source3/rpcclient/cmd_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4
   5    Copyright (C) Tim Potter              2000
   6    Copyright (C) Rafal Szczesniak        2002
   7    Copyright (C) Guenther Deschner       2008
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpcclient.h"
  25 #include "../libcli/auth/libcli_auth.h"
  26 #include "../librpc/gen_ndr/cli_lsa.h"
  27
  28 /* useful function to allow entering a name instead of a SID and
  29  * looking it up automatically */
  30 static NTSTATUS name_to_sid(struct rpc_pipe_client *cli,
  31                             TALLOC_CTX *mem_ctx,
  32                             DOM_SID *sid, const char *name)
  33 {
  34         struct policy_handle pol;
  35         enum lsa_SidType *sid_types;
  36         NTSTATUS result;
  37         DOM_SID *sids;
  38
  39         /* maybe its a raw SID */
  40         if (strncmp(name, "S-", 2) == 0 &&
  41             string_to_sid(sid, name)) {
  42                 return NT_STATUS_OK;
  43         }
  44
  45         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
  46                                      SEC_FLAG_MAXIMUM_ALLOWED,
  47                                      &pol);
  48         if (!NT_STATUS_IS_OK(result))
  49                 goto done;
  50
  51         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, NULL, 1, &sids, &sid_types);
  52         if (!NT_STATUS_IS_OK(result))
  53                 goto done;
  54
  55         rpccli_lsa_Close(cli, mem_ctx, &pol);
  56
  57         *sid = sids[0];
  58
  59 done:
  60         return result;
  61 }
  62
  63 static void display_query_info_1(struct lsa_AuditLogInfo *r)
  64 {
  65         d_printf("percent_full:\t%d\n", r->percent_full);
  66         d_printf("maximum_log_size:\t%d\n", r->maximum_log_size);
  67         d_printf("retention_time:\t%lld\n", (long long)r->retention_time);
  68         d_printf("shutdown_in_progress:\t%d\n", r->shutdown_in_progress);
  69         d_printf("time_to_shutdown:\t%lld\n", (long long)r->time_to_shutdown);
  70         d_printf("next_audit_record:\t%d\n", r->next_audit_record);
  71 }
  72
  73 static void display_query_info_2(struct lsa_AuditEventsInfo *r)
  74 {
  75         int i;
  76         d_printf("Auditing enabled:\t%d\n", r->auditing_mode);
  77         d_printf("Auditing categories:\t%d\n", r->count);
  78         d_printf("Auditsettings:\n");
  79         for (i=0; i<r->count; i++) {
  80                 const char *val = audit_policy_str(talloc_tos(), r->settings[i]);
  81                 const char *policy = audit_description_str(i);
  82                 d_printf("%s:\t%s\n", policy, val);
  83         }
  84 }
  85
  86 static void display_query_info_3(struct lsa_DomainInfo *r)
  87 {
  88         d_printf("Domain Name: %s\n", r->name.string);
  89         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
  90 }
  91
  92 static void display_query_info_5(struct lsa_DomainInfo *r)
  93 {
  94         d_printf("Domain Name: %s\n", r->name.string);
  95         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
  96 }
  97
  98 static void display_query_info_10(struct lsa_AuditFullSetInfo *r)
  99 {
 100         d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
 101 }
 102
 103 static void display_query_info_11(struct lsa_AuditFullQueryInfo *r)
 104 {
 105         d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
 106         d_printf("Log is full: %d\n", r->log_is_full);
 107 }
 108
 109 static void display_query_info_12(struct lsa_DnsDomainInfo *r)
 110 {
 111         d_printf("Domain NetBios Name: %s\n", r->name.string);
 112         d_printf("Domain DNS Name: %s\n", r->dns_domain.string);
 113         d_printf("Domain Forest Name: %s\n", r->dns_forest.string);
 114         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
 115         d_printf("Domain GUID: %s\n", GUID_string(talloc_tos(),
 116                                                       &r->domain_guid));
 117 }
 118
 119 static void display_lsa_query_info(union lsa_PolicyInformation *info,
 120                                    enum lsa_PolicyInfo level)
 121 {
 122         switch (level) {
 123                 case 1:
 124                         display_query_info_1(&info->audit_log);
 125                         break;
 126                 case 2:
 127                         display_query_info_2(&info->audit_events);
 128                         break;
 129                 case 3:
 130                         display_query_info_3(&info->domain);
 131                         break;
 132                 case 5:
 133                         display_query_info_5(&info->account_domain);
 134                         break;
 135                 case 10:
 136                         display_query_info_10(&info->auditfullset);
 137                         break;
 138                 case 11:
 139                         display_query_info_11(&info->auditfullquery);
 140                         break;
 141                 case 12:
 142                         display_query_info_12(&info->dns);
 143                         break;
 144                 default:
 145                         printf("can't display info level: %d\n", level);
 146                         break;
 147         }
 148 }
 149
 150 static NTSTATUS cmd_lsa_query_info_policy(struct rpc_pipe_client *cli,
 151                                           TALLOC_CTX *mem_ctx, int argc,
 152                                           const char **argv)
 153 {
 154         struct policy_handle pol;
 155         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 156         union lsa_PolicyInformation *info = NULL;
 157
 158         uint32 info_class = 3;
 159
 160         if (argc > 2) {
 161                 printf("Usage: %s [info_class]\n", argv[0]);
 162                 return NT_STATUS_OK;
 163         }
 164
 165         if (argc == 2)
 166                 info_class = atoi(argv[1]);
 167
 168         switch (info_class) {
 169         case 12:
 170                 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 171                                                  SEC_FLAG_MAXIMUM_ALLOWED,
 172                                                  &pol);
 173
 174                 if (!NT_STATUS_IS_OK(result))
 175                         goto done;
 176
 177                 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
 178                                                      &pol,
 179                                                      info_class,
 180                                                      &info);
 181                 break;
 182         default:
 183                 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 184                                                 SEC_FLAG_MAXIMUM_ALLOWED,
 185                                                 &pol);
 186
 187                 if (!NT_STATUS_IS_OK(result))
 188                         goto done;
 189
 190                 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
 191                                                     &pol,
 192                                                     info_class,
 193                                                     &info);
 194         }
 195
 196         if (NT_STATUS_IS_OK(result)) {
 197                 display_lsa_query_info(info, info_class);
 198         }
 199
 200         rpccli_lsa_Close(cli, mem_ctx, &pol);
 201
 202  done:
 203         return result;
 204 }
 205
 206 /* Resolve a list of names to a list of sids */
 207
 208 static NTSTATUS cmd_lsa_lookup_names(struct rpc_pipe_client *cli,
 209                                      TALLOC_CTX *mem_ctx, int argc,
 210                                      const char **argv)
 211 {
 212         struct policy_handle pol;
 213         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 214         DOM_SID *sids;
 215         enum lsa_SidType *types;
 216         int i;
 217
 218         if (argc == 1) {
 219                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 220                 return NT_STATUS_OK;
 221         }
 222
 223         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 224                                      SEC_FLAG_MAXIMUM_ALLOWED,
 225                                      &pol);
 226
 227         if (!NT_STATUS_IS_OK(result))
 228                 goto done;
 229
 230         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
 231                                       (const char**)(argv + 1), NULL, 1, &sids, &types);
 232
