867899, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 10.28.1.92 192.168.122.133 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:04.867924, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:47:04.867948, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:04.867997, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc2.adprotocolx.com, *" [2025/04/09 07:47:04.868039, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:47:04.868061, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:47:04.868080, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:47:04.868144, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:47:04.868165, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:04.868223, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] E5 E1 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:47:05.869394, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:47:05.869491, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:47:05.869523, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:05.869667, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 12 FC 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:47:05.869770, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:47:05.870272, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 12 FC 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s [0100] D0 D7 81 C8 0F 00 ...... [2025/04/09 07:47:05.870658, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:47:05.870689, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:47:05.870709, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:05.870729, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:47:05.870748, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:47:05.870767, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:05.870788, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:05.870834, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:05.870882, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:05.870905, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:47:05.870930, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:47:05.870955, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:05.871012, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:05.871051, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:05.871076, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:05.871108, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:05.871132, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:05.871154, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:05.871176, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:05.871195, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:05.871215, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:05.871233, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 10.28.1.92 192.168.122.133 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:05.871257, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:47:05.871278, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:47:06.072734, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:47:07.411569, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411559: No SRV records found [2025/04/09 07:47:07.411640, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411560: Response was not from master KDC [2025/04/09 07:47:07.411730, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411561: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP [2025/04/09 07:47:07.411769, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411562: Request or response is too big for UDP; retrying with TCP [2025/04/09 07:47:07.411796, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411563: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) [2025/04/09 07:47:07.411908, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411564: Resolving hostname 10.28.1.93 [2025/04/09 07:47:07.412113, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411565: Initiating TCP connection to stream 10.28.1.93:88 [2025/04/09 07:47:07.412466, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411566: Sending TCP request to stream 10.28.1.93:88 [2025/04/09 07:47:07.413875, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411567: Received answer (1596 bytes) from stream 10.28.1.93:88 [2025/04/09 07:47:07.413918, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411568: Terminating TCP connection to stream 10.28.1.93:88 [2025/04/09 07:47:07.414048, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199227.411569: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:47:08.872429, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:47:08.872661, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:47:08.872730, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200128] [2025/04/09 07:47:08.872768, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:02:08 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:47:08.872819, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200128] [2025/04/09 07:47:08.872840, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:02:08 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:47:08.872872, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' [2025/04/09 07:47:08.872903, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server windc2.adprotocolx.com [2025/04/09 07:47:08.873000, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 445 [2025/04/09 07:47:08.873702, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 07:47:10.483863, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199230.483850: No URI records found [2025/04/09 07:47:10.484068, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199230.483851: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:47:13.555644, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555627: No SRV records found [2025/04/09 07:47:13.555735, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555628: Response was not from master KDC [2025/04/09 07:47:13.555934, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555629: Processing preauth types: PA-ETYPE-INFO2 (19) [2025/04/09 07:47:13.556015, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555630: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:47:13.556052, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555631: Produced preauth for next request: (empty) [2025/04/09 07:47:13.556110, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555632: AS key determined by preauth: aes256-cts/C8D8 [2025/04/09 07:47:13.556243, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555633: Decrypted AS reply; session key is: aes256-cts/3391 [2025/04/09 07:47:13.556292, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555634: FAST negotiation: unavailable [2025/04/09 07:47:13.556414, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:47:13.556448, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555635: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:47:13.556485, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199233.555636: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect [2025/04/09 07:47:13.556555, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos [2025/04/09 07:47:13.556588, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO [2025/04/09 07:47:13.556910, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 07:47:13.557036, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 07:47:31.694331, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) [2025/04/09 07:47:31.694388, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb [2025/04/09 07:47:31.694561, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) Could not get the lock for windc2.adprotocolx.com [2025/04/09 07:47:31.694655, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com [2025/04/09 07:47:31.694708, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK [2025/04/09 07:47:31.988594, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55cf826037d0]: subreq: 0x55cf825c8e50 [2025/04/09 07:47:31.988668, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55cf826034c0]: subreq: 0x55cf825af290 [2025/04/09 07:47:31.988725, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55cf826037d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8e50/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825c9030)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] [2025/04/09 07:47:31.988846, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55cf826034c0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825af290/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf825af470)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] [2025/04/09 07:47:31.991865, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55cf826037d0]: subreq: 0x55cf825c8930 [2025/04/09 07:47:31.991908, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55cf826034c0]: subreq: 0x55cf825af290 [2025/04/09 07:47:31.991943, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55cf826037d0]: NT_STATUS_OK tevent_req[0x55cf825c8930/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825c8b10)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:994] [2025/04/09 07:47:31.992032, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55cf826034c0]: NT_STATUS_OK tevent_req[0x55cf825af290/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf825af470)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] [2025/04/09 07:47:31.992357, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:47:31.992762, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200151] [2025/04/09 07:47:31.992793, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:02:31 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:47:31.992871, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200151] [2025/04/09 07:47:31.992896, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:02:31 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:47:31.993016, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) set_domain_online: called for domain ADPROTOCOLX [2025/04/09 07:47:31.993067, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:47:31.993215, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) messaging_dgm_send: Sending message to 2398430 [2025/04/09 07:47:31.993272, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403284396 seconds ahead) ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:47:31.993685, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=13, vnn=4026531841, opcode=18, srvid=0 [2025/04/09 07:47:31.993908, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=14, vnn=4026531841, opcode=4, srvid=0 [2025/04/09 07:47:31.994073, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=15, vnn=4026531841, opcode=149, srvid=0 [2025/04/09 07:47:31.994314, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:47:31.995561, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH session_key : 6927d03bace8352078671274da7f767c sequence : 0x67f65e44 (1744199236) seed: struct netr_Credential data : 5ae434c6f197d07b client: struct netr_Credential data : 7b2f5a59c67e107d server: struct netr_Credential data : 780a45edba62c4b2 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' ex : * ex: struct netlogon_creds_CredentialState_extra_info magic : 0x00000601 (1537) reserved : 0x00000000 (0) client_requested_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH auth_time : Wed Apr 9 07:47:15 AM 2025 EDT client_sid : S-1-0-1108 [2025/04/09 07:47:31.996261, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:47:31.996305, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:47:31.996342, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:47:31.996436, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:47:31.996485, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:47:31.996515, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:47:31.996540, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:47:31.996655, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:47:31.997282, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH session_key : 6927d03bace8352078671274da7f767c sequence : 0x67f65e44 (1744199236) seed: struct netr_Credential data : 5ae434c6f197d07b client: struct netr_Credential data : 7b2f5a59c67e107d server: struct netr_Credential data : 780a45edba62c4b2 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' ex : * ex: struct netlogon_creds_CredentialState_extra_info magic : 0x00000601 (1537) reserved : 0x00000000 (0) client_requested_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH auth_time : Wed Apr 9 07:47:15 AM 2025 EDT client_sid : S-1-0-1108 [2025/04/09 07:47:31.998059, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 07:47:31.998115, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 07:47:31.998147, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 07:47:31.998243, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55cf825b00d0]: subreq: 0x55cf825c8e50 [2025/04/09 07:47:31.998276, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55cf825b00d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8e50/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825c9030)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] [2025/04/09 07:47:31.998312, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 07:47:31.998438, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x00000007 (7) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 07:47:31.998787, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:47:31.998845, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:47:31.999373, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 72 [2025/04/09 07:47:31.999446, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0058 (88) auth_length : 0x000c (12) call_id : 0x00000007 (7) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b4c (2892) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] 63 00 c. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 07:47:31.999767, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 88 at offset 0: NT_STATUS_OK [2025/04/09 07:47:31.999790, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 88 bytes. [2025/04/09 07:47:31.999818, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:47:31.999840, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:47:31.999869, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55cf825b00d0]: subreq: 0x55cf825c8e50 [2025/04/09 07:47:31.999895, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55cf825b00d0]: NT_STATUS_OK tevent_req[0x55cf825c8e50/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825c9030)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] [2025/04/09 07:47:31.999932, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:47:31.999986, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:47:32.000018, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:47:32.000043, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 07:47:32.000065, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=17, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 07:47:32.000100, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:47:32.000129, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:47:32.000148, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:47:32.000171, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:47:32.000255, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:47:32.000341, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:47:32.000575, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000008 (8) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000088 (136) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:47:32.000768, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:47:32.000861, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:47:32.000904, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:47:32.001603, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:47:32.001650, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000008 (8) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] A6 AC 84 DA F5 B2 16 21 42 38 F7 99 F9 E4 ED 80 .......! B8...... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] EB AC 18 33 EB 61 89 C1 9C 51 0C 0D 0F CF CE 5D ...3.a.. .Q.....] [0030] A2 C6 7A E9 7B 2F 69 83 B5 5E 4C 6E 14 B7 01 08 ..z.{/i. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:47:32.001914, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:47:32.001937, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:47:32.001983, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:47:32.002032, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:47:32.002057, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:47:32.002077, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:47:32.002110, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:47:32.002249, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:47:32.002299, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:47:32.002431, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:47:32.002479, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:47:32.002763, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:47:32.002791, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:47:32.002903, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:47:32.002980, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:47:32.003053, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000009 (9) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:47:32.003252, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:47:32.003331, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:47:32.003368, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:47:32.003799, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:47:32.003841, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000009 (9) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 06 36 F3 39 8D 1A B9 0D 37 2F F9 CA BA 11 E1 41 .6.9.... 7/.....A [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 19 55 C0 2E 27 B8 D4 90 41 7D 00 B9 5E B8 64 AB .U..'... A}..^.d. [0030] 84 3F 57 CB BE 6C A1 E7 B5 5E 4C 6E 14 B7 01 08 .?W..l.. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:47:32.004139, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:47:32.004164, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:47:32.004184, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:47:32.004219, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:47:32.004242, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:47:32.004262, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:47:32.004303, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:47:32.004370, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:47:32.004392, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:47:32.004450, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:47:32.004482, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:47:46.604931, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:47:46.605008, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:47:46.605141, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:47:46.605285, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:47:46.605397, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000a (10) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:47:46.605618, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:47:46.605745, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:47:46.605837, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:47:46.607131, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:47:46.607194, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000000a (10) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 36 17 D8 99 86 DC AC E8 2F 98 D6 4C 24 41 10 A7 6....... /..L$A.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] A5 5F 4F B0 7B 2C FE 67 95 71 A3 35 FB 2A B5 37 ._O.{,.g .q.5.*.7 [0030] 2D B2 13 72 3E C1 4D 3C B5 5E 4C 6E 14 B7 01 08 -..r>.M< .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:47:46.607459, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:47:46.607493, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:47:46.607517, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:47:46.607555, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:47:46.607581, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:47:46.607601, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:47:46.607639, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:47:46.607742, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:47:46.607794, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:47:46.607864, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:47:46.607886, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:47:48.874108, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_brlock failed (fd=19) at offset 560 rw_type=1 flags=1 len=1 [2025/04/09 07:47:48.874315, 1, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) [2025/04/09 07:47:48.874378, 0, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb [2025/04/09 07:47:48.874716, 1, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/server_mutex.c:97(grab_named_mutex) Could not get the lock for windc2.adprotocolx.com [2025/04/09 07:47:48.874899, 0, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com [2025/04/09 07:47:48.875006, 1, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK [2025/04/09 07:47:48.875110, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:48:48 AM 2025 EDT] (60 seconds ahead) [2025/04/09 07:47:48.875222, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX (windc2.adprotocolx.com) to failed conn cache [2025/04/09 07:47:48.875272, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) [2025/04/09 07:47:48.875300, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) [2025/04/09 07:47:48.875360, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [ADPROTOCOLX] [2025/04/09 07:47:48.875398, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:48:48 AM 2025 EDT] (60 seconds ahead) [2025/04/09 07:47:48.875453, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX.COM (windc2.adprotocolx.com) to failed conn cache [2025/04/09 07:47:48.875481, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 07:47:48.875512, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 07:47:48.875549, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [ADPROTOCOLX.COM] [2025/04/09 07:47:48.875580, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) Attempt 1/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 07:47:48.875605, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 07:47:48.875635, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX" domain [2025/04/09 07:47:48.875665, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result -1073741420 for domain ADPROTOCOLX server windc2.adprotocolx.com [2025/04/09 07:47:48.875688, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1549(find_dc) Retrieving a list of IP addresses for DCs. [2025/04/09 07:47:48.875752, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:48.875796, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) ads_dc_name: domain=ADPROTOCOLX [2025/04/09 07:47:48.875838, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:48.875863, 6, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'ADPROTOCOLX.COM' [2025/04/09 07:47:48.875888, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) [2025/04/09 07:47:48.875938, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:48.875985, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:47:48.876015, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) [2025/04/09 07:47:48.876072, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:47:48.876147, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:48.876184, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:48.876218, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:48.876252, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:48.876285, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:48.876312, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:48.876341, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:48.876368, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:48.876388, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:48.876408, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:48.876427, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:48.876457, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:48.876501, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:48.876530, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:48.876556, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:48.876586, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:48.876620, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:48.876666, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) cldap_ping_list: Try to create 6 netlogon connections for domain 'ADPROTOCOLX.COM' (provided count of addresses was 6). [2025/04/09 07:47:48.877680, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:47:48.878587, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:47:48.878624, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477531 seconds ahead) [2025/04/09 07:47:48.878675, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:47:48.878700, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477531 seconds ahead) [2025/04/09 07:47:48.878771, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) cldap_ping_list: realm[ADPROTOCOLX.COM]: selected 10.28.1.93 => windc2.adprotocolx.com [2025/04/09 07:47:48.878797, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:47:48.879758, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:47:48.879804, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:48.879842, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:47:48.879929, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:47:48.880005, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:48.880044, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:47:48.880085, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:47:48.880119, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:47:48.880187, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:47:48.880292, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:47:48.880337, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:48.880414, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 41 CE 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 A....