 233         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 234             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 235                 goto done;
 236
 237         result = NT_STATUS_OK;
 238
 239         /* Print results */
 240
 241         for (i = 0; i < (argc - 1); i++) {
 242                 fstring sid_str;
 243                 sid_to_fstring(sid_str, &sids[i]);
 244                 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
 245                        sid_type_lookup(types[i]), types[i]);
 246         }
 247
 248         rpccli_lsa_Close(cli, mem_ctx, &pol);
 249
 250  done:
 251         return result;
 252 }
 253
 254 /* Resolve a list of names to a list of sids */
 255
 256 static NTSTATUS cmd_lsa_lookup_names_level(struct rpc_pipe_client *cli,
 257                                            TALLOC_CTX *mem_ctx, int argc,
 258                                            const char **argv)
 259 {
 260         struct policy_handle pol;
 261         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 262         DOM_SID *sids;
 263         enum lsa_SidType *types;
 264         int i, level;
 265
 266         if (argc < 3) {
 267                 printf("Usage: %s [level] [name1 [name2 [...]]]\n", argv[0]);
 268                 return NT_STATUS_OK;
 269         }
 270
 271         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 272                                      SEC_FLAG_MAXIMUM_ALLOWED,
 273                                      &pol);
 274
 275         if (!NT_STATUS_IS_OK(result))
 276                 goto done;
 277
 278         level = atoi(argv[1]);
 279
 280         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 2,
 281                                       (const char**)(argv + 2), NULL, level, &sids, &types);
 282
 283         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 284             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 285                 goto done;
 286
 287         result = NT_STATUS_OK;
 288
 289         /* Print results */
 290
 291         for (i = 0; i < (argc - 2); i++) {
 292                 fstring sid_str;
 293                 sid_to_fstring(sid_str, &sids[i]);
 294                 printf("%s %s (%s: %d)\n", argv[i + 2], sid_str,
 295                        sid_type_lookup(types[i]), types[i]);
 296         }
 297
 298         rpccli_lsa_Close(cli, mem_ctx, &pol);
 299
 300  done:
 301         return result;
 302 }
 303
 304 static NTSTATUS cmd_lsa_lookup_names4(struct rpc_pipe_client *cli,
 305                                       TALLOC_CTX *mem_ctx, int argc,
 306                                       const char **argv)
 307 {
 308         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 309
 310         uint32_t num_names;
 311         struct lsa_String *names;
 312         struct lsa_RefDomainList *domains;
 313         struct lsa_TransSidArray3 sids;
 314         uint32_t count = 0;
 315         int i;
 316
 317         if (argc == 1) {
 318                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 319                 return NT_STATUS_OK;
 320         }
 321
 322         ZERO_STRUCT(sids);
 323
 324         num_names = argc-1;
 325         names = talloc_array(mem_ctx, struct lsa_String, num_names);
 326         NT_STATUS_HAVE_NO_MEMORY(names);
 327
 328         for (i=0; i < num_names; i++) {
 329                 init_lsa_String(&names[i], argv[i+1]);
 330         }
 331
 332         result = rpccli_lsa_LookupNames4(cli, mem_ctx,
 333                                          num_names,
 334                                          names,
 335                                          &domains,
 336                                          &sids,
 337                                          1,
 338                                          &count,
 339                                          0,
 340                                          0);
 341         if (!NT_STATUS_IS_OK(result)) {
 342                 return result;
 343         }
 344
 345         for (i = 0; i < sids.count; i++) {
 346                 fstring sid_str;
 347                 sid_to_fstring(sid_str, sids.sids[i].sid);
 348                 printf("%s %s (%s: %d)\n", argv[i+1], sid_str,
 349                        sid_type_lookup(sids.sids[i].sid_type),
 350                        sids.sids[i].sid_type);
 351         }
 352
 353         return result;
 354 }
 355
 356 /* Resolve a list of SIDs to a list of names */
 357
 358 static NTSTATUS cmd_lsa_lookup_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 359                                     int argc, const char **argv)
 360 {
 361         struct policy_handle pol;
 362         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 363         DOM_SID *sids;
 364         char **domains;
 365         char **names;
 366         enum lsa_SidType *types;
 367         int i;
 368
 369         if (argc == 1) {
 370                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 371                 return NT_STATUS_OK;
 372         }
 373
 374         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 375                                      SEC_FLAG_MAXIMUM_ALLOWED,
 376                                      &pol);
 377
 378         if (!NT_STATUS_IS_OK(result))
 379                 goto done;
 380
 381         /* Convert arguments to sids */
 382
 383         sids = TALLOC_ARRAY(mem_ctx, DOM_SID, argc - 1);
 384
 385         if (!sids) {
 386                 printf("could not allocate memory for %d sids\n", argc - 1);
 387                 goto done;
 388         }
 389
 390         for (i = 0; i < argc - 1; i++)
 391                 if (!string_to_sid(&sids[i], argv[i + 1])) {
 392                         result = NT_STATUS_INVALID_SID;
 393                         goto done;
 394                 }
 395
 396         /* Lookup the SIDs */
 397
 398         result = rpccli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
 399                                      &domains, &names, &types);
 400
 401         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 402             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 403                 goto done;
 404
 405         result = NT_STATUS_OK;
 406
 407         /* Print results */
 408
 409         for (i = 0; i < (argc - 1); i++) {
 410                 fstring sid_str;
 411
 412                 sid_to_fstring(sid_str, &sids[i]);
 413                 printf("%s %s\\%s (%d)\n", sid_str,
 414                        domains[i] ? domains[i] : "*unknown*",
 415                        names[i] ? names[i] : "*unknown*", types[i]);
 416         }
 417
 418         rpccli_lsa_Close(cli, mem_ctx, &pol);
 419
 420  done:
 421         return result;
 422 }
 423
 424 /* Resolve a list of SIDs to a list of names */
 425
 426 static NTSTATUS cmd_lsa_lookup_sids3(struct rpc_pipe_client *cli,
 427                                      TALLOC_CTX *mem_ctx,
 428                                      int argc, const char **argv)
 429 {
 430         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 431         int i;
 432         struct lsa_SidArray sids;
 433         struct lsa_RefDomainList *domains;
 434         struct lsa_TransNameArray2 names;
 435         uint32_t count = 0;
 436
 437         if (argc == 1) {
 438                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 439                 return NT_STATUS_OK;
 440         }
 441
 442         ZERO_STRUCT(names);
 443
 444         /* Convert arguments to sids */
 445
 446         sids.num_sids = argc-1;
 447         sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
 448         if (!sids.sids) {
 449                 printf("could not allocate memory for %d sids\n", sids.num_sids);
 450                 goto done;
 451         }
 452
 453         for (i = 0; i < sids.num_sids; i++) {
 454                 sids.sids[i].sid = talloc(sids.sids, struct dom_sid);
 455                 if (sids.sids[i].sid == NULL) {
 456                         result = NT_STATUS_NO_MEMORY;
 457                         goto done;
 458                 }
 459                 if (!string_to_sid(sids.sids[i].sid, argv[i+1])) {
 460                         result = NT_STATUS_INVALID_SID;
 461                         goto done;
 462                 }
 463         }
 464
 465         /* Lookup the SIDs */
 466         result = rpccli_lsa_LookupSids3(cli, mem_ctx,
 467                                         &sids,
 468                                         &domains,
 469                                         &names,
 470                                         1,
 471                                         &count,
 472                                         0,
 473                                         0);
 474
 475         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 476             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 477                 goto done;
 478
 479         result = NT_STATUS_OK;
 480
 481         /* Print results */
 482
 483         for (i = 0; i < count; i++) {
 484                 fstring sid_str;
 485
 486                 sid_to_fstring(sid_str, sids.sids[i].sid);
 487                 printf("%s %s (%d)\n", sid_str,
 488                        names.names[i].name.string,
 489                        names.names[i].sid_type);
 490         }
 491
 492  done:
 493         return result;
 494 }
 495
 496
 497 /* Enumerate list of trusted domains */
 498
 499 static NTSTATUS cmd_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
 500                                        TALLOC_CTX *mem_ctx, int argc,
 501                                        const char **argv)
 502 {
 503         struct policy_handle pol;
 504         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 505         struct lsa_DomainList domain_list;
 506
 507         /* defaults, but may be changed using params */
 508         uint32 enum_ctx = 0;
 509         int i;
 510         uint32_t max_size = (uint32_t)-1;
 511
 512         if (argc > 2) {
 513                 printf("Usage: %s [enum context (0)]\n", argv[0]);
 514                 return NT_STATUS_OK;
 515         }
 516
 517         if (argc == 2 && argv[1]) {
 518                 enum_ctx = atoi(argv[2]);
 519         }
 520
 521         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 522                                      LSA_POLICY_VIEW_LOCAL_INFORMATION,
 523                                      &pol);
 524
 525         if (!NT_STATUS_IS_OK(result))
 526                 goto done;
 527
 528         result = STATUS_MORE_ENTRIES;
 529
 530         while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
 531
 532                 /* Lookup list of trusted domains */
 533
 534                 result = rpccli_lsa_EnumTrustDom(cli, mem_ctx,
 535                                                  &pol,
 536                                                  &enum_ctx,
 537                                                  &domain_list,
 538                                                  max_size);
 539                 if (!NT_STATUS_IS_OK(result) &&
 540                     !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
 541                     !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
 542                         goto done;
 543
 544                 /* Print results: list of names and sids returned in this
 545                  * response. */
 546                 for (i = 0; i < domain_list.count; i++) {
 547                         fstring sid_str;
 548
 549                         sid_to_fstring(sid_str, domain_list.domains[i].sid);
 550                         printf("%s %s\n",
 551                                 domain_list.domains[i].name.string ?
 552                                 domain_list.domains[i].name.string : "*unknown*",
 553                                 sid_str);
 554                 }
 555         }
 556
 557         rpccli_lsa_Close(cli, mem_ctx, &pol);
 558  done:
 559         return result;
 560 }
 561
 562 /* Enumerates privileges */
 563
 564 static NTSTATUS cmd_lsa_enum_privilege(struct rpc_pipe_client *cli,
 565                                        TALLOC_CTX *mem_ctx, int argc,
 566                                        const char **argv)
 567 {
 568         struct policy_handle pol;
 569         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 570         struct lsa_PrivArray priv_array;
 571
 572         uint32 enum_context=0;
 573         uint32 pref_max_length=0x1000;
 574         int i;
 575
 576         if (argc > 3) {
 577                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 578                 return NT_STATUS_OK;
 579         }
 580
 581         if (argc>=2)
 582                 enum_context=atoi(argv[1]);
 583
 584         if (argc==3)
 585                 pref_max_length=atoi(argv[2]);
 586
 587         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 588                                      SEC_FLAG_MAXIMUM_ALLOWED,
 589                                      &pol);
 590
 591         if (!NT_STATUS_IS_OK(result))
 592                 goto done;
 593
 594         result = rpccli_lsa_EnumPrivs(cli, mem_ctx,
 595                                       &pol,
 596                                       &enum_context,
 597                                       &priv_array,
 598                                       pref_max_length);
 599         if (!NT_STATUS_IS_OK(result))
 600                 goto done;
 601
 602         /* Print results */
 603         printf("found %d privileges\n\n", priv_array.count);
 604
 605         for (i = 0; i < priv_array.count; i++) {
 606                 printf("%s \t\t%d:%d (0x%x:0x%x)\n",
 607                        priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*",
 608                        priv_array.privs[i].luid.high,
 609                        priv_array.privs[i].luid.low,
 610                        priv_array.privs[i].luid.high,
 611                        priv_array.privs[i].luid.low);
 612         }
 613
 614         rpccli_lsa_Close(cli, mem_ctx, &pol);
 615  done:
 616         return result;
 617 }
 618
 619 /* Get privilege name */
 620
 621 static NTSTATUS cmd_lsa_get_dispname(struct rpc_pipe_client *cli,
 622                                      TALLOC_CTX *mem_ctx, int argc,
 623                                      const char **argv)
 624 {
 625         struct policy_handle pol;
 626         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 627
 628         uint16 lang_id=0;
 629         uint16 lang_id_sys=0;
 630         uint16 lang_id_desc;
 631         struct lsa_String lsa_name;
 632         struct lsa_StringLarge *description = NULL;
 633
 634         if (argc != 2) {
 635                 printf("Usage: %s privilege name\n", argv[0]);
 636                 return NT_STATUS_OK;
 637         }
 638
 639         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 640                                      SEC_FLAG_MAXIMUM_ALLOWED,
 641                                      &pol);
 642
 643         if (!NT_STATUS_IS_OK(result))
 644                 goto done;
 645
 646         init_lsa_String(&lsa_name, argv[1]);
 647
 648         result = rpccli_lsa_LookupPrivDisplayName(cli, mem_ctx,
 649                                                   &pol,
 650                                                   &lsa_name,
 651                                                   lang_id,
 652                                                   lang_id_sys,
 653                                                   &description,
 654                                                   &lang_id_desc);
 655
 656         if (!NT_STATUS_IS_OK(result))
 657                 goto done;
 658
 659         /* Print results */
 660         printf("%s -> %s (language: 0x%x)\n", argv[1], description->string, lang_id_desc);
 661
 662         rpccli_lsa_Close(cli, mem_ctx, &pol);
 663  done:
 664         return result;
 665 }
 666
 667 /* Enumerate the LSA SIDS */
 668
 669 static NTSTATUS cmd_lsa_enum_sids(struct rpc_pipe_client *cli,
 670                                   TALLOC_CTX *mem_ctx, int argc,
 671                                   const char **argv)
 672 {
 673         struct policy_handle pol;
 674         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 675
 676         uint32 enum_context=0;
 677         uint32 pref_max_length=0x1000;
 678         struct lsa_SidArray sid_array;
 679         int i;
 680
 681         if (argc > 3) {
 682                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 683                 return NT_STATUS_OK;
 684         }
 685
 686         if (argc>=2)
 687                 enum_context=atoi(argv[1]);
 688
 689         if (argc==3)
 690                 pref_max_length=atoi(argv[2]);
 691
 692         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 693                                      SEC_FLAG_MAXIMUM_ALLOWED,
 694                                      &pol);
 695
 696         if (!NT_STATUS_IS_OK(result))
 697                 goto done;
 698
 699         result = rpccli_lsa_EnumAccounts(cli, mem_ctx,
 700                                          &pol,