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:47:49.881021, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:47:49.881122, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:47:49.881154, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:49.881274, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 8D 2E 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:47:49.881419, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:47:49.882118, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 8D 2E 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 07:47:49.882571, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:47:49.882604, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:47:49.882632, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:49.882653, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:47:49.882673, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:47:49.882692, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:49.882715, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:49.882774, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:49.882820, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:49.882846, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:49.882875, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:49.882899, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:49.882922, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:49.882945, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:49.882995, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:49.883022, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:49.883042, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:49.883078, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:47:49.883112, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:49.883149, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:47:49.883169, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:47:49.883193, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:47:49.883213, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:47:49.883272, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:47:49.883298, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:49.883357, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 91 69 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .i...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:47:50.884529, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:47:50.884620, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:47:50.884658, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:50.884763, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 1D EA 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:47:50.884883, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:47:50.885288, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 1D EA 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej [0100] 03 48 28 E1 00 D1 .H(... [2025/04/09 07:47:50.885717, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:47:50.885751, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:47:50.885774, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:50.885812, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:47:50.885833, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:47:50.885854, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:50.885877, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:50.885927, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:50.885989, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:50.886039, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:50.886078, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:50.886119, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:50.886147, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:50.886183, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:50.886203, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:50.886250, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:50.886279, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:50.886314, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:47:50.886354, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:47:50.987574, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:47:53.888317, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:47:53.888559, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:47:53.888644, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 [2025/04/09 07:47:53.888744, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:53.888787, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) [2025/04/09 07:47:53.888843, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:53.888890, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:47:53.888916, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) [2025/04/09 07:47:53.888978, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:47:53.889045, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:53.889084, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:53.889120, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:53.889148, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:53.889189, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:53.889220, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:53.889365, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:53.889412, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:53.889441, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:53.889486, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:53.889505, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:53.889553, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:47:53.889664, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:47:53.889712, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:47:53.889763, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:47:53.889800, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:53.889864, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:53.889897, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename NULL) [2025/04/09 07:47:53.889925, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:53.889985, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:47:53.890086, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename (null)) [2025/04/09 07:47:53.890124, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:47:53.890159, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:53.890192, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:53.890225, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:53.890252, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:53.890285, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:53.890312, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:53.890342, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:53.890367, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:53.890397, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:53.890437, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:53.890464, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:53.890507, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:47:53.890534, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:47:53.890564, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:47:53.890591, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:47:53.890625, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:53.890651, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:53.890679, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1553(find_dc) Retrieved IP addresses for 6 DCs. [2025/04/09 07:47:53.890706, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1574(find_dc) Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). [2025/04/09 07:47:53.890804, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 445 [2025/04/09 07:47:53.891320, 3, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1589(find_dc) Successfully connected to DC '10.28.1.93'. [2025/04/09 07:47:53.891375, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. [2025/04/09 07:47:53.891410, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.93'. [2025/04/09 07:47:53.891437, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) [2025/04/09 07:47:53.892243, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:47:53.893197, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:47:53.893240, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477526 seconds ahead) [2025/04/09 07:47:53.893315, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:47:53.893357, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477526 seconds ahead) [2025/04/09 07:47:53.893401, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:47:53.893433, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 [2025/04/09 07:47:53.893461, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 07:58:53 AM 2025 EDT] (660 seconds ahead) [2025/04/09 07:47:53.893514, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f1fc [2025/04/09 07:47:53.893546, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:47:53.893588, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:47:53.893652, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:47:53.893731, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:53.893770, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:47:53.893793, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:47:53.893846, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:47:53.893875, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:47:53.893987, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:47:53.894040, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:53.894131, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 49 0C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 I....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:47:54.895063, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:47:54.895165, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:47:54.895210, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:54.895338, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 7A 19 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 z....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:47:54.895475, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:47:54.896085, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 7A 19 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 z....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. [0120] D7 81 C8 0F 00 ..... [2025/04/09 07:47:54.896573, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:47:54.896618, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:47:54.896652, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:54.896679, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:47:54.896706, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:47:54.896727, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:54.896762, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:54.896823, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:54.896890, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:54.896928, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:54.897001, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:54.897031, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:54.897062, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:54.897097, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:54.897133, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:54.897165, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:54.897232, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:54.897270, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:47:54.897302, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:47:54.897327, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:47:54.897358, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:47:54.897386, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:47:54.897407, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:47:54.897483, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:47:54.897517, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:54.897590, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 2E 95 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:47:55.898786, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:47:55.898910, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:47:55.898942, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:47:55.899094, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 0C F9 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:47:55.899230, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:47:55.899683, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 0C F9 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s [0100] D0 D7 81 C8 0F 00 ...... [2025/04/09 07:47:55.900403, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:47:55.900454, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:47:55.900481, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:55.900509, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:47:55.900535, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:47:55.900556, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:55.900592, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:55.900652, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:47:55.900695, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:47:55.900740, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:47:55.900768, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:47:55.900810, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:47:55.900843, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:47:55.900897, 9, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:55.900924, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:47:55.900977, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:47:55.901012, 4, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:47:55.901043, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:47:55.901081, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:47:56.102573, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:47:56.885298, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) [2025/04/09 07:47:56.885468, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb [2025/04/09 07:47:56.885756, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) Could not get the lock for windc2.adprotocolx.com [2025/04/09 07:47:56.886023, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com [2025/04/09 07:47:56.886113, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK [2025/04/09 07:47:58.903180, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:47:58.903554, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:47:58.903664, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200178] [2025/04/09 07:47:58.903707, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:02:58 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:47:58.903776, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200178] [2025/04/09 07:47:58.903800, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:02:58 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:47:58.903843, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' [2025/04/09 07:47:58.903881, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 07:48:01.602910, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:48:01.603040, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:48:01.603193, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:48:01.603327, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:48:01.603483, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000b (11) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:48:01.603736, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:48:01.603928, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:48:01.604046, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:01.605014, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:48:01.605079, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000000b (11) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] F8 87 AC D4 E2 59 21 7E 51 E2 3D EF BF 17 03 20 .....Y!~ Q.=.... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 67 6D 7A 6E 66 FA 96 03 03 54 25 50 00 86 DD 8E gmznf... .T%P.... [0030] CB C3 8B 22 D6 37 02 29 B5 5E 4C 6E 14 B7 01 08 ...".7.) .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:48:01.605390, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:48:01.605415, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:48:01.605435, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:48:01.605476, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:48:01.605500, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:48:01.605521, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:48:01.605550, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:48:01.605637, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:48:01.605719, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:48:01.605816, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:48:01.605839, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:48:14.996554, 1] ../../source3/winbindd/winbindd_cm.c:877(cm_prepare_connection) authenticated session setup to windc2.adprotocolx.com using GPFSNMBASH$@ADPROTOCOLX.COM failed with NT_STATUS_CONNECTION_RESET [2025/04/09 07:48:14.996786, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_CONNECTION_RESET [2025/04/09 07:48:14.997380, 1] ../../source3/winbindd/winbindd_cm.c:776(cm_prepare_connection) Could not cli_initialize [2025/04/09 07:48:14.997502, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_NO_MEMORY [2025/04/09 07:48:14.997704, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). [2025/04/09 07:48:14.997881, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1019(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:48:14.999810, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:861(cm_prepare_connection) connecting to windc2.adprotocolx.com (ADPROTOCOLX, ADPROTOCOLX.COM) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] [2025/04/09 07:48:14.999862, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com [2025/04/09 07:48:15.000141, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] [2025/04/09 07:48:15.000236, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199295.000125: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:48:15.001134, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199295.000127: Sending unauthenticated request [2025/04/09 07:48:15.001219, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199295.000128: Sending request (182 bytes) to ADPROTOCOLX.COM [2025/04/09 07:48:15.001501, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199295.000129: Resolving hostname 10.28.1.93 [2025/04/09 07:48:15.001719, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199295.000130: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 07:48:15.002790, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199295.000131: Received answer (219 bytes) from dgram 10.28.1.93:88 [2025/04/09 07:48:15.002903, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199295.000132: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:48:16.611197, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:48:16.611313, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:48:16.611431, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:48:16.611540, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:48:16.611653, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000c (12) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:48:16.611876, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:48:16.612006, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:48:16.612082, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:16.612946, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:48:16.613026, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000000c (12) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 0F C8 02 AF 16 6E B5 E8 1D 6A D2 A8 98 06 A0 8E .....n.. .j...... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] AD 25 A5 65 FB A8 12 20 A5 E7 63 BA 89 14 F9 DF .%.e... ..c..... [0030] 03 90 ED 0C 3C BD 2A 33 00 00 00 00 00 00 00 00 ....<.*3 ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:48:16.613356, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:48:16.613382, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:48:16.613413, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:48:16.613448, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:48:16.613471, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:48:16.613501, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:48:16.613531, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:48:16.613619, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:48:16.613643, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:48:16.613710, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:48:16.613732, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:48:18.067884, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199298.067814: No URI records found [2025/04/09 07:48:18.068071, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199298.067815: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. [2025/04/09 07:48:21.139763, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199301.139749: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:48:24.212094, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212078: No SRV records found [2025/04/09 07:48:24.212188, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212079: Response was not from master KDC [2025/04/09 07:48:24.212313, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212080: Received error from KDC: -1765328359/Additional pre-authentication required [2025/04/09 07:48:24.212578, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212083: Preauthenticating using KDC method data [2025/04/09 07:48:24.212616, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212084: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) [2025/04/09 07:48:24.212646, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212085: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:48:24.212683, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 36 extra bytes [2025/04/09 07:48:24.212778, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:48:24.212826, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') [2025/04/09 07:48:24.212972, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:48:24.213151, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName in: struct netr_GetAnyDCName logon_server : * logon_server : 'windc2.adprotocolx.com' domainname : * domainname : 'adprotocolx' [2025/04/09 07:48:24.213277, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000d (13) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x000d (13) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:48:24.213507, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:48:24.213638, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:48:24.213730, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:24.216715, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212086: AS key obtained for encrypted timestamp: aes256-cts/C8D8 [2025/04/09 07:48:24.216812, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212088: Encrypted timestamp (for 1744210093.702851): plain 301AA011180F32303235303430393134343831335AA10502030AB983, encrypted 8ACDE9179797C3A1A64C1840882D0DBC2DB33A1A4B4AF8328F3F0F756DC31E775694D4659F273C82CCE71D317A086A4C0997CAD1BB4E5498 [2025/04/09 07:48:24.216867, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212089: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [2025/04/09 07:48:24.216896, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212090: Produced preauth for next request: PA-ENC-TIMESTAMP (2) [2025/04/09 07:48:24.216986, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212091: Sending request (261 bytes) to ADPROTOCOLX.COM [2025/04/09 07:48:24.217287, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212092: Resolving hostname 10.28.1.92 [2025/04/09 07:48:24.217435, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199304.212093: Sending initial UDP request to dgram 10.28.1.92:88 [2025/04/09 07:48:25.218623, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199305.218611: Resolving hostname 10.28.1.93 [2025/04/09 07:48:25.218860, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199305.218612: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 07:48:25.220992, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199305.218613: Received answer (102 bytes) from dgram 10.28.1.93:88 [2025/04/09 07:48:25.221209, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199305.218614: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:48:27.283665, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199307.283652: No URI records found [2025/04/09 07:48:27.283778, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199307.283653: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. [2025/04/09 07:48:30.355719, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199310.355709: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:48:33.427794, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427777: No SRV records found [2025/04/09 07:48:33.427904, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427778: Response was not from master KDC [2025/04/09 07:48:33.428009, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427779: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP [2025/04/09 07:48:33.428058, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427780: Request or response is too big for UDP; retrying with TCP [2025/04/09 07:48:33.428110, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427781: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) [2025/04/09 07:48:33.428399, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427782: Resolving hostname 10.28.1.93 [2025/04/09 07:48:33.428624, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427783: Initiating TCP connection to stream 10.28.1.93:88 [2025/04/09 07:48:33.429136, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427784: Sending TCP request to stream 10.28.1.93:88 [2025/04/09 07:48:33.430550, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427785: Received answer (1596 bytes) from stream 10.28.1.93:88 [2025/04/09 07:48:33.430607, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427786: Terminating TCP connection to stream 10.28.1.93:88 [2025/04/09 07:48:33.430701, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199313.427787: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:48:36.499814, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199316.499802: No URI records found [2025/04/09 07:48:36.499916, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199316.499803: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:48:39.571697, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571682: No SRV records found [2025/04/09 07:48:39.571839, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571683: Response was not from master KDC [2025/04/09 07:48:39.571970, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571684: Processing preauth types: PA-ETYPE-INFO2 (19) [2025/04/09 07:48:39.572043, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571685: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:48:39.572077, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571686: Produced preauth for next request: (empty) [2025/04/09 07:48:39.572163, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571687: AS key determined by preauth: aes256-cts/C8D8 [2025/04/09 07:48:39.572311, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571688: Decrypted AS reply; session key is: aes256-cts/1980 [2025/04/09 07:48:39.572363, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571689: FAST negotiation: unavailable [2025/04/09 07:48:39.572497, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:48:39.572566, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571690: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:48:39.572668, 10, pid=2398472, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398472] 1744199319.571691: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect [2025/04/09 07:48:39.572779, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos [2025/04/09 07:48:39.572830, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO [2025/04/09 07:48:39.573215, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 07:48:39.573331, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 07:48:46.902048, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) [2025/04/09 07:48:46.902145, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb [2025/04/09 07:48:46.902769, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) Could not get the lock for windc2.adprotocolx.com [2025/04/09 07:48:46.902940, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com [2025/04/09 07:48:46.903035, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK [2025/04/09 07:48:58.004521, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55cf82590090]: subreq: 0x55cf825a79f0 [2025/04/09 07:48:58.004618, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55cf82595480]: subreq: 0x55cf825ee110 [2025/04/09 07:48:58.004723, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55cf82590090]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825a79f0/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] [2025/04/09 07:48:58.004826, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55cf82595480]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825ee110/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf825ee2f0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] [2025/04/09 07:48:58.006892, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55cf82590090]: subreq: 0x55cf825a8c50 [2025/04/09 07:48:58.006947, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55cf82595480]: subreq: 0x55cf82601d30 [2025/04/09 07:48:58.007006, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55cf82590090]: NT_STATUS_OK tevent_req[0x55cf825a8c50/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825a8e30)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:994] [2025/04/09 07:48:58.007081, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55cf82595480]: NT_STATUS_OK tevent_req[0x55cf82601d30/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf82601f10)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] [2025/04/09 07:48:58.007445, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:58.007839, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200238] [2025/04/09 07:48:58.007890, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:03:58 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:48:58.007999, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200238] [2025/04/09 07:48:58.008031, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:03:58 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:48:58.008198, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:214(set_domain_online) set_domain_online: called for domain ADPROTOCOLX [2025/04/09 07:48:58.008271, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3848(get_global_winbindd_state_offline) get_global_winbindd_state_offline: Offline state not set. [2025/04/09 07:48:58.008730, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/messaging/messages_dgm.c:1463(messaging_dgm_send) messaging_dgm_send: Sending message to 2398430 [2025/04/09 07:48:58.008796, 10, pid=2398472, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[CURRENT_DCNAME/ADPROTOCOLX] and timeout=[Mon Jan 18 10:14:07 PM 2038 EST] (403284309 seconds ahead) ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:48:58.009391, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=14, vnn=4026531841, opcode=18, srvid=0 [2025/04/09 07:48:58.009773, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=15, vnn=4026531841, opcode=4, srvid=0 [2025/04/09 07:48:58.009907, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=16, vnn=4026531841, opcode=149, srvid=0 [2025/04/09 07:48:58.010146, 3, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:2023(db_open_ctdb) db_open_ctdb: opened database 'g_lock.tdb' with dbid 0x4d2a432b [2025/04/09 07:48:58.010325, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH session_key : 6927d03bace8352078671274da7f767c sequence : 0x67f65e44 (1744199236) seed: struct netr_Credential data : 5ae434c6f197d07b client: struct netr_Credential data : 7b2f5a59c67e107d server: struct netr_Credential data : 780a45edba62c4b2 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' ex : * ex: struct netlogon_creds_CredentialState_extra_info magic : 0x00000601 (1537) reserved : 0x00000000 (0) client_requested_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH auth_time : Wed Apr 9 07:47:15 AM 2025 EDT client_sid : S-1-0-1108 [2025/04/09 07:48:58.011026, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:48:58.011060, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:48:58.011095, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:48:58.011171, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:48:58.011203, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:48:58.011233, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:48:58.011254, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:48:58.011383, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:58.013462, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH session_key : 6927d03bace8352078671274da7f767c sequence : 0x67f65e44 (1744199236) seed: struct netr_Credential data : 5ae434c6f197d07b client: struct netr_Credential data : 7b2f5a59c67e107d server: struct netr_Credential data : 780a45edba62c4b2 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' ex : * ex: struct netlogon_creds_CredentialState_extra_info magic : 0x00000601 (1537) reserved : 0x00000000 (0) client_requested_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH auth_time : Wed Apr 9 07:47:15 AM 2025 EDT client_sid : S-1-0-1108 [2025/04/09 07:48:58.014259, 5, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 07:48:58.014311, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 07:48:58.014351, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 07:48:58.014429, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55cf82598840]: subreq: 0x55cf825a79f0 [2025/04/09 07:48:58.014474, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55cf82598840]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825a79f0/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] [2025/04/09 07:48:58.014515, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 07:48:58.014706, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x00000029 (41) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 07:48:58.015195, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:48:58.015304, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:58.016067, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 72 [2025/04/09 07:48:58.016192, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0058 (88) auth_length : 0x000c (12) call_id : 0x00000029 (41) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b51 (2897) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] D0 11 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 07:48:58.016620, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 88 at offset 0: NT_STATUS_OK [2025/04/09 07:48:58.016649, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 88 bytes. [2025/04/09 07:48:58.016678, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:48:58.016706, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:48:58.016743, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55cf82598840]: subreq: 0x55cf825a79f0 [2025/04/09 07:48:58.016777, 10, pid=2398472, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55cf82598840]: NT_STATUS_OK tevent_req[0x55cf825a79f0/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825a7bd0)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] [2025/04/09 07:48:58.016829, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:48:58.016858, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:48:58.016891, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:48:58.016931, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 07:48:58.016973, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=17, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 07:48:58.017020, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:48:58.017052, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:48:58.017072, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:48:58.017091, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:48:58.017156, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName in: struct netr_GetAnyDCName logon_server : * logon_server : 'windc2.adprotocolx.com' domainname : * domainname : 'adprotocolx' [2025/04/09 07:48:58.017254, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:48:58.017571, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000002a (42) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000000a4 (164) context_id : 0x0000 (0) opnum : 0x000d (13) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:48:58.017811, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:48:58.017919, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:48:58.017976, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:59.230414, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:59.231434, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:844(rpc_api_pipe_trans_done) cli_api_pipe failed: NT_STATUS_IO_TIMEOUT [2025/04/09 07:48:59.231537, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 10000 (ms) to 1000 (ms). [2025/04/09 07:48:59.231613, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 1000 (ms) to 500 (ms). [2025/04/09 07:48:59.231678, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:48:59.231869, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1956(connection_ok) connection_ok: Connection to windc2.adprotocolx.com for domain ADPROTOCOLX is not connected [2025/04/09 07:48:59.231909, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1770(cm_open_connection) Creating connection to domain controller. This is a start of a new connection or a DC failover. The failover only happens if the domain has more than one DC. We will try to connect 3 times at most. [2025/04/09 07:48:59.231990, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) Attempt 0/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 07:48:59.232020, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 07:48:59.232132, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX" domain [2025/04/09 07:48:59.232198, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result -1073741420 for domain ADPROTOCOLX server windc2.adprotocolx.com [2025/04/09 07:48:59.232247, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result -1073741420 for domain ADPROTOCOLX server windc2.adprotocolx.com [2025/04/09 07:48:59.232292, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1549(find_dc) Retrieving a list of IP addresses for DCs. [2025/04/09 07:48:59.232358, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:48:59.232393, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) ads_dc_name: domain=ADPROTOCOLX [2025/04/09 07:48:59.232433, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:48:59.232461, 6, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'ADPROTOCOLX.COM' [2025/04/09 07:48:59.232491, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) [2025/04/09 07:48:59.232537, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain [2025/04/09 07:48:59.232577, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc2.adprotocolx.com, *" [2025/04/09 07:48:59.232616, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) [2025/04/09 07:48:59.232663, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:48:59.232705, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:48:59.232733, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:48:59.232776, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:48:59.232804, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:48:59.232844, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:48:59.232875, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:48:59.232910, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:48:59.232965, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:48:59.233002, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:48:59.233034, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:48:59.233064, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:48:59.233090, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:48:59.233119, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:48:59.233145, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:48:59.233172, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:48:59.233194, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:48:59.233228, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:48:59.233271, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:48:59.233304, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:48:59.233337, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:48:59.233369, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:48:59.233403, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:48:59.233440, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) cldap_ping_list: Try to create 6 netlogon connections for domain 'ADPROTOCOLX.COM' (provided count of addresses was 6). [2025/04/09 07:48:59.234531, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:48:59.235598, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:48:59.235636, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477460 seconds ahead) [2025/04/09 07:48:59.235691, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:48:59.235720, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477460 seconds ahead) [2025/04/09 07:48:59.235770, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) cldap_ping_list: realm[ADPROTOCOLX.COM]: selected 10.28.1.93 => windc2.adprotocolx.com [2025/04/09 07:48:59.235799, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:48:59.236790, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:48:59.236855, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:48:59.236902, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:48:59.237000, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:48:59.237044, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain [2025/04/09 07:48:59.237084, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc2.adprotocolx.com, *" [2025/04/09 07:48:59.237115, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:48:59.237143, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:48:59.237198, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:48:59.237306, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:48:59.237351, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:48:59.237421, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 2C 25 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ,%...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:49:00.238660, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:49:00.238791, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:49:00.238822, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:49:00.238969, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 46 00 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 F....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:49:00.239120, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:49:00.239712, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 46 00 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 F....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c1.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 70 ..d.X.wi ndc2.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 6B 00 ........ ....\.k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 65 6A 03 48 28 E1 00 D1 C0 95 00 01 00 01 00 .ej.H(.. ........ [00F0] 00 0E 10 00 04 0A 1C 01 5D C0 95 00 01 00 01 00 ........ ]....... [0100] 00 0E 10 00 04 C0 A8 7A CE C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 D0 ..... .. ......s. [0120] D7 81 C8 0F 00 ..... [2025/04/09 07:49:00.240237, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:49:00.240278, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:49:00.240313, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:00.240335, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:49:00.240355, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:49:00.240379, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:00.240403, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:00.240462, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:49:00.240519, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:49:00.240555, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:49:00.240584, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:49:00.240613, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:00.240647, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:00.240679, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:49:00.240709, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:49:00.240739, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:00.240775, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:00.240810, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:49:00.240837, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:00.240863, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:00.240890, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:49:00.240911, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 10.28.1.92 192.168.122.133 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:00.240949, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:49:00.241004, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain [2025/04/09 07:49:00.241039, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc2.adprotocolx.com, *" [2025/04/09 07:49:00.241073, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:49:00.241106, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:49:00.241132, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:49:00.241206, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:49:00.241240, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:49:00.241308, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] D7 0C 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:49:01.242507, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:49:01.242596, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:49:01.242625, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:49:01.242734, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 07 62 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .b...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:49:01.242847, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:49:01.243289, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 07 62 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 .b...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej [0100] 03 48 28 E1 00 D1 .H(... [2025/04/09 07:49:01.243687, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:49:01.243729, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:49:01.243763, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:01.243790, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:49:01.243815, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:49:01.243841, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:01.243881, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:01.243997, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:49:01.244057, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:49:01.244092, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:49:01.244155, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:49:01.244190, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:01.244235, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:01.244268, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:01.244297, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:49:01.244327, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:01.244357, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:49:01.244386, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:49:01.244416, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:01.244441, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:01.244473, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:49:01.244498, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:01.244528, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:49:01.244555, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:49:01.446017, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:49:04.246181, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:49:04.246448, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:49:04.246513, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 [2025/04/09 07:49:04.246564, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:49:04.246602, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) [2025/04/09 07:49:04.246642, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain [2025/04/09 07:49:04.246675, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc2.adprotocolx.com, *" [2025/04/09 07:49:04.246704, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) [2025/04/09 07:49:04.246732, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:49:04.246774, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:04.246810, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:49:04.246850, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:49:04.246878, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:49:04.246909, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:49:04.246939, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:04.246998, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:04.247053, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:04.247081, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:49:04.247122, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:04.247147, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:49:04.247180, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:49:04.247206, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:04.247228, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:04.247253, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:49:04.247275, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:04.247308, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:49:04.247338, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:49:04.247365, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:49:04.247395, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:49:04.247432, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:04.247465, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:04.247488, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename NULL) [2025/04/09 07:49:04.247515, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain [2025/04/09 07:49:04.247542, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc2.adprotocolx.com, *" [2025/04/09 07:49:04.247568, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename (null)) [2025/04/09 07:49:04.247597, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:49:04.247629, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:04.247655, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:49:04.247687, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:49:04.247714, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:49:04.247743, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:49:04.247771, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:04.247798, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:04.247827, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:04.247856, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:49:04.247881, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:04.247905, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:49:04.247937, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:49:04.247986, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:04.248035, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:04.248059, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:49:04.248093, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:04.248122, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:49:04.248151, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:49:04.248177, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:49:04.248201, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:49:04.248225, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:04.248250, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:04.248272, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1553(find_dc) Retrieved IP addresses for 6 DCs. [2025/04/09 07:49:04.248302, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1574(find_dc) Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). [2025/04/09 07:49:04.248384, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 445 [2025/04/09 07:49:04.248908, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1589(find_dc) Successfully connected to DC '10.28.1.93'. [2025/04/09 07:49:04.248986, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. [2025/04/09 07:49:04.249039, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.93'. [2025/04/09 07:49:04.249068, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) [2025/04/09 07:49:04.249790, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:49:04.250630, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:49:04.250666, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477455 seconds ahead) [2025/04/09 07:49:04.250733, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:49:04.250771, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477455 seconds ahead) [2025/04/09 07:49:04.250831, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:49:04.250863, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 [2025/04/09 07:49:04.250899, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 08:00:04 AM 2025 EDT] (660 seconds ahead) [2025/04/09 07:49:04.250945, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f1fc [2025/04/09 07:49:04.251023, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:49:04.251055, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:49:04.251107, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:49:04.251143, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:279(saf_fetch) saf_fetch: Returning "windc2.adprotocolx.com" for "ADPROTOCOLX.COM" domain [2025/04/09 07:49:04.251172, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: "windc2.adprotocolx.com, *" [2025/04/09 07:49:04.251199, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:49:04.251225, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:49:04.251259, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:49:04.251334, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:49:04.251368, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:49:04.251435, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 72 46 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 rF...