 701                                          &enum_context,
 702                                          &sid_array,
 703                                          pref_max_length);
 704
 705         if (!NT_STATUS_IS_OK(result))
 706                 goto done;
 707
 708         /* Print results */
 709         printf("found %d SIDs\n\n", sid_array.num_sids);
 710
 711         for (i = 0; i < sid_array.num_sids; i++) {
 712                 fstring sid_str;
 713
 714                 sid_to_fstring(sid_str, sid_array.sids[i].sid);
 715                 printf("%s\n", sid_str);
 716         }
 717
 718         rpccli_lsa_Close(cli, mem_ctx, &pol);
 719  done:
 720         return result;
 721 }
 722
 723 /* Create a new account */
 724
 725 static NTSTATUS cmd_lsa_create_account(struct rpc_pipe_client *cli,
 726                                            TALLOC_CTX *mem_ctx, int argc,
 727                                            const char **argv)
 728 {
 729         struct policy_handle dom_pol;
 730         struct policy_handle user_pol;
 731         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 732         uint32 des_access = 0x000f000f;
 733
 734         DOM_SID sid;
 735
 736         if (argc != 2 ) {
 737                 printf("Usage: %s SID\n", argv[0]);
 738                 return NT_STATUS_OK;
 739         }
 740
 741         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 742         if (!NT_STATUS_IS_OK(result))
 743                 goto done;
 744
 745         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 746                                      SEC_FLAG_MAXIMUM_ALLOWED,
 747                                      &dom_pol);
 748
 749         if (!NT_STATUS_IS_OK(result))
 750                 goto done;
 751
 752         result = rpccli_lsa_CreateAccount(cli, mem_ctx,
 753                                           &dom_pol,
 754                                           &sid,
 755                                           des_access,
 756                                           &user_pol);
 757
 758         if (!NT_STATUS_IS_OK(result))
 759                 goto done;
 760
 761         printf("Account for SID %s successfully created\n\n", argv[1]);
 762         result = NT_STATUS_OK;
 763
 764         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 765  done:
 766         return result;
 767 }
 768
 769
 770 /* Enumerate the privileges of an SID */
 771
 772 static NTSTATUS cmd_lsa_enum_privsaccounts(struct rpc_pipe_client *cli,
 773                                            TALLOC_CTX *mem_ctx, int argc,
 774                                            const char **argv)
 775 {
 776         struct policy_handle dom_pol;
 777         struct policy_handle user_pol;
 778         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 779         uint32 access_desired = 0x000f000f;
 780         DOM_SID sid;
 781         struct lsa_PrivilegeSet *privs = NULL;
 782         int i;
 783
 784         if (argc != 2 ) {
 785                 printf("Usage: %s SID\n", argv[0]);
 786                 return NT_STATUS_OK;
 787         }
 788
 789         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 790         if (!NT_STATUS_IS_OK(result))
 791                 goto done;
 792
 793         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 794                                      SEC_FLAG_MAXIMUM_ALLOWED,
 795                                      &dom_pol);
 796
 797         if (!NT_STATUS_IS_OK(result))
 798                 goto done;
 799
 800         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
 801                                         &dom_pol,
 802                                         &sid,
 803                                         access_desired,
 804                                         &user_pol);
 805
 806         if (!NT_STATUS_IS_OK(result))
 807                 goto done;
 808
 809         result = rpccli_lsa_EnumPrivsAccount(cli, mem_ctx,
 810                                              &user_pol,
 811                                              &privs);
 812
 813         if (!NT_STATUS_IS_OK(result))
 814                 goto done;
 815
 816         /* Print results */
 817         printf("found %d privileges for SID %s\n\n", privs->count, argv[1]);
 818         printf("high\tlow\tattribute\n");
 819
 820         for (i = 0; i < privs->count; i++) {
 821                 printf("%u\t%u\t%u\n",
 822                         privs->set[i].luid.high,
 823                         privs->set[i].luid.low,
 824                         privs->set[i].attribute);
 825         }
 826
 827         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 828  done:
 829         return result;
 830 }
 831
 832
 833 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
 834
 835 static NTSTATUS cmd_lsa_enum_acct_rights(struct rpc_pipe_client *cli,
 836                                          TALLOC_CTX *mem_ctx, int argc,
 837                                          const char **argv)
 838 {
 839         struct policy_handle dom_pol;
 840         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 841         DOM_SID sid;
 842         struct lsa_RightSet rights;
 843
 844         int i;
 845
 846         if (argc != 2 ) {
 847                 printf("Usage: %s SID\n", argv[0]);
 848                 return NT_STATUS_OK;
 849         }
 850
 851         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 852         if (!NT_STATUS_IS_OK(result))
 853                 goto done;
 854
 855         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 856                                      SEC_FLAG_MAXIMUM_ALLOWED,
 857                                      &dom_pol);
 858
 859         if (!NT_STATUS_IS_OK(result))
 860                 goto done;
 861
 862         result = rpccli_lsa_EnumAccountRights(cli, mem_ctx,
 863                                               &dom_pol,
 864                                               &sid,
 865                                               &rights);
 866
 867         if (!NT_STATUS_IS_OK(result))
 868                 goto done;
 869
 870         printf("found %d privileges for SID %s\n", rights.count,
 871                sid_string_tos(&sid));
 872
 873         for (i = 0; i < rights.count; i++) {
 874                 printf("\t%s\n", rights.names[i].string);
 875         }
 876
 877         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 878  done:
 879         return result;
 880 }
 881
 882
 883 /* add some privileges to a SID via LsaAddAccountRights */
 884
 885 static NTSTATUS cmd_lsa_add_acct_rights(struct rpc_pipe_client *cli,
 886                                         TALLOC_CTX *mem_ctx, int argc,
 887                                         const char **argv)
 888 {
 889         struct policy_handle dom_pol;
 890         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 891         struct lsa_RightSet rights;
 892         DOM_SID sid;
 893         int i;
 894
 895         if (argc < 3 ) {
 896                 printf("Usage: %s SID [rights...]\n", argv[0]);
 897                 return NT_STATUS_OK;
 898         }
 899
 900         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 901         if (!NT_STATUS_IS_OK(result))
 902                 goto done;
 903
 904         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 905                                      SEC_FLAG_MAXIMUM_ALLOWED,
 906                                      &dom_pol);
 907
 908         if (!NT_STATUS_IS_OK(result))
 909                 goto done;
 910
 911         rights.count = argc-2;
 912         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 913                                     rights.count);
 914         if (!rights.names) {
 915                 return NT_STATUS_NO_MEMORY;
 916         }
 917
 918         for (i=0; i<argc-2; i++) {
 919                 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
 920         }
 921
 922         result = rpccli_lsa_AddAccountRights(cli, mem_ctx,
 923                                              &dom_pol,
 924                                              &sid,
 925                                              &rights);
 926
 927         if (!NT_STATUS_IS_OK(result))
 928                 goto done;
 929
 930         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 931  done:
 932         return result;
 933 }
 934
 935
 936 /* remove some privileges to a SID via LsaRemoveAccountRights */
 937
 938 static NTSTATUS cmd_lsa_remove_acct_rights(struct rpc_pipe_client *cli,
 939                                         TALLOC_CTX *mem_ctx, int argc,