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:49:05.013656, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) [2025/04/09 07:49:05.013783, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb [2025/04/09 07:49:05.014114, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) Could not get the lock for windc2.adprotocolx.com [2025/04/09 07:49:05.014301, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com [2025/04/09 07:49:05.014368, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK [2025/04/09 07:49:05.252669, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:49:05.252754, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:49:05.252785, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:49:05.253342, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] D1 BA 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:49:05.253490, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:49:05.254000, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] D1 BA 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 07:49:05.254490, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:49:05.254530, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:49:05.254555, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:05.254577, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:49:05.254597, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:49:05.254621, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:05.254665, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:05.254724, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:49:05.254781, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:49:05.254813, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up windc2.adprotocolx.com#20 (sitename Default-First-Site-Name) [2025/04/09 07:49:05.254843, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name windc2.adprotocolx.com#20 found. [2025/04/09 07:49:05.254871, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:05.254906, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:05.254938, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:05.254993, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:49:05.255033, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:05.255065, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:49:05.255094, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:49:05.255124, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:05.255149, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:05.255177, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:49:05.255201, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:05.255229, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:49:05.255259, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:49:05.255302, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:49:05.255329, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:49:05.255356, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:49:05.255382, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:49:05.255443, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:49:05.255476, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:49:05.255546, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] D4 7E 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 .~...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:49:06.256722, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:49:06.256873, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:49:06.256906, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:49:06.257122, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] D0 5F 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ._...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:49:06.257260, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:49:06.257604, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] D0 5F 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ._...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 31 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc1.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 32 0B 61 64 ...d.X.w indc2.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5C C0 4C ........ .....\.L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A 85 C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 65 6A 03 48 28 E1 00 D1 C0 76 00 01 00 01 ..ej.H(. ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5D C0 76 00 01 00 01 ........ .].v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A CE C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 C9 73 ...... . .......s [0100] D0 D7 81 C8 0F 00 ...... [2025/04/09 07:49:06.258103, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:49:06.258152, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:49:06.258177, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:06.258206, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:49:06.258229, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:49:06.258251, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:06.258280, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:06.258345, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:49:06.258395, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:49:06.258431, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:49:06.258460, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:49:06.258491, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:49:06.258519, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:49:06.258546, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:06.258574, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:49:06.258600, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:49:06.258625, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.92 192.168.122.133 10.28.1.93 192.168.122.206 2001:192::656a:348:28e1:d1 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:49:06.258654, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:49:06.258688, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:49:06.360083, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:49:09.212714, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:09.212837, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000002a (42) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000008 (8) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 25 7E 56 F9 4E 43 BC 42 ED FE 45 2A AE B5 EA C9 %~V.NC.B ..E*.... [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 0C 4A 48 8A 3C EF A1 00 0B DC 7B 3A A9 6B B4 DB .JH.<... ..{:.k.. [0030] 71 3F DD 1C 53 0A F4 94 B5 5E 4C 6E 14 B7 01 08 q?..S... .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:49:09.213211, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:09.213237, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:49:09.213255, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:09.213319, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 8 [2025/04/09 07:49:09.213343, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:09.213364, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. [2025/04/09 07:49:09.213403, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName out: struct netr_GetAnyDCName dcname : * dcname : NULL result : WERR_NO_LOGON_SERVERS [2025/04/09 07:49:09.213544, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS [2025/04/09 07:49:09.213604, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:09.213721, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:09.213752, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4016 bytes to parent [2025/04/09 07:49:09.214210, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:09.214244, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:49:09.214322, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:09.214416, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:49:09.214494, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000002b (43) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:09.214671, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:09.214745, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:09.214781, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:09.215616, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:09.215665, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000002b (43) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 8E 5B B2 50 4C 55 44 8A 5C 0A A1 9D F0 D7 E9 9E .[.PLUD. \....... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 93 BE 73 00 03 A9 88 F6 B0 26 FE 31 93 C5 8A 9A ..s..... .&.1.... [0030] B0 5B 25 8D CE 2D DE E9 B5 5E 4C 6E 14 B7 01 08 .[%..-.. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:49:09.215917, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:09.215939, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:49:09.215957, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:09.216013, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:49:09.216036, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:09.216065, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:49:09.216111, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:49:09.216213, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:49:09.216235, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:09.216312, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:09.216333, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:49:09.259276, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:49:09.259500, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:49:09.259573, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200249] [2025/04/09 07:49:09.259611, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:04:09 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:49:09.259662, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200249] [2025/04/09 07:49:09.259683, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:04:09 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:49:09.259713, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' [2025/04/09 07:49:09.259750, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 07:49:25.809415, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:25.809533, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:49:25.809671, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:25.809813, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:49:25.809918, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000002c (44) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:25.810163, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:25.810275, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:25.810338, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:25.811157, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:25.811208, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000002c (44) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] F9 20 92 CB 09 3F 9F 96 0F 62 70 3A 28 C5 32 51 . ...?.. .bp:(.2Q [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 9D DC B6 71 F9 5C 35 11 12 D4 D7 2B 2B AF 26 38 ...q.\5. ...++.&8 [0030] 8B B9 2F 77 80 A5 3F 7C 0F B0 74 F7 7A 72 80 3C ../w..?| ..t.zr.< [0040] 12 37 E8 D2 99 AE 2D D5 E1 D1 67 1A 97 3F 47 D1 .7....-. ..g..?G. [2025/04/09 07:49:25.811507, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:25.811534, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:49:25.811554, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:25.811588, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:49:25.811612, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:25.811642, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:49:25.811680, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:49:25.811763, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:49:25.811787, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:25.811855, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:25.811877, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:49:26.958365, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:26.958419, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:49:26.958492, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:26.958558, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:49:26.958641, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000002d (45) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:26.958848, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:26.958951, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:26.959032, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:26.959754, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:26.959797, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000002d (45) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 72 8E 64 86 88 0E 1D C3 64 B7 4C 99 2B CE E9 E0 r.d..... d.L.+... [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 5C E4 7B C8 83 62 97 E8 77 2B C3 3A E9 1D E8 3C \.{..b.. w+.:...< [0030] 88 CC B0 79 F9 E7 CE 03 A2 99 45 44 4A 78 AD 66 ...y.... ..EDJx.f [0040] 5F 5E D5 0A A4 AB 98 3D 73 E3 ED 9D F4 76 49 39 _^.....= s....vI9 [2025/04/09 07:49:26.960092, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:26.960117, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:49:26.960138, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:26.960172, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:49:26.960195, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:26.960221, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:49:26.960256, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:49:26.960354, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:49:26.960400, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:26.960464, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:26.960485, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:49:31.620900, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:31.621058, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:49:31.621227, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:31.621391, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:49:31.621536, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000002e (46) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:31.621741, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:31.621862, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:31.622008, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:31.625273, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:31.625339, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000002e (46) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 0F 65 3F 51 95 4A 69 9D 85 32 D8 D9 70 F6 9C 22 .e?Q.Ji. .2..p.." [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 28 EC E6 86 C5 DE 9A CA 55 83 42 F5 1D F1 4E 1A (....... U.B...N. [0030] 3C 8C 69 60 B8 96 D4 6E A2 99 45 44 4A 78 AD 66 <.i`...n ..EDJx.f [0040] 5F 5E D5 0A A4 AB 98 3D 73 E3 ED 9D F4 76 49 39 _^.....= s....vI9 [2025/04/09 07:49:31.625615, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:31.625640, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:49:31.625660, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:31.625697, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:49:31.625719, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:31.625746, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:49:31.625776, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:49:31.625855, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:49:31.625878, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:31.625944, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:31.626014, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:49:34.868860, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 36 extra bytes [2025/04/09 07:49:34.868993, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:34.869048, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') [2025/04/09 07:49:34.869216, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:49:34.869385, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName in: struct netr_GetAnyDCName logon_server : * logon_server : 'windc2.adprotocolx.com' domainname : * domainname : 'adprotocolx' [2025/04/09 07:49:34.869481, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000002f (47) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x000d (13) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:34.869740, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:34.869859, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:34.869925, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:34.870781, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:34.870837, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000002f (47) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000008 (8) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] E5 D6 DA C6 00 8F 17 32 E8 A0 89 30 03 17 22 2D .......2 ...0.."- [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 33 C6 07 BF EE F9 95 FC CD 77 1A FC 83 8A 84 9A 3....... .w...... [0030] 2B F9 1B 12 A0 B7 48 00 A2 99 45 44 4A 78 AD 66 +.....H. ..EDJx.f [0040] 5F 5E D5 0A A4 AB 98 3D 73 E3 ED 9D F4 76 49 39 _^.....= s....vI9 [2025/04/09 07:49:34.871168, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:34.871195, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:49:34.871222, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:34.871269, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 8 [2025/04/09 07:49:34.871292, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:34.871320, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. [2025/04/09 07:49:34.871346, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName out: struct netr_GetAnyDCName dcname : * dcname : NULL result : WERR_NO_LOGON_SERVERS [2025/04/09 07:49:34.871406, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS [2025/04/09 07:49:34.871430, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:34.871482, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:34.871506, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4016 bytes to parent [2025/04/09 07:49:36.921726, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) [2025/04/09 07:49:36.921853, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb [2025/04/09 07:49:36.922032, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) Could not get the lock for windc2.adprotocolx.com [2025/04/09 07:49:36.922146, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com [2025/04/09 07:49:36.922207, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK [2025/04/09 07:49:40.067782, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:40.067847, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:49:40.067991, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:40.068093, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:49:40.068212, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000030 (48) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:40.068420, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:40.068521, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:40.068583, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:40.071116, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:40.071177, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000030 (48) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] A2 FE A9 11 A7 A1 6A 8B EE 7F BA AE 90 C5 6D BD ......j. ......m. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 15 A4 BE DA 66 4E 73 AB 7E 9A 76 86 4C 59 27 79 ....fNs. ~.v.LY'y [0030] 8A 45 74 03 A1 F2 BE B6 68 E3 73 95 71 01 00 00 .Et..... h.s.q... [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ [2025/04/09 07:49:40.071482, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:40.071517, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:49:40.071537, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:40.071577, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:49:40.071616, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:40.071639, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:49:40.071673, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:49:40.071767, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:49:40.071797, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:40.071877, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:40.071898, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:49:41.016643, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). [2025/04/09 07:49:41.016930, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1019(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:49:41.018331, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:861(cm_prepare_connection) connecting to windc2.adprotocolx.com (ADPROTOCOLX, ADPROTOCOLX.COM) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] [2025/04/09 07:49:41.018471, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com [2025/04/09 07:49:41.018684, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] [2025/04/09 07:49:41.018758, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199381.018678: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:49:41.019690, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199381.018680: Sending unauthenticated request [2025/04/09 07:49:41.019745, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199381.018681: Sending request (182 bytes) to ADPROTOCOLX.COM [2025/04/09 07:49:41.019943, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199381.018682: Resolving hostname 10.28.1.92 [2025/04/09 07:49:41.020128, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199381.018683: Sending initial UDP request to dgram 10.28.1.92:88 [2025/04/09 07:49:42.021320, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199382.021304: Resolving hostname 10.28.1.93 [2025/04/09 07:49:42.021553, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199382.021305: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 07:49:42.023044, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199382.021306: Received answer (219 bytes) from dgram 10.28.1.93:88 [2025/04/09 07:49:42.023248, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199382.021307: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:49:44.083904, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199384.083876: No URI records found [2025/04/09 07:49:44.084147, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199384.083877: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. [2025/04/09 07:49:46.622301, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:46.622373, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:49:46.622488, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:46.622623, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:49:46.622787, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000031 (49) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:46.623062, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:46.623244, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:46.623344, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:46.624503, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:46.624567, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000031 (49) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 6E 74 71 B5 B2 AD 69 E9 ED 9E 79 B1 55 4E 35 83 ntq...i. ..y.UN5. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 9E FE DE AB D5 DF 6C 7C 81 C0 1B 3F 8C 9D AF 77 ......l| ...?...w [0030] 21 34 E6 41 AD 69 F2 26 68 E3 73 95 71 01 00 00 !4.A.i.& h.s.q... [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ [2025/04/09 07:49:46.624899, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:46.624926, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:49:46.624948, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:46.625007, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:49:46.625033, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:46.625061, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:49:46.625097, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:49:46.625206, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:49:46.625243, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:46.625327, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:46.625351, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:49:47.156404, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199387.156386: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:49:47.156539, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 36 extra bytes [2025/04/09 07:49:47.156583, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:47.156614, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') [2025/04/09 07:49:47.156704, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:49:47.156820, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName in: struct netr_GetAnyDCName logon_server : * logon_server : 'windc2.adprotocolx.com' domainname : * domainname : 'adprotocolx' [2025/04/09 07:49:47.156944, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000032 (50) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x000d (13) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:47.157311, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:47.157482, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:47.157560, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:47.158403, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:47.158472, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000032 (50) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000008 (8) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 29 31 03 61 7E D8 36 EC 2B FE 5E 36 C8 05 40 00 )1.a~.6. +.^6..@. [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 49 77 BB 1B 45 2E 0F 0F 68 52 47 EE 36 20 05 13 Iw..E... hRG.6 .. [0030] 47 78 AE C9 E1 B1 25 07 00 00 00 00 1B 00 00 00 Gx....%. ........ [0040] E0 37 F7 30 FD 7F 00 00 F0 37 F7 30 FD 7F 00 00 .7.0.... .7.0.... [2025/04/09 07:49:47.158891, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:47.158930, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:49:47.158973, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:47.159022, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 8 [2025/04/09 07:49:47.159052, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:47.159080, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. [2025/04/09 07:49:47.159119, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName out: struct netr_GetAnyDCName dcname : * dcname : NULL result : WERR_NO_LOGON_SERVERS [2025/04/09 07:49:47.159220, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS [2025/04/09 07:49:47.159260, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:49:47.159365, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:47.159406, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4016 bytes to parent [2025/04/09 07:49:50.228003, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.227989: No SRV records found [2025/04/09 07:49:50.228110, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.227990: Response was not from master KDC [2025/04/09 07:49:50.228214, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.227991: Received error from KDC: -1765328359/Additional pre-authentication required [2025/04/09 07:49:50.228421, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.227994: Preauthenticating using KDC method data [2025/04/09 07:49:50.228459, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.227995: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) [2025/04/09 07:49:50.228508, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.227996: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:49:50.232365, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.227997: AS key obtained for encrypted timestamp: aes256-cts/C8D8 [2025/04/09 07:49:50.232491, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.227999: Encrypted timestamp (for 1744210180.673053): plain 301AA011180F32303235303430393134343934305AA10502030A451D, encrypted 27859E4451840F04F86F230028777B6102B01224A209DFFF94027EC29B6E4218F55D3ECD43A13B67FFD44CBE6206058A530C743F42F7B89E [2025/04/09 07:49:50.232538, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.228000: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [2025/04/09 07:49:50.232564, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.228001: Produced preauth for next request: PA-ENC-TIMESTAMP (2) [2025/04/09 07:49:50.232617, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.228002: Sending request (261 bytes) to ADPROTOCOLX.COM [2025/04/09 07:49:50.232715, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.228003: Resolving hostname 10.28.1.93 [2025/04/09 07:49:50.232883, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.228004: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 07:49:50.234839, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.228005: Received answer (102 bytes) from dgram 10.28.1.93:88 [2025/04/09 07:49:50.234933, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199390.228006: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:49:52.345678, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:52.345733, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:49:52.345813, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:49:52.345903, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:49:52.346077, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000033 (51) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:52.346321, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:52.346519, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:52.346619, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:49:52.347456, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:49:52.347526, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000033 (51) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 20 24 0F 8E ED D0 2D CF EB 25 35 12 05 81 6E C5 $....-. .%5...n. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] BC D6 98 3E F9 A7 D8 D7 D1 39 E8 35 C1 E9 04 0C ...>.... .9.5.... [0030] 24 C8 B4 FB 07 62 42 4F 00 00 00 00 1B 00 00 00 $....bBO ........ [0040] E0 37 F7 30 FD 7F 00 00 F0 37 F7 30 FD 7F 00 00 .7.0.... .7.0.... [2025/04/09 07:49:52.347929, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:49:52.348005, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:49:52.348044, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:49:52.348084, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:49:52.348118, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:49:52.348141, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:49:52.348182, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:49:52.348278, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:49:52.348315, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:49:52.348395, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:49:52.348424, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:49:53.299946, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199393.299915: No URI records found [2025/04/09 07:49:53.300157, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199393.299916: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. [2025/04/09 07:49:55.030412, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) [2025/04/09 07:49:55.030515, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb [2025/04/09 07:49:55.031198, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) Could not get the lock for windc2.adprotocolx.com [2025/04/09 07:49:55.031351, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com [2025/04/09 07:49:55.031410, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK [2025/04/09 07:49:56.371846, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199396.371815: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:49:59.443735, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199399.443726: No SRV records found [2025/04/09 07:49:59.443848, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199399.443727: Response was not from master KDC [2025/04/09 07:49:59.444005, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199399.443728: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP [2025/04/09 07:49:59.444079, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199399.443729: Request or response is too big for UDP; retrying with TCP [2025/04/09 07:49:59.444124, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199399.443730: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) [2025/04/09 07:49:59.444536, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 36 extra bytes [2025/04/09 07:49:59.444578, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199399.443731: Resolving hostname 10.28.1.92 [2025/04/09 07:49:59.444592, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:49:59.444627, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') [2025/04/09 07:49:59.444719, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199399.443732: Initiating TCP connection to stream 10.28.1.92:88 [2025/04/09 07:49:59.444725, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:49:59.444870, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName in: struct netr_GetAnyDCName logon_server : * logon_server : 'windc2.adprotocolx.com' domainname : * domainname : 'adprotocolx' [2025/04/09 07:49:59.445023, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000034 (52) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x000d (13) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:49:59.445347, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:49:59.445473, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:49:59.445537, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:50:00.445908, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199400.445895: Resolving hostname 10.28.1.93 [2025/04/09 07:50:00.446189, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199400.445896: Initiating TCP connection to stream 10.28.1.93:88 [2025/04/09 07:50:00.446772, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199400.445897: Sending TCP request to stream 10.28.1.93:88 [2025/04/09 07:50:00.448925, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199400.445898: Received answer (1596 bytes) from stream 10.28.1.93:88 [2025/04/09 07:50:00.449003, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199400.445899: Terminating TCP connection to stream 10.28.1.92:88 [2025/04/09 07:50:00.449068, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199400.445900: Terminating TCP connection to stream 10.28.1.93:88 [2025/04/09 07:50:00.449279, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199400.445901: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:50:02.516082, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199402.516062: No URI records found [2025/04/09 07:50:02.516306, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199402.516063: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:50:05.591310, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591296: No SRV records found [2025/04/09 07:50:05.591397, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591297: Response was not from master KDC [2025/04/09 07:50:05.591544, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591298: Processing preauth types: PA-ETYPE-INFO2 (19) [2025/04/09 07:50:05.591586, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591299: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:50:05.591627, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591300: Produced preauth for next request: (empty) [2025/04/09 07:50:05.591669, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591301: AS key determined by preauth: aes256-cts/C8D8 [2025/04/09 07:50:05.591782, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591302: Decrypted AS reply; session key is: aes256-cts/A62B [2025/04/09 07:50:05.591827, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591303: FAST negotiation: unavailable [2025/04/09 07:50:05.591938, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:50:05.592018, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591304: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:50:05.592084, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199405.591305: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect [2025/04/09 07:50:05.592176, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos [2025/04/09 07:50:05.592232, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO [2025/04/09 07:50:05.592520, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 07:50:05.592635, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 07:50:14.464512, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:50:14.464693, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000034 (52) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000008 (8) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] E6 62 2C 66 81 11 3B 5C C0 49 21 9E 16 22 B4 2D .b,f..;\ .I!..".- [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 01 07 61 71 CB F2 ED 4A DC 09 B2 F2 11 5C E7 69 ..aq...J .....\.i [0030] A1 B0 2A 97 41 DE F9 96 68 E3 73 95 71 01 00 00 ..*.A... h.s.q... [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ [2025/04/09 07:50:14.465146, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:50:14.465183, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:50:14.465208, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:50:14.465282, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 8 [2025/04/09 07:50:14.465316, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:50:14.465366, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. [2025/04/09 07:50:14.465408, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName out: struct netr_GetAnyDCName dcname : * dcname : NULL result : WERR_NO_LOGON_SERVERS [2025/04/09 07:50:14.465514, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS [2025/04/09 07:50:14.465550, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:14.465673, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:50:14.465714, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4016 bytes to parent [2025/04/09 07:50:16.634138, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:50:16.634187, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:50:16.634269, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:16.634386, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:50:16.634487, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000035 (53) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:50:16.634732, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:50:16.634846, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:50:16.634906, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:50:16.638421, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:50:16.638478, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000035 (53) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 5A DA 4A AA 39 BE DB 40 FA 02 88 63 39 C2 03 72 Z.J.9..@ ...c9..r [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 40 10 A2 7C 50 07 E2 76 0C C8 2A F3 E0 F8 73 CB @..|P..v ..*...s. [0030] 83 C5 48 28 A6 03 0A C5 68 E3 73 95 71 01 00 00 ..H(.... h.s.q... [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ [2025/04/09 07:50:16.638776, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:50:16.638803, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:50:16.638824, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:50:16.638858, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:50:16.638883, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:50:16.638909, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:50:16.638940, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:50:16.639044, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:50:16.639071, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:16.639147, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:50:16.639169, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:50:19.654980, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:50:19.655081, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:50:19.655229, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:19.655341, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:50:19.655463, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000036 (54) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:50:19.655819, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:50:19.656000, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:50:19.656080, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:50:19.657031, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:50:19.657093, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000036 (54) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] DE B2 81 30 BD 5F 77 33 F3 B0 27 31 BF 69 23 4E ...0._w3 ..'1.i#N [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 35 51 50 17 07 48 B2 82 B9 DD 3C 86 39 DC C3 A0 5QP..H.. ..<.9... [0030] 5F 8D 2D 0B C1 D4 D8 7F 68 E3 73 95 71 01 00 00 _.-..... h.s.q... [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ [2025/04/09 07:50:19.657478, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:50:19.657508, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:50:19.657536, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:50:19.657573, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:50:19.657606, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:50:19.657642, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:50:19.657678, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:50:19.657771, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:50:19.657803, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:19.657890, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:50:19.657919, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:50:24.020253, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: gse_krb5[0x55cf8259a830]: subreq: 0x55cf825c8930 [2025/04/09 07:50:24.020368, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: spnego[0x55cf8258ccd0]: subreq: 0x55cf82605e00 [2025/04/09 07:50:24.020420, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: gse_krb5[0x55cf8259a830]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8930/../../source3/librpc/crypto/gse.c:977]: state[2] error[0 (0x0)] state[struct gensec_gse_update_state (0x55cf825c8b10)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:987] [2025/04/09 07:50:24.020529, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: spnego[0x55cf8258ccd0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf82605e00/../../auth/gensec/spnego.c:1632]: state[2] error[0 (0x0)] state[struct gensec_spnego_update_state (0x55cf82605fe0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2126] [2025/04/09 07:50:24.020934, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1719(cli_session_setup_creds_done_spnego) SPNEGO login failed: The transport connection has been reset. [2025/04/09 07:50:24.021049, 1, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:877(cm_prepare_connection) authenticated session setup to windc2.adprotocolx.com using GPFSNMBASH$@ADPROTOCOLX.COM failed with NT_STATUS_CONNECTION_RESET [2025/04/09 07:50:24.021182, 1, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_CONNECTION_RESET [2025/04/09 07:50:24.021240, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:51:24 AM 2025 EDT] (60 seconds ahead) [2025/04/09 07:50:24.021318, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX (windc2.adprotocolx.com) to failed conn cache [2025/04/09 07:50:24.021374, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX]) [2025/04/09 07:50:24.021410, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX]) [2025/04/09 07:50:24.021402, 1] ../../source3/winbindd/winbindd_cm.c:776(cm_prepare_connection) Could not cli_initialize [2025/04/09 07:50:24.021440, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:227(saf_delete) saf_delete: domain = [ADPROTOCOLX] [2025/04/09 07:50:24.021465, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NEG_CONN_CACHE/ADPROTOCOLX.COM,windc2.adprotocolx.com] and timeout=[Wed Apr 9 07:51:24 AM 2025 EDT] (60 seconds ahead) [2025/04/09 07:50:24.021477, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_NO_MEMORY [2025/04/09 07:50:24.021505, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:190(add_failed_connection_entry) add_failed_connection_entry: added domain ADPROTOCOLX.COM (windc2.adprotocolx.com) to failed conn cache [2025/04/09 07:50:24.021530, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAFJOIN/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 07:50:24.021553, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:333(gencache_del) Deleting cache entry (key=[SAF/DOMAIN/ADPROTOCOLX.COM]) [2025/04/09 07:50:24.021589, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1777(cm_open_connection) Attempt 1/3: DC 'windc2.adprotocolx.com' of domain 'ADPROTOCOLX'. [2025/04/09 07:50:24.021614, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1538(find_dc) First try to connect to the closest DC (using server affinity cache). If this fails, try to lookup the DC using DNS afterwards. [2025/04/09 07:50:24.021645, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX" domain [2025/04/09 07:50:24.021675, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result -1073741801 for domain ADPROTOCOLX server windc2.adprotocolx.com [2025/04/09 07:50:24.021698, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1549(find_dc) Retrieving a list of IP addresses for DCs. [2025/04/09 07:50:24.021758, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:50:24.021794, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:81(ads_dc_name) ads_dc_name: domain=ADPROTOCOLX [2025/04/09 07:50:24.021827, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:50:24.021850, 6, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:652(resolve_and_ping_dns) resolve_and_ping_dns: (cldap) looking for realm 'ADPROTOCOLX.COM' [2025/04/09 07:50:24.021877, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) [2025/04/09 07:50:24.021917, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:50:24.021942, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:50:24.021989, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) [2025/04/09 07:50:24.022020, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:50:24.022061, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:24.022091, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:50:24.022120, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:50:24.022146, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:50:24.022172, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:24.022196, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:50:24.022220, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:50:24.022244, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:24.022265, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:24.022289, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:50:24.022315, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:24.022373, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:50:24.022453, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:50:24.022484, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:50:24.022520, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:50:24.022557, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:24.022587, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:24.022623, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:485(cldap_ping_list) cldap_ping_list: Try to create 6 netlogon connections for domain 'ADPROTOCOLX.COM' (provided count of addresses was 6). [2025/04/09 07:50:24.023459, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:50:24.025980, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:50:24.026044, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477375 seconds ahead) [2025/04/09 07:50:24.026136, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:50:24.026173, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477375 seconds ahead) [2025/04/09 07:50:24.026216, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:539(cldap_ping_list) cldap_ping_list: realm[ADPROTOCOLX.COM]: selected 10.28.1.93 => windc2.adprotocolx.com [2025/04/09 07:50:24.026245, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/libads/ldap.c:542(cldap_ping_list) cldap_reply: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:50:24.027309, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:50:24.027372, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:50:24.027403, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:50:24.027466, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:50:24.027508, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:50:24.027541, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:50:24.027566, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:50:24.027595, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:50:24.027632, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:50:24.027714, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:50:24.027751, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:50:24.027819, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] F0 D6 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:50:25.029133, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:50:25.029227, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:50:25.029257, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:50:25.029386, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] A6 D5 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:50:25.029530, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:50:25.030020, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] A6 D5 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 07:50:25.030486, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:50:25.030529, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:50:25.030556, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:25.030585, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:50:25.030623, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:50:25.030650, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:25.030679, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:25.030754, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:50:25.030797, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:50:25.030844, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:50:25.030870, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:25.030901, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:50:25.030932, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:50:25.030989, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:25.031025, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:25.031054, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:50:25.031092, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:25.031124, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:50:25.031170, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:50:25.031201, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:50:25.031227, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:50:25.031258, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:50:25.031286, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:50:25.031380, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:50:25.031416, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:50:25.031489, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 59 C0 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 Y....... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:50:26.032693, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:50:26.032846, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:50:26.032881, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:50:26.033005, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] BB CE 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:50:26.033143, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:50:26.033467, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] BB CE 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej [0100] 03 48 28 E1 00 D1 .H(... [2025/04/09 07:50:26.033903, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:50:26.033944, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:50:26.034016, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:26.034042, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:50:26.034065, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:50:26.034088, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:26.034116, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:26.034179, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:50:26.034216, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:50:26.034247, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:50:26.034274, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:26.034306, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:50:26.034344, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:50:26.034389, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:26.034415, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:26.034444, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:50:26.034467, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:26.034498, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:50:26.034533, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:50:26.136044, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:50:27.092395, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:125(child_read_request) Need to read 36 extra bytes [2025/04/09 07:50:27.092490, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:50:27.092523, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_DsGetDcName (domain 'ADPROTOCOLX') [2025/04/09 07:50:27.092618, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName in: struct wbint_DsGetDcName domain_name : * domain_name : 'adprotocolx' domain_guid : NULL site_name : NULL flags : 0x40000001 (1073741825) [2025/04/09 07:50:27.092746, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName in: struct netr_GetAnyDCName logon_server : * logon_server : 'windc2.adprotocolx.com' domainname : * domainname : 'adprotocolx' [2025/04/09 07:50:27.092849, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000037 (55) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x00000068 (104) context_id : 0x0000 (0) opnum : 0x000d (13) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:50:27.093126, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x08 (8) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:50:27.093240, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:50:27.093312, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:50:27.100566, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:50:27.100622, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000037 (55) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000008 (8) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] D1 D0 F3 B1 E2 A9 C8 58 51 D9 B3 2A CA 53 8F 3C .......X Q..*.S.< [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] E8 D5 D3 71 43 A3 39 F1 35 BB 42 34 94 2A EF D0 ...qC.9. 5.B4.*.. [0030] 92 2A 75 FE A0 9C 49 ED 68 E3 73 95 71 01 00 00 .*u...I. h.s.q... [0040] 88 E3 73 95 71 01 00 00 04 00 00 00 00 00 00 00 ..s.q... ........ [2025/04/09 07:50:27.100929, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:50:27.101000, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:50:27.101032, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:50:27.101088, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 8 [2025/04/09 07:50:27.101125, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:50:27.101153, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. [2025/04/09 07:50:27.101188, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName out: struct netr_GetAnyDCName dcname : * dcname : NULL result : WERR_NO_LOGON_SERVERS [2025/04/09 07:50:27.101276, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS [2025/04/09 07:50:27.101317, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:50:27.101405, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:50:27.101430, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4016 bytes to parent [2025/04/09 07:50:29.035671, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:50:29.035917, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:50:29.036009, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery_dc.c:148(ads_dc_name) ads_dc_name: using server='WINDC2.ADPROTOCOLX.COM' IP=10.28.1.93 [2025/04/09 07:50:29.036045, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:50:29.036084, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename Default-First-Site-Name) [2025/04/09 07:50:29.036129, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:50:29.036176, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:50:29.036336, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename Default-First-Site-Name) [2025/04/09 07:50:29.036366, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:50:29.036429, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:29.036465, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:50:29.036497, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:50:29.036537, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:50:29.036571, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:29.036600, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:50:29.036627, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:50:29.036670, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:29.036697, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:29.036719, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:50:29.036742, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:29.036776, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:50:29.036805, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:50:29.036835, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:50:29.036872, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:50:29.036903, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:29.036934, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:29.036978, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3473(get_sorted_dc_list) get_sorted_dc_list: attempting lookup for name ADPROTOCOLX.COM (sitename NULL) [2025/04/09 07:50:29.037011, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:50:29.037042, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:50:29.037078, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#1c (sitename (null)) [2025/04/09 07:50:29.037108, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:329(namecache_fetch) namecache_fetch: name ADPROTOCOLX.COM#1C found. [2025/04/09 07:50:29.037144, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:29.037189, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:50:29.037215, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:50:29.037242, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:50:29.037276, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:29.037306, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:50:29.037333, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:50:29.037361, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:29.037386, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:29.037433, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:50:29.037464, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:29.037508, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.93 [2025/04/09 07:50:29.037537, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.206 [2025/04/09 07:50:29.037566, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 10.28.1.92 [2025/04/09 07:50:29.037594, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 192.168.122.133 [2025/04/09 07:50:29.037622, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:29.037650, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:29.037676, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1553(find_dc) Retrieved IP addresses for 6 DCs. [2025/04/09 07:50:29.037703, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1574(find_dc) Trying to establish a connection to one of the 6 DCs (timeout of 10 sec for each DC). [2025/04/09 07:50:29.037757, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/util_sock.c:458(open_socket_out_send) Connecting to 10.28.1.93 at port 445 [2025/04/09 07:50:29.038264, 3, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1589(find_dc) Successfully connected to DC '10.28.1.93'. [2025/04/09 07:50:29.038351, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1110(dcip_check_name_ads) Trying to figure out the DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93'. [2025/04/09 07:50:29.038402, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:865(ads_connect) ads_connect: Resolving name of LDAP server '10.28.1.93'. [2025/04/09 07:50:29.038445, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:382(ads_try_connect) ads_try_connect: ads_try_connect: sending CLDAP request to 10.28.1.93 (realm: ADPROTOCOLX.COM) [2025/04/09 07:50:29.039065, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:50:29.040337, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [ADPROTOCOLX], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:50:29.040376, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477370 seconds ahead) [2025/04/09 07:50:29.040469, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:67(sitename_store) sitename_store: realm = [adprotocolx.com], sitename = [Default-First-Site-Name], expire = [2085923199] [2025/04/09 07:50:29.040504, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[AD_SITENAME/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Dec 31 06:59:59 PM -2147481749 EST] (67768034447477370 seconds ahead) [2025/04/09 07:50:29.040559, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:926(ads_connect) Successfully contacted LDAP server 10.28.1.93 [2025/04/09 07:50:29.040592, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namecache.c:246(namecache_store) namecache_store: storing 1 address for windc2.adprotocolx.com#20: 10.28.1.93 [2025/04/09 07:50:29.040624, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[NBT/WINDC2.ADPROTOCOLX.COM#20] and timeout=[Wed Apr 9 08:01:29 AM 2025 EDT] (660 seconds ahead) [2025/04/09 07:50:29.040664, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1138(dcip_check_name_ads) dcip_check_name_ads: CLDAP flags = 0x1f1fc [2025/04/09 07:50:29.040692, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/ldap.c:233(ads_closest_dc) ads_closest_dc: NBT_SERVER_CLOSEST flag set [2025/04/09 07:50:29.040722, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/sitename_cache.c:101(sitename_fetch) sitename_fetch: Returning sitename for realm 'ADPROTOCOLX.COM': "Default-First-Site-Name" [2025/04/09 07:50:29.040770, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:733(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: fname = /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX, realm = ADPROTOCOLX.COM, domain = ADPROTOCOLX [2025/04/09 07:50:29.040803, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:50:29.040841, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:50:29.040871, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename Default-First-Site-Name) [2025/04/09 07:50:29.040908, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:50:29.040936, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:50:29.041055, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:50:29.041102, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:50:29.041170, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] C6 DB 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:50:30.042372, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:50:30.042483, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:50:30.042531, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:50:30.042636, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 7E 26 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ~&...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 .COM..!. . [2025/04/09 07:50:30.042795, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:50:30.043091, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 7E 26 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ~&...... ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 17 44 65 66 61 rberos._ tcp.Defa [0020] 75 6C 74 2D 46 69 72 73 74 2D 53 69 74 65 2D 4E ult-Firs t-Site-N [0030] 61 6D 65 06 5F 73 69 74 65 73 02 64 63 06 5F 6D ame._sit es.dc._m [0040] 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C 58 sdcs.ADP ROTOCOLX [0050] 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 00 .COM..!. ....!... [0060] 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E 64 ..X..... d.X.wind [0070] 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 63 c2.adpro tocolx.c [0080] 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E 00 om....!. ....X... [0090] 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 70 ..d.X.wi ndc1.adp [00A0] 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 6B 00 rotocolx .com..k. [00B0] 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 6B 00 ........ ....].k. [00C0] 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 6B 00 ........ ...z..k. [00D0] 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 00 ........ . ...... [00E0] 00 C9 73 D0 D7 81 C8 0F 00 C0 95 00 01 00 01 00 ..s..... ........ [00F0] 00 0E 10 00 04 0A 1C 01 5C C0 95 00 01 00 01 00 ........ \....... [0100] 00 0E 10 00 04 C0 A8 7A 85 C0 95 00 1C 00 01 00 .......z ........ [0110] 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A 03 ..... .. .....ej. [0120] 48 28 E1 00 D1 H(... [2025/04/09 07:50:30.043582, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:50:30.043643, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:50:30.043669, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:30.043692, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:50:30.043717, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:50:30.043743, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:30.043767, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:30.043829, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:50:30.043864, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:50:30.043897, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:50:30.043925, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:30.043981, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:50:30.044020, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:50:30.044048, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:30.044071, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:30.044098, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:50:30.044120, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:30.044150, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:477(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site Default-First-Site-Name search [2025/04/09 07:50:30.044181, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:276(saf_fetch) saf_fetch: failed to find server for "ADPROTOCOLX.COM" domain [2025/04/09 07:50:30.044211, 3, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3256(get_dc_list) get_dc_list: preferred server list: ", *" [2025/04/09 07:50:30.044235, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2667(internal_resolve_name) internal_resolve_name: looking up ADPROTOCOLX.COM#dcdc (sitename (null)) [2025/04/09 07:50:30.044262, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2514(resolve_ads) resolve_ads: Attempting to resolve KDCs for ADPROTOCOLX.COM using DNS [2025/04/09 07:50:30.044289, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2529(resolve_ads) resolve_ads: SRV query for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM [2025/04/09 07:50:30.044358, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #0 to 10.28.1.92 [2025/04/09 07:50:30.044403, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.92 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:50:30.044487, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] 7F C0 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:50:31.045684, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:274(dns_lookup_waited) dns_lookup_waited: waited [2025/04/09 07:50:31.045755, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:137(dns_lookup_send_next) dns_lookup_send_next: Sending DNS request #1 to 10.28.1.93 [2025/04/09 07:50:31.045786, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns.c:436(dns_cli_request_send) dns_cli_request_send: Asking 10.28.1.93 for _kerberos._tcp.dc._msdcs.ADPROTOCOLX.COM/1/33 via UDP [2025/04/09 07:50:31.045865, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] EB F2 01 00 00 01 00 00 00 00 00 00 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 X.COM..! .. [2025/04/09 07:50:31.045991, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/dns/dns_lookup.c:159(dns_lookup_send_next) dns_lookup_send_next: cancelling wait_subreq [2025/04/09 07:50:31.046375, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util.c:578(dump_data) [0000] EB F2 85 80 00 01 00 02 00 00 00 06 09 5F 6B 65 ........ ....._ke [0010] 72 62 65 72 6F 73 04 5F 74 63 70 02 64 63 06 5F rberos._ tcp.dc._ [0020] 6D 73 64 63 73 0B 41 44 50 52 4F 54 4F 43 4F 4C msdcs.AD PROTOCOL [0030] 58 03 43 4F 4D 00 00 21 00 01 C0 0C 00 21 00 01 X.COM..! .....!.. [0040] 00 00 02 58 00 1E 00 00 00 64 00 58 06 77 69 6E ...X.... .d.X.win [0050] 64 63 32 0B 61 64 70 72 6F 74 6F 63 6F 6C 78 03 dc2.adpr otocolx. [0060] 63 6F 6D 00 C0 0C 00 21 00 01 00 00 02 58 00 1E com....! .....X.. [0070] 00 00 00 64 00 58 06 77 69 6E 64 63 31 0B 61 64 ...d.X.w indc1.ad [0080] 70 72 6F 74 6F 63 6F 6C 78 03 63 6F 6D 00 C0 4C protocol x.com..L [0090] 00 01 00 01 00 00 0E 10 00 04 0A 1C 01 5D C0 4C ........ .....].L [00A0] 00 01 00 01 00 00 0E 10 00 04 C0 A8 7A CE C0 4C ........ ....z..L [00B0] 00 1C 00 01 00 00 0E 10 00 10 20 01 01 92 00 00 ........ .. ..... [00C0] 00 00 C9 73 D0 D7 81 C8 0F 00 C0 76 00 01 00 01 ...s.... ...v.... [00D0] 00 00 0E 10 00 04 0A 1C 01 5C C0 76 00 01 00 01 ........ .\.v.... [00E0] 00 00 0E 10 00 04 C0 A8 7A 85 C0 76 00 1C 00 01 ........ z..v.... [00F0] 00 00 0E 10 00 10 20 01 01 92 00 00 00 00 65 6A ...... . ......ej [0100] 03 48 28 E1 00 D1 .H(... [2025/04/09 07:50:31.046789, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.93 [2025/04/09 07:50:31.046830, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.206 [2025/04/09 07:50:31.046859, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:31.046881, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[0] 10.28.1.92 [2025/04/09 07:50:31.046909, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[1] 192.168.122.133 [2025/04/09 07:50:31.047005, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:2593(resolve_ads) resolve_ads: SRV lookup ADPROTOCOLX.COM got IP[2] 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:31.047050, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs internal_resolve_name: returning 6 addresses: 10.28.1.93 192.168.122.206 2001:192::c973:d0d7:81c8:f00 10.28.1.92 192.168.122.133 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:31.047147, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3288(get_dc_list) get_dc_list: Adding 6 DC's from auto lookup [2025/04/09 07:50:31.047194, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.93 [2025/04/09 07:50:31.047228, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.206 [2025/04/09 07:50:31.047256, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::c973:d0d7:81c8:f00 [2025/04/09 07:50:31.047283, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 10.28.1.92 [2025/04/09 07:50:31.047313, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 192.168.122.133 [2025/04/09 07:50:31.047343, 9, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/conncache.c:151(check_negative_conn_cache) check_negative_conn_cache returning result 0 for domain ADPROTOCOLX.COM server 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:31.047368, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:1228(remove_duplicate_addrs2) remove_duplicate_addrs2: looking for duplicate address/port pairs [2025/04/09 07:50:31.047395, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3427(get_dc_list) get_dc_list: returning 6 ip addresses in an ordered list [2025/04/09 07:50:31.047420, 4, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:3428(get_dc_list) get_dc_list: 10.28.1.93 192.168.122.206 10.28.1.92 192.168.122.133 2001:192::c973:d0d7:81c8:f00 2001:192::656a:348:28e1:d1 [2025/04/09 07:50:31.047459, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:492(get_kdc_ip_string) get_kdc_ip_string: got 6 addresses from site-less search [2025/04/09 07:50:31.047493, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:523(get_kdc_ip_string) get_kdc_ip_string: 5 additional KDCs to test [2025/04/09 07:50:31.148788, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/netlogon/netlogon.c:110(pull_netlogon_samlogon_response) &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX command : LOGON_SAM_LOGON_RESPONSE_EX (23) sbz : 0x0000 (0) server_type : 0x0001f1fc (127484) 0: NBT_SERVER_PDC 1: NBT_SERVER_GC 1: NBT_SERVER_LDAP 1: NBT_SERVER_DS 1: NBT_SERVER_KDC 1: NBT_SERVER_TIMESERV 1: NBT_SERVER_CLOSEST 1: NBT_SERVER_WRITABLE 0: NBT_SERVER_GOOD_TIMESERV 0: NBT_SERVER_NDNC 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6 1: NBT_SERVER_FULL_SECRET_DOMAIN_6 1: NBT_SERVER_ADS_WEB_SERVICE 1: NBT_SERVER_DS_8 1: NBT_SERVER_DS_9 1: NBT_SERVER_DS_10 0: NBT_SERVER_HAS_DNS_NAME 0: NBT_SERVER_IS_DEFAULT_NC 0: NBT_SERVER_FOREST_ROOT domain_uuid : 70ae124d-b2db-4f55-b55e-4c6e14b70108 forest : 'adprotocolx.com' dns_domain : 'adprotocolx.com' pdc_dns_name : 'windc2.adprotocolx.com' domain_name : 'ADPROTOCOLX' pdc_name : 'WINDC2' user_name : '' server_site : 'Default-First-Site-Name' client_site : 'Default-First-Site-Name' sockaddr_size : 0x00 (0) sockaddr: struct nbt_sockaddr sockaddr_family : 0x00000000 (0) pdc_ip : (null) remaining : DATA_BLOB length=0 next_closest_site : NULL nt_version : 0x00000005 (5) 1: NETLOGON_NT_VERSION_1 0: NETLOGON_NT_VERSION_5 1: NETLOGON_NT_VERSION_5EX 0: NETLOGON_NT_VERSION_5EX_WITH_IP 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL 0: NETLOGON_NT_VERSION_PDC 0: NETLOGON_NT_VERSION_IP 0: NETLOGON_NT_VERSION_LOCAL 0: NETLOGON_NT_VERSION_GC lmnt_token : 0xffff (65535) lm20_token : 0xffff (65535) [2025/04/09 07:50:31.621295, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:50:31.621365, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:50:31.621484, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:31.621594, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:50:31.621719, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000038 (56) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:50:31.621949, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:50:31.622075, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:50:31.622149, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:50:31.623133, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:50:31.623186, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000038 (56) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] EA FB B4 7F 70 BF 19 84 1F 0F BD ED DC 67 BA 8F ....p... .....g.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 4C F1 76 CC DE 55 EB D3 03 3D 54 9C 71 DE 35 F1 L.v..U.. .=T.q.5. [0030] 8E D8 7B C3 BB 27 75 D7 B5 5E 4C 6E 14 B7 01 08 ..{..'u. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:50:31.623502, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:50:31.623527, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:50:31.623548, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:50:31.623589, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:50:31.623615, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:50:31.623636, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:50:31.623672, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:50:31.623747, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:50:31.623772, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:31.623838, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:50:31.623859, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:50:31.624622, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:50:31.624654, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:50:31.624698, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:31.624750, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:50:31.624819, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000039 (57) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:50:31.625062, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:50:31.625147, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:50:31.625185, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:50:31.625930, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:50:31.626013, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000039 (57) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] B3 0C 33 9E 7D E0 B4 D5 DE E0 EF 46 8C B4 AF 37 ..3.}... ...F...7 [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 03 59 3B 41 20 EA 58 9D EA 38 7E A1 76 17 46 5D .Y;A .X. .8~.v.F] [0030] 1E DD 19 E5 A4 72 85 64 B5 5E 4C 6E 14 B7 01 08 .....r.d .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:50:31.626310, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:50:31.626334, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:50:31.626355, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:50:31.626390, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:50:31.626414, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:50:31.626435, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:50:31.626481, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:50:31.626558, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:50:31.626583, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:31.626647, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:50:31.626669, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:50:34.049576, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:595(get_kdc_ip_string) get_kdc_ip_string: Returning kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:50:34.049802, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:832(create_local_private_krb5_conf_for_domain) create_local_private_krb5_conf_for_domain: wrote file /run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX with realm ADPROTOCOLX.COM KDC list: kdc = 10.28.1.93 kdc = [2001:192::c973:d0d7:81c8:f00]:88 [2025/04/09 07:50:34.049945, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX], server = [windc2.adprotocolx.com], expire = [1744200334] [2025/04/09 07:50:34.050014, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX] and timeout=[Wed Apr 9 08:05:34 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:50:34.050074, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/namequery.c:154(saf_store) saf_store: domain = [ADPROTOCOLX.COM], server = [windc2.adprotocolx.com], expire = [1744200334] [2025/04/09 07:50:34.050099, 10, pid=2398754, effective(0, 0), real(0, 0), class=tdb] ../../source3/lib/gencache.c:283(gencache_set_data_blob) gencache_set_data_blob: Adding cache entry with key=[SAF/DOMAIN/ADPROTOCOLX.COM] and timeout=[Wed Apr 9 08:05:34 AM 2025 EDT] (900 seconds ahead) [2025/04/09 07:50:34.050157, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:1172(dcip_check_name_ads) DC name for domain 'ADPROTOCOLX' at IP '10.28.1.93' is 'windc2.adprotocolx.com' [2025/04/09 07:50:34.050226, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:751(cm_prepare_connection) cm_prepare_connection: connecting to DC windc2.adprotocolx.com for domain ADPROTOCOLX [2025/04/09 07:50:46.632343, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:50:46.632401, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:50:46.632553, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:50:46.632702, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:50:46.632882, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003a (58) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:50:46.633184, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:50:46.633303, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:50:46.633391, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:50:46.634878, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:50:46.634940, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003a (58) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 27 CA F1 9D 1D 4C 4E B9 9F 1E 26 32 9E B0 C6 36 '....LN. ..&2...6 [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] E2 1B 43 AF 61 C6 FD E6 0D 17 7D 3C 3C A2 1B E4 ..C.a... ..}<<... [0030] 9B 28 77 D3 3A 4F 25 6B B5 5E 4C 6E 14 B7 01 08 .(w.:O%k .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:50:46.635260, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:50:46.635287, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:50:46.635307, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:50:46.635345, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:50:46.635370, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:50:46.635396, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:50:46.635429, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:50:46.635536, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:50:46.635576, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:50:46.635663, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:50:46.635686, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:51:01.622747, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:51:01.622828, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:51:01.623007, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:51:01.623125, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:51:01.623259, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003b (59) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:51:01.623448, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:51:01.623598, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:51:01.623676, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:51:01.625379, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:51:01.625446, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003b (59) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] EF 80 2A CE 16 93 BF 9C 9F D6 51 21 0D 5F D4 2D ..*..... ..Q!._.- [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 5E A1 DD 9E 76 4E E2 3C 53 24 B4 4D 59 04 4E 02 ^...vN.< S$.MY.N. [0030] 70 65 9F B0 F0 FB 6B 35 B5 5E 4C 6E 14 B7 01 08 pe....k5 .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:51:01.625732, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:51:01.625821, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:51:01.625849, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:51:01.625887, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:51:01.625924, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:51:01.625944, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:51:01.626025, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:51:01.626115, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:51:01.626139, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:51:01.626210, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:51:01.626232, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:51:07.032360, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/clientgen.c:43(cli_set_timeout) cli_set_timeout: Changing connection timeout for server 'windc2.adprotocolx.com' from 20000 (ms) to 10000 (ms). [2025/04/09 07:51:07.032576, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/util/util_net.c:1019(print_socket_options) socket options: SO_KEEPALIVE=1, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=4, TCP_KEEPIDLE=240, TCP_KEEPINTVL=15, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0 ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:51:07.034140, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cm.c:861(cm_prepare_connection) connecting to windc2.adprotocolx.com (ADPROTOCOLX, ADPROTOCOLX.COM) with account [ADPROTOCOLX\GPFSNMBASH$] principal [GPFSNMBASH$@ADPROTOCOLX.COM] and realm [ADPROTOCOLX.COM] [2025/04/09 07:51:07.034206, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:308(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Doing kinit for GPFSNMBASH$@ADPROTOCOLX.COM to access windc2.adprotocolx.com [2025/04/09 07:51:07.034358, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:151(kerberos_kinit_password_ext) kerberos_kinit_password_ext: as GPFSNMBASH$@ADPROTOCOLX.COM using [MEMORY:cliconnect] as ccache and config [/run/gpfs-samba/lock/smb_krb5/krb5.conf.ADPROTOCOLX] [2025/04/09 07:51:07.034411, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199467.034345: Getting initial credentials for GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:51:07.034875, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199467.034347: Sending unauthenticated request [2025/04/09 07:51:07.034914, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199467.034348: Sending request (182 bytes) to ADPROTOCOLX.COM [2025/04/09 07:51:07.035182, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199467.034349: Resolving hostname 10.28.1.93 [2025/04/09 07:51:07.035326, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199467.034350: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 07:51:07.036450, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199467.034351: Received answer (219 bytes) from dgram 10.28.1.93:88 [2025/04/09 07:51:07.036525, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199467.034352: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:51:07.037773, 1] ../../source3/rpc_client/cli_pipe.c:554(cli_pipe_validate_current_pdu) ../../source3/rpc_client/cli_pipe.c:554: RPC fault code DCERPC_FAULT_ACCESS_DENIED received from host windc2.adprotocolx.com! ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:51:10.099603, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199470.099589: No URI records found [2025/04/09 07:51:10.099707, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199470.099590: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. [2025/04/09 07:51:13.171837, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199473.171826: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:51:14.039006, 1] ../../lib/tdb_wrap/tdb_wrap.c:65(tdb_wrap_log) tdb(/run/gpfs-samba/lock/mutex.tdb): tdb_lock failed on list 98 ltype=1 (Interrupted system call) [2025/04/09 07:51:14.039128, 0] ../../source3/lib/util_tdb.c:411(tdb_chainlock_with_timeout_internal) tdb_chainlock_with_timeout_internal: alarm (40) timed out for key windc2.adprotocolx.com in tdb /run/gpfs-samba/lock/mutex.tdb [2025/04/09 07:51:14.039412, 1] ../../source3/lib/server_mutex.c:97(grab_named_mutex) Could not get the lock for windc2.adprotocolx.com [2025/04/09 07:51:14.039552, 0] ../../source3/winbindd/winbindd_cm.c:760(cm_prepare_connection) cm_prepare_connection: mutex grab failed for windc2.adprotocolx.com [2025/04/09 07:51:14.039606, 1] ../../source3/winbindd/winbindd_cm.c:1021(cm_prepare_connection) Failed to prepare SMB connection to windc2.adprotocolx.com: NT_STATUS_POSSIBLE_DEADLOCK [2025/04/09 07:51:16.243891, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243879: No SRV records found [2025/04/09 07:51:16.244011, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243880: Response was not from master KDC [2025/04/09 07:51:16.244082, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243881: Received error from KDC: -1765328359/Additional pre-authentication required [2025/04/09 07:51:16.244177, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243884: Preauthenticating using KDC method data [2025/04/09 07:51:16.244229, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243885: Processing preauth types: PA-PK-AS-REQ (16), PA-PK-AS-REP_OLD (15), PA-ETYPE-INFO2 (19), PA-ENC-TIMESTAMP (2) [2025/04/09 07:51:16.244276, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243886: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:51:16.248076, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243887: AS key obtained for encrypted timestamp: aes256-cts/C8D8 [2025/04/09 07:51:16.248179, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243889: Encrypted timestamp (for 1744210265.658860): plain 301AA011180F32303235303430393134353130355AA10502030A0DAC, encrypted 12E9C53D34DB64C4148DA16DB2C66E28DEDE9DB526376B5F9627951C45735B8B9B12C5F9A1E3E35E1403BC04FFBEC906C0F8B505775D09B8 [2025/04/09 07:51:16.248240, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243890: Preauth module encrypted_timestamp (2) (real) returned: 0/Success [2025/04/09 07:51:16.248279, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243891: Produced preauth for next request: PA-ENC-TIMESTAMP (2) [2025/04/09 07:51:16.248324, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243892: Sending request (261 bytes) to ADPROTOCOLX.COM [2025/04/09 07:51:16.248411, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243893: Resolving hostname 10.28.1.93 [2025/04/09 07:51:16.248547, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243894: Sending initial UDP request to dgram 10.28.1.93:88 [2025/04/09 07:51:16.250261, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243895: Received answer (102 bytes) from dgram 10.28.1.93:88 [2025/04/09 07:51:16.250362, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199476.243896: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:51:16.629491, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:51:16.629559, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:51:16.629653, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:51:16.629732, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:51:16.629830, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003c (60) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:51:16.630069, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:51:16.630177, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:51:16.630254, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:51:16.633271, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:51:16.633321, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003c (60) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 37 F2 0D 9E 96 64 13 84 8A DD 9B B0 CF 8E E1 C8 7....d.. ........ [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 2E 0E E0 E5 45 A5 1F 99 A4 95 10 7C E1 3F CD F2 ....E... ...|.?.. [0030] 25 E9 0E 6F 2D 00 17 EF 00 00 00 00 00 00 00 00 %..o-... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:51:16.633590, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:51:16.633613, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:51:16.633632, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:51:16.633664, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:51:16.633685, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:51:16.633713, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:51:16.633742, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:51:16.633813, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:51:16.633834, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:51:16.633890, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:51:16.633910, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:51:19.315802, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199479.315787: No URI records found [2025/04/09 07:51:19.315998, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199479.315788: Sending DNS SRV query for _kerberos-master._udp.ADPROTOCOLX.COM. [2025/04/09 07:51:22.387723, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199482.387712: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:51:25.459905, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459876: No SRV records found [2025/04/09 07:51:25.459992, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459877: Response was not from master KDC [2025/04/09 07:51:25.460085, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459878: Received error from KDC: -1765328332/Response too big for UDP, retry with TCP [2025/04/09 07:51:25.460117, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459879: Request or response is too big for UDP; retrying with TCP [2025/04/09 07:51:25.460144, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459880: Sending request (261 bytes) to ADPROTOCOLX.COM (tcp only) [2025/04/09 07:51:25.460296, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459881: Resolving hostname 10.28.1.93 [2025/04/09 07:51:25.460458, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459882: Initiating TCP connection to stream 10.28.1.93:88 [2025/04/09 07:51:25.460983, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459883: Sending TCP request to stream 10.28.1.93:88 [2025/04/09 07:51:25.462582, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459884: Received answer (1596 bytes) from stream 10.28.1.93:88 [2025/04/09 07:51:25.462626, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459885: Terminating TCP connection to stream 10.28.1.93:88 [2025/04/09 07:51:25.462725, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199485.459886: Sending DNS URI query for _kerberos.ADPROTOCOLX.COM. [2025/04/09 07:51:28.531660, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199488.531642: No URI records found [2025/04/09 07:51:28.531761, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199488.531643: Sending DNS SRV query for _kerberos-master._tcp.ADPROTOCOLX.COM. [2025/04/09 07:51:31.614121, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614088: No SRV records found [2025/04/09 07:51:31.614199, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614089: Response was not from master KDC [2025/04/09 07:51:31.614279, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614090: Processing preauth types: PA-ETYPE-INFO2 (19) [2025/04/09 07:51:31.614316, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614091: Selected etype info: etype aes256-cts, salt "ADPROTOCOLX.COMhostgpfsnmbash.adprotocolx.com", params "" [2025/04/09 07:51:31.614345, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614092: Produced preauth for next request: (empty) [2025/04/09 07:51:31.614397, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614093: AS key determined by preauth: aes256-cts/C8D8 [2025/04/09 07:51:31.614498, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614094: Decrypted AS reply; session key is: aes256-cts/8537 [2025/04/09 07:51:31.614548, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614095: FAST negotiation: unavailable [2025/04/09 07:51:31.614634, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libads/kerberos.c:211(kerberos_kinit_password_ext) kerberos_kinit_password_ext: GPFSNMBASH$@ADPROTOCOLX.COM mapped to GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:51:31.614685, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614096: Initializing MEMORY:cliconnect with default princ GPFSNMBASH$@ADPROTOCOLX.COM [2025/04/09 07:51:31.614730, 10, pid=2398754, effective(0, 0), real(0, 0), class=kerberos] ../../lib/krb5_wrap/krb5_samba.c:3989(smb_krb5_trace_cb) smb_krb5_trace_cb: [2398754] 1744199491.614097: Storing GPFSNMBASH$@ADPROTOCOLX.COM -> krbtgt/ADPROTOCOLX.COM@ADPROTOCOLX.COM in MEMORY:cliconnect [2025/04/09 07:51:31.614811, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:370(cli_session_creds_prepare_krb5) cli_session_creds_prepare_krb5: Successfully authenticated as GPFSNMBASH$@ADPROTOCOLX.COM (GPFSNMBASH$@ADPROTOCOLX.COM) to access windc2.adprotocolx.com using Kerberos [2025/04/09 07:51:31.614847, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/libsmb/cliconnect.c:1349(cli_session_setup_spnego_send) cli_session_setup_spnego_send: Connect to windc2.adprotocolx.com as GPFSNMBASH$@ADPROTOCOLX.COM using SPNEGO [2025/04/09 07:51:31.615166, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC mechanism spnego [2025/04/09 07:51:31.615279, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC submechanism gse_krb5 [2025/04/09 07:51:31.641480, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:51:31.641545, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:51:31.641664, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:51:31.641773, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:51:31.641870, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003d (61) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:51:31.642100, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:51:31.642216, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:51:31.642281, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:51:31.645502, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:51:31.645568, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003d (61) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] AC 7F 23 B4 96 95 C7 4B B7 66 68 64 E6 03 99 6E ..#....K .fhd...n [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] F7 3B E0 51 84 55 F4 D1 3F B7 DD 27 CC 4E 0E 0A .;.Q.U.. ?..'.N.. [0030] 63 F0 5A 8E 4B ED 0E 35 B8 3C 71 95 71 01 00 00 c.Z.K..5 .pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003e (62) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 6A D5 86 ED 43 70 26 E4 6A 4B 80 27 C6 27 A6 9E j...Cp&. jK.'.'.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] CD 2B 36 FA A4 4E 2D 72 5C 1F E5 54 0B 10 E6 61 .+6..N-r \..T...a [0030] 77 2F BD C2 22 9C 5E 75 B8 3C 71 95 71 01 00 00 w/..".^u .creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH session_key : 6927d03bace8352078671274da7f767c sequence : 0x67f65e44 (1744199236) seed: struct netr_Credential data : 5ae434c6f197d07b client: struct netr_Credential data : 7b2f5a59c67e107d server: struct netr_Credential data : 780a45edba62c4b2 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' ex : * ex: struct netlogon_creds_CredentialState_extra_info magic : 0x00000601 (1537) reserved : 0x00000000 (0) client_requested_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH auth_time : Wed Apr 9 07:47:15 AM 2025 EDT client_sid : S-1-0-1108 [2025/04/09 07:51:50.043726, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:51:50.043756, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:51:50.043795, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:51:50.043845, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1171(fetch_locked_internal) ctdb_data.dptr = (nil), dmaster = 4294967295 (1) 0 [2025/04/09 07:51:50.043868, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:968(ctdbd_migrate) ctdbd_migrate: Sending ctdb packet ldb: unable to stat module /usr/lpp/mmfs/lib64/samba/ldb : No such file or directory [2025/04/09 07:51:50.044053, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:51:50.044094, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:51:50.044124, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:51:50.044164, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:51:50.044184, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:51:50.044273, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:51:50.044817, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../libcli/auth/netlogon_creds_cli.c:662(netlogon_creds_cli_fetch_parser) state->creds: struct netlogon_creds_CredentialState negotiate_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH session_key : 6927d03bace8352078671274da7f767c sequence : 0x67f65e44 (1744199236) seed: struct netr_Credential data : 5ae434c6f197d07b client: struct netr_Credential data : 7b2f5a59c67e107d server: struct netr_Credential data : 780a45edba62c4b2 secure_channel_type : SEC_CHAN_WKSTA (0x2) computer_name : 'GPFSNMBASH' account_name : 'GPFSNMBASH$' ex : * ex: struct netlogon_creds_CredentialState_extra_info magic : 0x00000601 (1537) reserved : 0x00000000 (0) client_requested_flags : 0x610fffff (1628438527) 1: NETLOGON_NEG_ACCOUNT_LOCKOUT 1: NETLOGON_NEG_PERSISTENT_SAMREPL 1: NETLOGON_NEG_ARCFOUR 1: NETLOGON_NEG_PROMOTION_COUNT 1: NETLOGON_NEG_CHANGELOG_BDC 1: NETLOGON_NEG_FULL_SYNC_REPL 1: NETLOGON_NEG_MULTIPLE_SIDS 1: NETLOGON_NEG_REDO 1: NETLOGON_NEG_PASSWORD_CHANGE_REFUSAL 1: NETLOGON_NEG_SEND_PASSWORD_INFO_PDC 1: NETLOGON_NEG_GENERIC_PASSTHROUGH 1: NETLOGON_NEG_CONCURRENT_RPC 1: NETLOGON_NEG_AVOID_ACCOUNT_DB_REPL 1: NETLOGON_NEG_AVOID_SECURITYAUTH_DB_REPL 1: NETLOGON_NEG_STRONG_KEYS 1: NETLOGON_NEG_TRANSITIVE_TRUSTS 1: NETLOGON_NEG_DNS_DOMAIN_TRUSTS 1: NETLOGON_NEG_PASSWORD_SET2 1: NETLOGON_NEG_GETDOMAININFO 1: NETLOGON_NEG_CROSS_FOREST_TRUSTS 0: NETLOGON_NEG_NEUTRALIZE_NT4_EMULATION 0: NETLOGON_NEG_RODC_PASSTHROUGH 0: NETLOGON_NEG_SUPPORTS_AES_SHA2 1: NETLOGON_NEG_SUPPORTS_AES 1: NETLOGON_NEG_AUTHENTICATED_RPC_LSASS 1: NETLOGON_NEG_AUTHENTICATED_RPC 0: NETLOGON_NEG_SUPPORTS_KERBEROS_AUTH auth_time : Wed Apr 9 07:47:15 AM 2025 EDT client_sid : S-1-0-1108 [2025/04/09 07:51:50.045535, 5, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec_start.c:847(gensec_start_mech) Starting GENSEC mechanism schannel [2025/04/09 07:51:50.045575, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1811(rpc_pipe_bind_send) Bind RPC Pipe: host windc2.adprotocolx.com auth_type 68, auth_level 6 [2025/04/09 07:51:50.045598, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1094(create_generic_auth_rpc_bind_req) create_generic_auth_rpc_bind_req: generate first token [2025/04/09 07:51:50.045661, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55cf825b31d0]: subreq: 0x55cf825c8e50 [2025/04/09 07:51:50.045691, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55cf825b31d0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55cf825c8e50/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825c9030)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] [2025/04/09 07:51:50.045723, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x00 (0) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=31 [0000] 00 00 00 00 03 00 00 00 41 44 50 52 4F 54 4F 43 ........ ADPROTOC [0010] 4F 4C 58 00 47 50 46 53 4E 4D 42 41 53 48 00 OLX.GPFS NMBASH. [2025/04/09 07:51:50.045827, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND (11) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x006f (111) auth_length : 0x001f (31) call_id : 0x0000000e (14) u : union dcerpc_payload(case 11) bind: struct dcerpc_bind max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000000 (0) num_contexts : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ctx_list context_id : 0x0000 (0) num_transfer_syntaxes : 0x01 (1) abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntaxes: ARRAY(1) transfer_syntaxes: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=39 [0000] 44 06 00 00 01 00 00 00 00 00 00 00 03 00 00 00 D....... ........ [0010] 41 44 50 52 4F 54 4F 43 4F 4C 58 00 47 50 46 53 ADPROTOC OLX.GPFS [0020] 4E 4D 42 41 53 48 00 NMBASH. [2025/04/09 07:51:50.046141, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:51:50.046186, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:51:50.046706, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 72 [2025/04/09 07:51:50.046785, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_BIND_ACK (12) pfc_flags : 0x07 (7) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 1: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0058 (88) auth_length : 0x000c (12) call_id : 0x0000000e (14) u : union dcerpc_payload(case 12) bind_ack: struct dcerpc_bind_ack max_xmit_frag : 0x10b8 (4280) max_recv_frag : 0x10b8 (4280) assoc_group_id : 0x00000b88 (2952) secondary_address_size : 0x000c (12) secondary_address : '\pipe\lsass' _pad1 : DATA_BLOB length=2 [0000] 00 00 .. num_results : 0x01 (1) ctx_list: ARRAY(1) ctx_list: struct dcerpc_ack_ctx result : DCERPC_BIND_ACK_RESULT_ACCEPTANCE (0) reason : union dcerpc_bind_ack_reason(case 0) value : DCERPC_BIND_ACK_REASON_NOT_SPECIFIED (0) syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) auth_info : DATA_BLOB length=20 [0000] 44 06 00 00 01 00 00 00 01 00 00 00 00 00 00 00 D....... ........ [0010] 00 00 00 00 .... [2025/04/09 07:51:50.047113, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 88 at offset 0: NT_STATUS_OK [2025/04/09 07:51:50.047147, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 88 bytes. [2025/04/09 07:51:50.047174, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1686(check_bind_response) check_bind_response: accepted! [2025/04/09 07:51:50.047196, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 0 [2025/04/09 07:51:50.047224, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:458(gensec_update_send) gensec_update_send: schannel[0x55cf825b31d0]: subreq: 0x55cf825c8e50 [2025/04/09 07:51:50.047249, 10, pid=2398754, effective(0, 0), real(0, 0), class=auth] ../../auth/gensec/gensec.c:551(gensec_update_done) gensec_update_done: schannel[0x55cf825b31d0]: NT_STATUS_OK tevent_req[0x55cf825c8e50/../../auth/gensec/schannel.c:775]: state[2] error[0 (0x0)] state[struct schannel_update_state (0x55cf825c9030)] timer[(nil)] finish[../../auth/gensec/schannel.c:791] [2025/04/09 07:51:50.047284, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:174(dbwrap_lock_order_lock) dbwrap_lock_order_lock: check lock order 3 for g_lock.tdb [2025/04/09 07:51:50.047303, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:157(debug_lock_order) lock order: 1: 2: 3:g_lock.tdb 4: [2025/04/09 07:51:50.047327, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1132(fetch_locked_internal) Locking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:51:50.047360, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:507(dbwrap_watched_record_prepare_wakeup) dbwrap_watched_record_prepare_wakeup: No watchers [2025/04/09 07:51:50.047389, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/ctdbd_conn.c:790(ctdbd_control) ctdbd_control: Sending ctdb packet reqid=22, vnn=4026531841, opcode=128, srvid=1294615339 [2025/04/09 07:51:50.047472, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_ctdb.c:1001(db_ctdb_record_destr) Unlocking db 1294615339 key 434C495B475046534E4D [2025/04/09 07:51:50.047504, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:487(dbwrap_watched_do_locked) dbwrap_watched_do_locked: dbwrap_watched_do_locked_fn returned [2025/04/09 07:51:50.047522, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../source3/lib/dbwrap/dbwrap_watch.c:550(dbwrap_watched_trigger_wakeup) dbwrap_watched_trigger_wakeup: No one to wakeup [2025/04/09 07:51:50.047539, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../lib/dbwrap/dbwrap.c:206(dbwrap_lock_order_unlock) dbwrap_lock_order_unlock: release lock order 3 for g_lock.tdb [2025/04/09 07:51:50.047592, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName in: struct netr_GetAnyDCName logon_server : * logon_server : 'windc2.adprotocolx.com' domainname : * domainname : 'adprotocolx' [2025/04/09 07:51:50.047704, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:1395(prepare_verification_trailer) t: struct dcerpc_sec_verification_trailer _pad : DATA_BLOB length=0 magic : 0000000000000000 count: struct dcerpc_sec_vt_count count : 0x0002 (2) commands: ARRAY(2) commands: struct dcerpc_sec_vt command : 0x0001 (1) 0x01: DCERPC_SEC_VT_COMMAND_ENUM (1) 0: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x1) bitmask1 : 0x00000001 (1) 1: DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING commands: struct dcerpc_sec_vt command : 0x4002 (16386) 0x02: DCERPC_SEC_VT_COMMAND_ENUM (2) 1: DCERPC_SEC_VT_COMMAND_END 0: DCERPC_SEC_VT_MUST_PROCESS u : union dcerpc_sec_vt_union(case 0x2) pcontext: struct dcerpc_sec_vt_pcontext abstract_syntax: struct ndr_syntax_id uuid : 12345678-1234-abcd-ef00-01234567cffb if_version : 0x00000001 (1) transfer_syntax: struct ndr_syntax_id uuid : 8a885d04-1ceb-11c9-9fe8-08002b104860 if_version : 0x00000002 (2) [2025/04/09 07:51:50.047908, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000000f (15) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x000000a4 (164) context_id : 0x0000 (0) opnum : 0x000d (13) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:51:50.048112, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x0c (12) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:51:50.048238, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:51:50.048287, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:52:01.636659, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:52:01.636717, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:52:01.636785, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:52:01.636873, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:52:01.636998, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x0000003f (63) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:52:01.637221, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:52:01.637327, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:52:01.637382, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:52:01.639367, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:52:01.639424, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000003f (63) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 0C 15 37 8C 49 22 C4 30 FC 2E 51 81 90 6F BC 65 ..7.I".0 ..Q..o.e [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] B8 E7 DD 92 16 FF 4A 13 E5 5E 5D 7B 91 E3 7B 95 ......J. .