 940                                         const char **argv)
 941 {
 942         struct policy_handle dom_pol;
 943         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 944         struct lsa_RightSet rights;
 945         DOM_SID sid;
 946         int i;
 947
 948         if (argc < 3 ) {
 949                 printf("Usage: %s SID [rights...]\n", argv[0]);
 950                 return NT_STATUS_OK;
 951         }
 952
 953         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 954         if (!NT_STATUS_IS_OK(result))
 955                 goto done;
 956
 957         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 958                                      SEC_FLAG_MAXIMUM_ALLOWED,
 959                                      &dom_pol);
 960
 961         if (!NT_STATUS_IS_OK(result))
 962                 goto done;
 963
 964         rights.count = argc-2;
 965         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 966                                     rights.count);
 967         if (!rights.names) {
 968                 return NT_STATUS_NO_MEMORY;
 969         }
 970
 971         for (i=0; i<argc-2; i++) {
 972                 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
 973         }
 974
 975         result = rpccli_lsa_RemoveAccountRights(cli, mem_ctx,
 976                                                 &dom_pol,
 977                                                 &sid,
 978                                                 false,
 979                                                 &rights);
 980
 981         if (!NT_STATUS_IS_OK(result))
 982                 goto done;
 983
 984         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 985
 986  done:
 987         return result;
 988 }
 989
 990
 991 /* Get a privilege value given its name */
 992
 993 static NTSTATUS cmd_lsa_lookup_priv_value(struct rpc_pipe_client *cli,
 994                                         TALLOC_CTX *mem_ctx, int argc,
 995                                         const char **argv)
 996 {
 997         struct policy_handle pol;
 998         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 999         struct lsa_LUID luid;
1000         struct lsa_String name;
1001
1002         if (argc != 2 ) {
1003                 printf("Usage: %s name\n", argv[0]);
1004                 return NT_STATUS_OK;
1005         }
1006
1007         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1008                                      SEC_FLAG_MAXIMUM_ALLOWED,
1009                                      &pol);
1010
1011         if (!NT_STATUS_IS_OK(result))
1012                 goto done;
1013
1014         init_lsa_String(&name, argv[1]);
1015
1016         result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1017                                             &pol,
1018                                             &name,
1019                                             &luid);
1020
1021         if (!NT_STATUS_IS_OK(result))
1022                 goto done;
1023
1024         /* Print results */
1025
1026         printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
1027
1028         rpccli_lsa_Close(cli, mem_ctx, &pol);
1029  done:
1030         return result;
1031 }
1032
1033 /* Query LSA security object */
1034
1035 static NTSTATUS cmd_lsa_query_secobj(struct rpc_pipe_client *cli,
1036                                      TALLOC_CTX *mem_ctx, int argc,
1037                                      const char **argv)
1038 {
1039         struct policy_handle pol;
1040         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1041         struct sec_desc_buf *sdb;
1042         uint32 sec_info = DACL_SECURITY_INFORMATION;
1043
1044         if (argc < 1 || argc > 2) {
1045                 printf("Usage: %s [sec_info]\n", argv[0]);
1046                 return NT_STATUS_OK;
1047         }
1048
1049         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1050                                       SEC_FLAG_MAXIMUM_ALLOWED,
1051                                       &pol);
1052
1053         if (argc == 2)
1054                 sscanf(argv[1], "%x", &sec_info);
1055
1056         if (!NT_STATUS_IS_OK(result))
1057                 goto done;
1058
1059         result = rpccli_lsa_QuerySecurity(cli, mem_ctx,
1060                                           &pol,
1061                                           sec_info,
1062                                           &sdb);
1063         if (!NT_STATUS_IS_OK(result))
1064                 goto done;
1065
1066         /* Print results */
1067
1068         display_sec_desc(sdb->sd);
1069
1070         rpccli_lsa_Close(cli, mem_ctx, &pol);
1071  done:
1072         return result;
1073 }
1074
1075 static void display_trust_dom_info_4(struct lsa_TrustDomainInfoPassword *p,
1076                                      uint8_t session_key[16])
1077 {
1078         char *pwd, *pwd_old;
1079
1080         DATA_BLOB data     = data_blob_const(p->password->data, p->password->length);
1081         DATA_BLOB data_old = data_blob_const(p->old_password->data, p->old_password->length);
1082         DATA_BLOB session_key_blob = data_blob_const(session_key, sizeof(session_key));
1083
1084         pwd     = sess_decrypt_string(talloc_tos(), &data, &session_key_blob);
1085         pwd_old = sess_decrypt_string(talloc_tos(), &data_old, &session_key_blob);
1086
1087         d_printf("Password:\t%s\n", pwd);
1088         d_printf("Old Password:\t%s\n", pwd_old);
1089
1090         talloc_free(pwd);
1091         talloc_free(pwd_old);
1092 }
1093
1094 static void display_trust_dom_info(TALLOC_CTX *mem_ctx,
1095                                    union lsa_TrustedDomainInfo *info,
1096                                    enum lsa_TrustDomInfoEnum info_class,
1097                                    uint8_t nt_hash[16])
1098 {
1099         switch (info_class) {
1100                 case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
1101                         display_trust_dom_info_4(&info->password, nt_hash);
1102                         break;
1103                 default: {
1104                         const char *str = NULL;
1105                         str = NDR_PRINT_UNION_STRING(mem_ctx,
1106                                                      lsa_TrustedDomainInfo,
1107                                                      info_class, info);
1108                         if (str) {
1109                                 d_printf("%s\n", str);
1110                         }
1111                         break;
1112                 }
1113         }
1114 }
1115
1116 static NTSTATUS cmd_lsa_query_trustdominfobysid(struct rpc_pipe_client *cli,
1117                                                 TALLOC_CTX *mem_ctx, int argc,
1118                                                 const char **argv)
1119 {
1120         struct policy_handle pol;
1121         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1122         DOM_SID dom_sid;
1123         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1124         union lsa_TrustedDomainInfo *info = NULL;
1125         enum lsa_TrustDomInfoEnum info_class = 1;
1126         uint8_t nt_hash[16];
1127
1128         if (argc > 3 || argc < 2) {
1129                 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1130                 return NT_STATUS_OK;
1131         }
1132
1133         if (!string_to_sid(&dom_sid, argv[1]))
1134                 return NT_STATUS_NO_MEMORY;
1135
1136         if (argc == 3)
1137                 info_class = atoi(argv[2]);
1138
1139         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1140
1141         if (!NT_STATUS_IS_OK(result))
1142                 goto done;
1143
1144         result = rpccli_lsa_QueryTrustedDomainInfoBySid(cli, mem_ctx,
1145                                                         &pol,
1146                                                         &dom_sid,
1147                                                         info_class,
1148                                                         &info);
1149         if (!NT_STATUS_IS_OK(result))
1150                 goto done;
1151
1152         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1153                 d_fprintf(stderr, "Could not get pwd hash\n");
1154                 goto done;
1155         }
1156
1157         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1158
1159  done:
1160         rpccli_lsa_Close(cli, mem_ctx, &pol);
1161
1162         return result;
1163 }
1164
1165 static NTSTATUS cmd_lsa_query_trustdominfobyname(struct rpc_pipe_client *cli,