^]{..{. [0030] 04 76 6C D3 38 FD 6A 13 B8 3C 71 95 71 01 00 00 .vl.8.j. .pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x0000000f (15) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x00000008 (8) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] D5 B1 75 C7 0F A6 0F 5B E6 17 54 4C 9D B2 FC 2A ..u....[ ..TL...* [0010] 44 06 08 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 04 9A 1F DB 23 4F 55 A9 54 29 48 C1 A6 88 61 EC ....#OU. T)H...a. [0030] 4E E5 5B 16 08 51 EE BA 00 00 00 00 00 00 00 00 N.[..Q.. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:52:05.044614, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:52:05.044649, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 8 [2025/04/09 07:52:05.044670, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:52:05.044754, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 8 [2025/04/09 07:52:05.044778, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:52:05.044812, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 8 bytes. [2025/04/09 07:52:05.044866, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_GetAnyDCName: struct netr_GetAnyDCName out: struct netr_GetAnyDCName dcname : * dcname : NULL result : WERR_NO_LOGON_SERVERS [2025/04/09 07:52:05.045073, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:774(_wbint_DsGetDcName) dcerpc_netr_Get[Any]DCName failed: WERR_NO_LOGON_SERVERS [2025/04/09 07:52:05.045141, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_DsGetDcName: struct wbint_DsGetDcName out: struct wbint_DsGetDcName dc_info : * dc_info : NULL result : NT_STATUS_NO_LOGON_SERVERS [2025/04/09 07:52:05.045276, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:52:05.045300, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4016 bytes to parent [2025/04/09 07:52:16.669752, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:52:16.669825, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:52:16.669987, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:52:16.670127, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:52:16.670279, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000040 (64) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:52:16.670492, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:52:16.670639, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:52:16.670715, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:52:16.671589, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:52:16.671644, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000040 (64) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 0B D7 A0 4D BA 98 B5 20 84 AC FA 7A 22 B8 33 D0 ...M... ...z".3. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] F8 54 05 0E 18 B6 54 5E 9D 32 C5 8F A1 88 AF FB .T....T^ .2...... [0030] 4A 3B 86 3B 36 67 D3 E4 00 00 00 00 00 00 00 00 J;.;6g.. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:52:16.671984, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:52:16.672026, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:52:16.672047, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:52:16.672082, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:52:16.672105, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:52:16.672126, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:52:16.672162, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:52:16.672280, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:52:16.672304, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:52:16.672375, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:52:16.672398, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:52:31.647984, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:52:31.648059, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:52:31.648149, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:52:31.648239, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:52:31.648343, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000041 (65) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:52:31.648544, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:52:31.648655, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:52:31.648722, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:52:31.649859, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:52:31.649935, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000041 (65) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 83 50 82 7C 96 56 B8 8A 3E 9B C1 D8 DE 11 93 39 .P.|.V.. >......9 [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 6D 32 BA DD C8 E5 3F 00 05 32 2C CC 99 3D 2A 3A m2....?. .2,..=*: [0030] 3B 6E F6 12 5E 7A B1 4A B8 3C 71 95 71 01 00 00 ;n..^z.J .pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000042 (66) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 43 8B FE 33 16 E1 D9 00 05 FB 76 D4 FB 7E 16 9D C..3.... ..v..~.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 08 67 0B AF F7 E2 C6 8D 84 29 4E 16 7C E3 DE 0E .g...... .)N.|... [0030] 5B 16 76 3F 94 D4 13 80 00 00 00 00 00 00 00 00 [.v?.... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:52:46.653677, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:52:46.653701, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:52:46.653731, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:52:46.653764, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:52:46.653786, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:52:46.653814, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:52:46.653843, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:52:46.653909, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:52:46.653930, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:52:46.654054, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:52:46.654085, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:53:01.648557, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:53:01.648552, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:53:01.648661, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:53:01.648694, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:53:01.648829, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:01.648937, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc [2025/04/09 07:53:01.649005, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct wbint_PingDc in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:53:01.649121, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [2025/04/09 07:53:01.649210, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl [3] : 0x00 (0) in: struct netr_LogonControl frag_length : 0x0018 (24) logon_server : * auth_length : 0x0038 (56) logon_server : '\\windc2.adprotocolx.com' call_id : 0x00000043 (67) function_code : NETLOGON_CONTROL_QUERY (1) u : union dcerpc_payload(case 0) level : 0x00000002 (2) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:53:01.649322, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) [2025/04/09 07:53:01.649337, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth rpc_vers_minor : 0x00 (0) auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) ptype : DCERPC_PKT_REQUEST (0) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) pfc_flags : 0x03 (3) auth_pad_length : 0x04 (4) 1: DCERPC_PFC_FLAG_FIRST auth_reserved : 0x00 (0) 1: DCERPC_PFC_FLAG_LAST auth_context_id : 0x00000001 (1) 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING credentials : DATA_BLOB length=0 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000010 (16) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) [2025/04/09 07:53:01.649477, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:53:01.649528, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) [2025/04/09 07:53:01.649582, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) credentials : DATA_BLOB length=0 [2025/04/09 07:53:01.649653, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:53:01.649752, 5, pid=2398754, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:53:01.651497, 5, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:53:01.651568, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000010 (16) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 46 13 DC D5 02 1D 54 D9 7B 2B C4 0B C8 ED 6B 89 F.....T. {+....k. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 77 AF E2 82 EA 5A 60 D0 7C 2F 20 A8 52 80 82 A4 w....Z`. |/ .R... [0030] 7F F9 CE F6 62 FE 97 9F 00 00 00 00 00 00 00 00 ....b... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:53:01.651842, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:53:01.651867, 10, pid=2398754, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:53:01.651886, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:53:01.651922, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:53:01.651944, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:53:01.652044, 10, pid=2398754, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:53:01.652080, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:53:01.652161, 5, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:53:01.652184, 1, pid=2398754, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:01.652247, 4, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:53:01.652267, 10, pid=2398754, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:53:01.652436, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:53:01.652474, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000043 (67) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] ED 60 C4 C4 29 96 A8 D9 F5 CA 27 AC 86 C1 45 70 .`..)... ..'...Ep [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 80 09 E2 DD 36 CB B7 63 00 6D 37 E3 40 8A 48 18 ....6..c .m7.@.H. [0030] BB 2C B4 5B 8C 4C 45 62 00 00 00 00 00 00 00 00 .,.[.LEb ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:53:01.652725, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:53:01.652746, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:53:01.652765, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:53:01.652795, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:53:01.652816, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:53:01.652839, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:53:01.652863, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:53:01.652938, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:53:01.653007, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:01.653083, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:53:01.653105, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:53:16.666236, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:53:16.666320, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:53:16.666625, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:16.666820, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:53:16.666947, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000044 (68) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:53:16.667221, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:53:16.667329, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:53:16.667414, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:53:16.668917, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:53:16.668993, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000044 (68) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 33 F5 4B 14 0F 4C 08 94 B1 4A 55 FA 9F 41 80 F3 3.K..L.. .JU..A.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 13 E0 40 F0 45 50 69 3E AD 9D 00 E6 22 00 6A FE ..@.EPi> ....".j. [0030] 57 F4 3A 95 6A 00 F6 88 00 00 00 00 00 00 00 00 W.:.j... ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:53:16.669309, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:53:16.669341, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:53:16.669360, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:53:16.669397, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:53:16.669421, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:53:16.669441, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:53:16.669469, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:53:16.669557, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:53:16.669580, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:16.669646, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:53:16.669666, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:53:31.656649, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:53:31.656724, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:53:31.656869, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:31.657076, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:53:31.657245, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000045 (69) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:53:31.657471, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:53:31.657655, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:53:31.657778, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:53:31.663165, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:53:31.663221, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000045 (69) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 6B A0 FF 58 82 A1 70 BA 91 A0 82 D3 F2 B7 AC 4A k..X..p. .......J [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 39 53 E9 BD B2 E8 44 6D 0C 33 06 14 E8 6B 21 5D 9S....Dm .3...k!] [0030] 00 17 FC 9C 6E 6A 3B C1 00 00 00 00 00 00 00 00 ....nj;. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:53:31.663497, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:53:31.663521, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:53:31.663541, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:53:31.663573, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:53:31.663595, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:53:31.663625, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:53:31.663660, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:53:31.663746, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:53:31.663783, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:31.663857, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:53:31.663878, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:53:31.674803, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:53:31.674831, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:53:31.674868, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:31.674911, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:53:31.675002, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000046 (70) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:53:31.675182, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:53:31.675255, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:53:31.675304, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:53:31.676061, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:53:31.676105, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000046 (70) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 3F B9 94 96 7B 7E 02 5A BE DF 0C D9 33 42 9D 0B ?...{~.Z ....3B.. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] DF 1A BD EF 80 28 21 39 03 E2 EE D7 96 08 B5 3B .....(!9 .......; [0030] 9B FB 41 3D 20 84 7E 47 B5 5E 4C 6E 14 B7 01 08 ..A= .~G .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:53:31.676359, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:53:31.676381, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:53:31.676399, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:53:31.676430, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:53:31.676451, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:53:31.676482, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:53:31.676509, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:53:31.676576, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:53:31.676603, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:31.676659, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:53:31.676679, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:53:46.649484, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:53:46.649556, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:53:46.649653, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:53:46.649761, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:53:46.649864, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000047 (71) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:53:46.650084, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:53:46.650221, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:53:46.650279, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:53:46.651802, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:53:46.651863, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000047 (71) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 60 13 58 80 86 4C B3 62 16 01 81 2E 42 8F 90 47 `.X..L.b ....B..G [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 8A FA 4E 85 30 A8 BA 95 30 A2 E9 7B 54 F4 75 6C ..N.0... 0..{T.ul [0030] F8 BF E7 DF F4 D5 5C D5 00 00 00 00 00 00 00 00 ......\. ........ [0040] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:53:46.652184, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:53:46.652208, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:53:46.652227, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:53:46.652259, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:53:46.652280, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:53:46.652307, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:53:46.652336, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:53:46.652422, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:53:46.652461, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:53:46.652518, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:53:46.652538, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:54:01.657778, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:54:01.657843, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:54:01.658111, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:54:01.658224, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:54:01.658326, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000048 (72) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:54:01.658505, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:54:01.658610, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:54:01.658676, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:54:01.659920, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:54:01.660007, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000048 (72) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 39 0B 2C A6 78 B2 59 50 B4 88 E7 E5 C3 E7 36 A6 9.,.x.YP ......6. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] 8C 94 C5 A7 D1 58 AF 5F 31 96 D8 E7 4E 7F 27 A2 .....X._ 1...N.'. [0030] 4D 30 F4 67 44 A8 0D 18 B5 5E 4C 6E 14 B7 01 08 M0.gD... .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:54:01.660278, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:54:01.660299, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:54:01.660317, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:54:01.660348, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:54:01.660369, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:54:01.660398, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:54:01.660426, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:54:01.660504, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:54:01.660526, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:54:01.660581, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:54:01.660600, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent [2025/04/09 07:54:01.673341, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1652(child_handler) child daemon request 55 [2025/04/09 07:54:01.673373, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:540(winbindd_dual_ndrcmd) winbindd_dual_ndrcmd: Running command wbint_PingDc (domain 'ADPROTOCOLX') [2025/04/09 07:54:01.673416, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc in: struct wbint_PingDc [2025/04/09 07:54:01.673470, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl in: struct netr_LogonControl logon_server : * logon_server : '\\windc2.adprotocolx.com' function_code : NETLOGON_CONTROL_QUERY (1) level : 0x00000002 (2) [2025/04/09 07:54:01.673542, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:79(dcerpc_push_ncacn_packet) &r: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_REQUEST (0) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0018 (24) auth_length : 0x0038 (56) call_id : 0x00000049 (73) u : union dcerpc_payload(case 0) request: struct dcerpc_request alloc_hint : 0x0000004c (76) context_id : 0x0000 (0) opnum : 0x000c (12) object : union dcerpc_object(case 0) empty: struct dcerpc_empty stub_and_verifier : DATA_BLOB length=0 [2025/04/09 07:54:01.673736, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:124(dcerpc_push_dcerpc_auth) &r: struct dcerpc_auth auth_type : DCERPC_AUTH_TYPE_SCHANNEL (68) auth_level : DCERPC_AUTH_LEVEL_PRIVACY (6) auth_pad_length : 0x04 (4) auth_reserved : 0x00 (0) auth_context_id : 0x00000001 (1) credentials : DATA_BLOB length=0 [2025/04/09 07:54:01.673823, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:800(rpc_api_pipe_send) rpc_api_pipe: host windc2.adprotocolx.com [2025/04/09 07:54:01.673865, 5, pid=2398472, effective(0, 0), real(0, 0)] ../../libcli/smb/smb2_signing.c:582(smb2_signing_sign_pdu) signed SMB2 message (sign_algo_id=1) [2025/04/09 07:54:01.675478, 5, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:106(rpc_read_send) rpc_read_send: data_to_read: 88 [2025/04/09 07:54:01.675529, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/rpc_client/cli_pipe.c:917(rpc_api_pipe_got_pdu) state->pkt: struct ncacn_packet rpc_vers : 0x05 (5) rpc_vers_minor : 0x00 (0) ptype : DCERPC_PKT_RESPONSE (2) pfc_flags : 0x03 (3) 1: DCERPC_PFC_FLAG_FIRST 1: DCERPC_PFC_FLAG_LAST 0: DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING 0: DCERPC_PFC_FLAG_CONC_MPX 0: DCERPC_PFC_FLAG_DID_NOT_EXECUTE 0: DCERPC_PFC_FLAG_MAYBE 0: DCERPC_PFC_FLAG_OBJECT_UUID drep: ARRAY(4) [0] : 0x10 (16) [1] : 0x00 (0) [2] : 0x00 (0) [3] : 0x00 (0) frag_length : 0x0068 (104) auth_length : 0x0038 (56) call_id : 0x00000049 (73) u : union dcerpc_payload(case 2) response: struct dcerpc_response alloc_hint : 0x0000000c (12) context_id : 0x0000 (0) cancel_count : 0x00 (0) reserved : 0x00 (0) stub_and_verifier : DATA_BLOB length=80 [0000] 49 0E 1F 20 B0 A8 4B BD 9A C7 36 A2 C6 7E 67 0B I.. ..K. ..6..~g. [0010] 44 06 04 00 01 00 00 00 13 00 1A 00 FF FF 00 00 D....... ........ [0020] CB BF 3E A3 2E 3B B4 6F D7 5F 2D D4 24 90 23 F6 ..>..;.o ._-.$.#. [0030] 4D 46 D6 04 5D 6F F2 05 B5 5E 4C 6E 14 B7 01 08 MF..]o.. .^Ln.... [0040] 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [2025/04/09 07:54:01.675787, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:428(dcerpc_check_auth) Requested Privacy. [2025/04/09 07:54:01.675809, 10, pid=2398472, effective(0, 0), real(0, 0)] ../../librpc/rpc/dcerpc_util.c:387(dcerpc_pull_auth_trailer) dcerpc_pull_auth_trailer: auth_pad_length 4 [2025/04/09 07:54:01.675828, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../source3/librpc/rpc/dcerpc_helpers.c:492(dcerpc_check_auth) GENSEC auth [2025/04/09 07:54:01.675861, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:511(cli_pipe_validate_current_pdu) Got pdu len 104, data_len 12 [2025/04/09 07:54:01.675890, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:931(rpc_api_pipe_got_pdu) rpc_api_pipe_got_pdu: got frag len of 104 at offset 0: NT_STATUS_OK [2025/04/09 07:54:01.675909, 10, pid=2398472, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:1030(rpc_api_pipe_got_pdu) rpc_api_pipe: host windc2.adprotocolx.com returned 12 bytes. [2025/04/09 07:54:01.675936, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) netr_LogonControl: struct netr_LogonControl out: struct netr_LogonControl query : * query : union netr_CONTROL_QUERY_INFORMATION(case 2) info2 : NULL result : WERR_NOT_SUPPORTED [2025/04/09 07:54:01.676040, 5, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_srv.c:1015(_wbint_PingDc) winbindd_dual_ping_dc succeeded [2025/04/09 07:54:01.676064, 1, pid=2398472, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:493(ndr_print_function_debug) wbint_PingDc: struct wbint_PingDc out: struct wbint_PingDc dcname : * dcname : * dcname : 'windc2.adprotocolx.com' result : NT_STATUS_OK [2025/04/09 07:54:01.676131, 4, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:1660(child_handler) Finished processing child request 55 [2025/04/09 07:54:01.676154, 10, pid=2398472, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual.c:160(child_write_response) Writing 4052 bytes to parent