1166                                                  TALLOC_CTX *mem_ctx, int argc,
1167                                                  const char **argv)
1168 {
1169         struct policy_handle pol;
1170         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1171         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1172         union lsa_TrustedDomainInfo *info = NULL;
1173         enum lsa_TrustDomInfoEnum info_class = 1;
1174         struct lsa_String trusted_domain;
1175         uint8_t nt_hash[16];
1176
1177         if (argc > 3 || argc < 2) {
1178                 printf("Usage: %s [name] [info_class]\n", argv[0]);
1179                 return NT_STATUS_OK;
1180         }
1181
1182         if (argc == 3)
1183                 info_class = atoi(argv[2]);
1184
1185         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1186
1187         if (!NT_STATUS_IS_OK(result))
1188                 goto done;
1189
1190         init_lsa_String(&trusted_domain, argv[1]);
1191
1192         result = rpccli_lsa_QueryTrustedDomainInfoByName(cli, mem_ctx,
1193                                                          &pol,
1194                                                          &trusted_domain,
1195                                                          info_class,
1196                                                          &info);
1197         if (!NT_STATUS_IS_OK(result))
1198                 goto done;
1199
1200         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1201                 d_fprintf(stderr, "Could not get pwd hash\n");
1202                 goto done;
1203         }
1204
1205         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1206
1207  done:
1208         rpccli_lsa_Close(cli, mem_ctx, &pol);
1209
1210         return result;
1211 }
1212
1213 static NTSTATUS cmd_lsa_query_trustdominfo(struct rpc_pipe_client *cli,
1214                                            TALLOC_CTX *mem_ctx, int argc,
1215                                            const char **argv)
1216 {
1217         struct policy_handle pol, trustdom_pol;
1218         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1219         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1220         union lsa_TrustedDomainInfo *info = NULL;
1221         DOM_SID dom_sid;
1222         enum lsa_TrustDomInfoEnum info_class = 1;
1223         uint8_t nt_hash[16];
1224
1225         if (argc > 3 || argc < 2) {
1226                 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1227                 return NT_STATUS_OK;
1228         }
1229
1230         if (!string_to_sid(&dom_sid, argv[1]))
1231                 return NT_STATUS_NO_MEMORY;
1232
1233
1234         if (argc == 3)
1235                 info_class = atoi(argv[2]);
1236
1237         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1238
1239         if (!NT_STATUS_IS_OK(result))
1240                 goto done;
1241
1242         result = rpccli_lsa_OpenTrustedDomain(cli, mem_ctx,
1243                                               &pol,
1244                                               &dom_sid,
1245                                               access_mask,
1246                                               &trustdom_pol);
1247
1248         if (!NT_STATUS_IS_OK(result))
1249                 goto done;
1250
1251         result = rpccli_lsa_QueryTrustedDomainInfo(cli, mem_ctx,
1252                                                    &trustdom_pol,
1253                                                    info_class,
1254                                                    &info);
1255
1256         if (!NT_STATUS_IS_OK(result))
1257                 goto done;
1258
1259         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1260                 d_fprintf(stderr, "Could not get pwd hash\n");
1261                 goto done;
1262         }
1263
1264         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1265
1266  done:
1267         rpccli_lsa_Close(cli, mem_ctx, &pol);
1268
1269         return result;
1270 }
1271
1272 static NTSTATUS cmd_lsa_get_username(struct rpc_pipe_client *cli,
1273                                      TALLOC_CTX *mem_ctx, int argc,
1274                                      const char **argv)
1275 {
1276         struct policy_handle pol;
1277         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1278         const char *servername = cli->desthost;
1279         struct lsa_String *account_name = NULL;
1280         struct lsa_String *authority_name = NULL;
1281
1282         if (argc > 2) {
1283                 printf("Usage: %s servername\n", argv[0]);
1284                 return NT_STATUS_OK;
1285         }
1286
1287         result = rpccli_lsa_open_policy(cli, mem_ctx, true,
1288                                         SEC_FLAG_MAXIMUM_ALLOWED,
1289                                         &pol);
1290
1291         if (!NT_STATUS_IS_OK(result)) {
1292                 goto done;
1293         }
1294
1295         result = rpccli_lsa_GetUserName(cli, mem_ctx,
1296                                         servername,
1297                                         &account_name,
1298                                         &authority_name);
1299         if (!NT_STATUS_IS_OK(result)) {
1300                 goto done;
1301         }
1302
1303         /* Print results */
1304
1305         printf("Account Name: %s, Authority Name: %s\n",
1306                 account_name->string, authority_name ? authority_name->string :
1307                 "");
1308
1309         rpccli_lsa_Close(cli, mem_ctx, &pol);
1310  done:
1311         return result;
1312 }
1313
1314 static NTSTATUS cmd_lsa_add_priv(struct rpc_pipe_client *cli,
1315                                  TALLOC_CTX *mem_ctx, int argc,
1316                                  const char **argv)
1317 {
1318         struct policy_handle dom_pol, user_pol;
1319         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1320         struct lsa_PrivilegeSet privs;
1321         struct lsa_LUIDAttribute *set = NULL;
1322         DOM_SID sid;
1323         int i;
1324
1325         ZERO_STRUCT(privs);
1326
1327         if (argc < 3 ) {
1328                 printf("Usage: %s SID [rights...]\n", argv[0]);
1329                 return NT_STATUS_OK;
1330         }
1331
1332         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1333         if (!NT_STATUS_IS_OK(result)) {
1334                 goto done;
1335         }
1336
1337         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1338                                          SEC_FLAG_MAXIMUM_ALLOWED,
1339                                          &dom_pol);
1340
1341         if (!NT_STATUS_IS_OK(result)) {
1342                 goto done;
1343         }
1344
1345         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
1346                                         &dom_pol,
1347                                         &sid,
1348                                         SEC_FLAG_MAXIMUM_ALLOWED,
1349                                         &user_pol);
1350
1351         if (!NT_STATUS_IS_OK(result)) {
1352                 goto done;
1353         }
1354
1355         for (i=2; i<argc; i++) {
1356
1357                 struct lsa_String priv_name;
1358                 struct lsa_LUID luid;
1359
1360                 init_lsa_String(&priv_name, argv[i]);
1361
1362                 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1363                                                     &dom_pol,
1364                                                     &priv_name,
1365                                                     &luid);
1366                 if (!NT_STATUS_IS_OK(result)) {
1367                         continue;
1368                 }
1369
1370                 privs.count++;
1371                 set = TALLOC_REALLOC_ARRAY(mem_ctx, set,
1372                                            struct lsa_LUIDAttribute,
1373                                            privs.count);
1374                 if (!set) {
1375                         return NT_STATUS_NO_MEMORY;
1376                 }
1377
1378                 set[privs.count-1].luid = luid;
1379                 set[privs.count-1].attribute = 0;
1380         }
1381
1382         privs.set = set;
1383
1384         result = rpccli_lsa_AddPrivilegesToAccount(cli, mem_ctx,
1385                                                    &user_pol,
1386                                                    &privs);
1387
1388         if (!NT_STATUS_IS_OK(result)) {
1389                 goto done;
1390         }
1391
1392         rpccli_lsa_Close(cli, mem_ctx, &user_pol);
1393         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
1394  done:
1395         return result;
1396 }
1397
1398 static NTSTATUS cmd_lsa_del_priv(struct rpc_pipe_client *cli,
1399                                  TALLOC_CTX *mem_ctx, int argc,
1400                                  const char **argv)
1401 {
1402         struct policy_handle dom_pol, user_pol;
1403         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1404         struct lsa_PrivilegeSet privs;
1405         struct lsa_LUIDAttribute *set = NULL;
1406         DOM_SID sid;
1407         int i;
1408
1409         ZERO_STRUCT(privs);
1410
1411         if (argc < 3 ) {
1412                 printf("Usage: %s SID [rights...]\n", argv[0]);
1413                 return NT_STATUS_OK;
1414         }
1415
1416         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1417         if (!NT_STATUS_IS_OK(result)) {
1418                 goto done;
1419         }
1420
1421         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1422                                          SEC_FLAG_MAXIMUM_ALLOWED,
1423                                          &dom_pol);
1424
1425         if (!NT_STATUS_IS_OK(result)) {
1426                 goto done;
1427         }
1428
1429         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
1430                                         &dom_pol,
1431                                         &sid,
1432                                         SEC_FLAG_MAXIMUM_ALLOWED,
1433                                         &user_pol);
1434
1435         if (!NT_STATUS_IS_OK(result)) {
1436                 goto done;
1437         }
1438
1439         for (i=2; i<argc; i++) {
1440
1441                 struct lsa_String priv_name;
1442                 struct lsa_LUID luid;
1443
1444                 init_lsa_String(&priv_name, argv[i]);
1445
1446                 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1447                                                     &dom_pol,
1448                                                     &priv_name,
1449                                                     &luid);
1450                 if (!NT_STATUS_IS_OK(result)) {
1451                         continue;
1452                 }
1453
1454                 privs.count++;
1455                 set = TALLOC_REALLOC_ARRAY(mem_ctx, set,
1456                                            struct lsa_LUIDAttribute,
1457                                            privs.count);
1458                 if (!set) {
1459                         return NT_STATUS_NO_MEMORY;
1460                 }
1461
1462                 set[privs.count-1].luid = luid;
1463                 set[privs.count-1].attribute = 0;
1464         }
1465
1466         privs.set = set;
1467
1468
1469         result = rpccli_lsa_RemovePrivilegesFromAccount(cli, mem_ctx,
1470                                                         &user_pol,
1471                                                         false,
1472                                                         &privs);
1473
1474         if (!NT_STATUS_IS_OK(result)) {
1475                 goto done;
1476         }
1477
1478         rpccli_lsa_Close(cli, mem_ctx, &user_pol);
1479         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
1480  done:
1481         return result;
1482 }
1483
1484 static NTSTATUS cmd_lsa_create_secret(struct rpc_pipe_client *cli,
1485                                       TALLOC_CTX *mem_ctx, int argc,
1486                                       const char **argv)
1487 {
1488         NTSTATUS status;
1489         struct policy_handle handle, sec_handle;
1490         struct lsa_String name;
1491
1492         if (argc < 2) {
1493                 printf("Usage: %s name\n", argv[0]);
1494                 return NT_STATUS_OK;
1495         }
1496
1497         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1498                                          true,
1499                                          SEC_FLAG_MAXIMUM_ALLOWED,
1500                                          &handle);
1501         if (!NT_STATUS_IS_OK(status)) {
1502                 return status;
1503         }
1504
1505         init_lsa_String(&name, argv[1]);
1506
1507         status = rpccli_lsa_CreateSecret(cli, mem_ctx,
1508                                          &handle,
1509                                          name,
1510                                          SEC_FLAG_MAXIMUM_ALLOWED,
1511                                          &sec_handle);
1512         if (!NT_STATUS_IS_OK(status)) {
1513                 goto done;
1514         }
1515
1516  done:
1517         if (is_valid_policy_hnd(&sec_handle)) {
1518                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1519         }
1520         if (is_valid_policy_hnd(&handle)) {
1521                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1522         }
1523
1524         return status;
1525 }
1526
1527 static NTSTATUS cmd_lsa_delete_secret(struct rpc_pipe_client *cli,
1528                                       TALLOC_CTX *mem_ctx, int argc,
1529                                       const char **argv)
1530 {
1531         NTSTATUS status;
1532         struct policy_handle handle, sec_handle;
1533         struct lsa_String name;
1534
1535         if (argc < 2) {
1536                 printf("Usage: %s name\n", argv[0]);
1537                 return NT_STATUS_OK;
1538         }
1539
1540         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1541                                          true,
1542                                          SEC_FLAG_MAXIMUM_ALLOWED,
1543                                          &handle);
1544         if (!NT_STATUS_IS_OK(status)) {
1545                 return status;
1546         }
1547
1548         init_lsa_String(&name, argv[1]);
1549
1550         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1551                                        &handle,
1552                                        name,
1553                                        SEC_FLAG_MAXIMUM_ALLOWED,
1554                                        &sec_handle);
1555         if (!NT_STATUS_IS_OK(status)) {
1556                 goto done;
1557         }
1558
1559         status = rpccli_lsa_DeleteObject(cli, mem_ctx,
1560                                          &sec_handle);
1561         if (!NT_STATUS_IS_OK(status)) {
1562                 goto done;
1563         }
1564
1565  done:
1566         if (is_valid_policy_hnd(&sec_handle)) {
1567                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1568         }
1569         if (is_valid_policy_hnd(&handle)) {
1570                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1571         }
1572
1573         return status;
1574 }
1575
1576 static NTSTATUS cmd_lsa_query_secret(struct rpc_pipe_client *cli,
1577                                      TALLOC_CTX *mem_ctx, int argc,
1578                                      const char **argv)
1579 {
1580         NTSTATUS status;
1581         struct policy_handle handle, sec_handle;
1582         struct lsa_String name;
1583         struct lsa_DATA_BUF_PTR new_val;
1584         NTTIME new_mtime = 0;
1585         struct lsa_DATA_BUF_PTR old_val;
1586         NTTIME old_mtime = 0;
1587         DATA_BLOB session_key;
1588         DATA_BLOB new_blob = data_blob_null;
1589         DATA_BLOB old_blob = data_blob_null;
1590         char *new_secret, *old_secret;
1591
1592         if (argc < 2) {
1593                 printf("Usage: %s name\n", argv[0]);
1594                 return NT_STATUS_OK;
1595         }
1596
1597         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1598                                          true,
1599                                          SEC_FLAG_MAXIMUM_ALLOWED,
1600                                          &handle);
1601         if (!NT_STATUS_IS_OK(status)) {
1602                 return status;
1603         }
1604
1605         init_lsa_String(&name, argv[1]);
1606
1607         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1608                                        &handle,
1609                                        name,
1610                                        SEC_FLAG_MAXIMUM_ALLOWED,
1611                                        &sec_handle);
1612         if (!NT_STATUS_IS_OK(status)) {
1613                 goto done;
1614         }
1615
1616         ZERO_STRUCT(new_val);
1617         ZERO_STRUCT(old_val);
1618
1619         status = rpccli_lsa_QuerySecret(cli, mem_ctx,
1620                                         &sec_handle,
1621                                         &new_val,
1622                                         &new_mtime,
1623                                         &old_val,
1624                                         &old_mtime);
1625         if (!NT_STATUS_IS_OK(status)) {
1626                 goto done;
1627         }
1628
1629         status = cli_get_session_key(mem_ctx, cli, &session_key);
1630         if (!NT_STATUS_IS_OK(status)) {
1631                 goto done;
1632         }
1633
1634         if (new_val.buf) {
1635                 new_blob = data_blob_const(new_val.buf->data, new_val.buf->length);
1636         }
1637         if (old_val.buf) {
1638                 old_blob = data_blob_const(old_val.buf->data, old_val.buf->length);
1639         }
1640
1641         new_secret = sess_decrypt_string(mem_ctx, &new_blob, &session_key);
1642         old_secret = sess_decrypt_string(mem_ctx, &old_blob, &session_key);
1643         if (new_secret) {
1644                 d_printf("new secret: %s\n", new_secret);
1645         }
1646         if (old_secret) {
1647                 d_printf("old secret: %s\n", old_secret);
1648         }
1649
1650  done:
1651         if (is_valid_policy_hnd(&sec_handle)) {
1652                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1653         }
1654         if (is_valid_policy_hnd(&handle)) {
1655                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1656         }
1657
1658         return status;
1659 }
1660
1661 static NTSTATUS cmd_lsa_set_secret(struct rpc_pipe_client *cli,
1662                                    TALLOC_CTX *mem_ctx, int argc,
1663                                    const char **argv)
1664 {
1665         NTSTATUS status;
1666         struct policy_handle handle, sec_handle;
1667         struct lsa_String name;
1668         struct lsa_DATA_BUF new_val;
1669         struct lsa_DATA_BUF old_val;
1670         DATA_BLOB enc_key;
1671         DATA_BLOB session_key;
1672
1673         if (argc < 3) {
1674                 printf("Usage: %s name secret\n", argv[0]);
1675                 return NT_STATUS_OK;
1676         }
1677
1678         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1679                                          true,
1680                                          SEC_FLAG_MAXIMUM_ALLOWED,
1681                                          &handle);
1682         if (!NT_STATUS_IS_OK(status)) {
1683                 return status;
1684         }
1685
1686         init_lsa_String(&name, argv[1]);
1687
1688         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1689                                        &handle,
1690                                        name,
1691                                        SEC_FLAG_MAXIMUM_ALLOWED,
1692                                        &sec_handle);
1693         if (!NT_STATUS_IS_OK(status)) {
1694                 goto done;
1695         }
1696
1697         ZERO_STRUCT(new_val);
1698         ZERO_STRUCT(old_val);
1699
1700         status = cli_get_session_key(mem_ctx, cli, &session_key);
1701         if (!NT_STATUS_IS_OK(status)) {
1702                 goto done;
1703         }
1704
1705         enc_key = sess_encrypt_string(argv[2], &session_key);
1706
1707         new_val.length = enc_key.length;
1708         new_val.size = enc_key.length;
1709         new_val.data = enc_key.data;
1710
1711         status = rpccli_lsa_SetSecret(cli, mem_ctx,
1712                                       &sec_handle,
1713                                       &new_val,
1714                                       NULL);
1715         if (!NT_STATUS_IS_OK(status)) {
1716                 goto done;
1717         }
1718
1719  done:
1720         if (is_valid_policy_hnd(&sec_handle)) {
1721                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1722         }
1723         if (is_valid_policy_hnd(&handle)) {
1724                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1725         }
1726
1727         return status;
1728 }
1729
1730 static NTSTATUS cmd_lsa_retrieve_private_data(struct rpc_pipe_client *cli,
1731                                               TALLOC_CTX *mem_ctx, int argc,
1732                                               const char **argv)
1733 {
1734         NTSTATUS status;
1735         struct policy_handle handle;
1736         struct lsa_String name;
1737         struct lsa_DATA_BUF *val;
1738         DATA_BLOB session_key;
1739         DATA_BLOB blob = data_blob_null;
1740         char *secret;
1741
1742         if (argc < 2) {
1743                 printf("Usage: %s name\n", argv[0]);
1744                 return NT_STATUS_OK;
1745         }
1746
1747         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1748                                          true,
1749                                          SEC_FLAG_MAXIMUM_ALLOWED,
1750                                          &handle);
1751         if (!NT_STATUS_IS_OK(status)) {
1752                 return status;
1753         }
1754
1755         init_lsa_String(&name, argv[1]);
1756
1757         ZERO_STRUCT(val);
1758
1759         status = rpccli_lsa_RetrievePrivateData(cli, mem_ctx,
1760                                                 &handle,
1761                                                 &name,
1762                                                 &val);
1763         if (!NT_STATUS_IS_OK(status)) {
1764                 goto done;
1765         }
1766
1767         status = cli_get_session_key(mem_ctx, cli, &session_key);
1768         if (!NT_STATUS_IS_OK(status)) {
1769                 goto done;
1770         }
1771
1772         if (val) {
1773                 blob = data_blob_const(val->data, val->length);
1774         }
1775
1776         secret = sess_decrypt_string(mem_ctx, &blob, &session_key);
1777         if (secret) {
1778                 d_printf("secret: %s\n", secret);
1779         }
1780
1781  done:
1782         if (is_valid_policy_hnd(&handle)) {
1783                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1784         }
1785
1786         return status;
1787 }
1788
1789 static NTSTATUS cmd_lsa_store_private_data(struct rpc_pipe_client *cli,
1790                                            TALLOC_CTX *mem_ctx, int argc,
1791                                            const char **argv)
1792 {
1793         NTSTATUS status;
1794         struct policy_handle handle;
1795         struct lsa_String name;
1796         struct lsa_DATA_BUF val;
1797         DATA_BLOB session_key;
1798         DATA_BLOB enc_key;
1799
1800         if (argc < 3) {
1801                 printf("Usage: %s name secret\n", argv[0]);
1802                 return NT_STATUS_OK;
1803         }
1804
1805         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1806                                          true,
1807                                          SEC_FLAG_MAXIMUM_ALLOWED,
1808                                          &handle);
1809         if (!NT_STATUS_IS_OK(status)) {
1810                 return status;
1811         }
1812
1813         init_lsa_String(&name, argv[1]);
1814
1815         ZERO_STRUCT(val);
1816
1817         status = cli_get_session_key(mem_ctx, cli, &session_key);
1818         if (!NT_STATUS_IS_OK(status)) {
1819                 goto done;
1820         }
1821
1822         enc_key = sess_encrypt_string(argv[2], &session_key);
1823
1824         val.length = enc_key.length;
1825         val.size = enc_key.length;
1826         val.data = enc_key.data;
1827
1828         status = rpccli_lsa_StorePrivateData(cli, mem_ctx,
1829                                              &handle,
1830                                              &name,
1831                                              &val);
1832         if (!NT_STATUS_IS_OK(status)) {
1833                 goto done;
1834         }
1835
1836  done:
1837         if (is_valid_policy_hnd(&handle)) {
1838                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1839         }
1840
1841         return status;
1842 }
1843
1844 static NTSTATUS cmd_lsa_create_trusted_domain(struct rpc_pipe_client *cli,
1845                                               TALLOC_CTX *mem_ctx, int argc,
1846                                               const char **argv)
1847 {
1848         NTSTATUS status;
1849         struct policy_handle handle, trustdom_handle;
1850         struct dom_sid sid;
1851         struct lsa_DomainInfo info;
1852
1853         if (argc < 3) {
1854                 printf("Usage: %s name sid\n", argv[0]);
1855                 return NT_STATUS_OK;
1856         }
1857
1858         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1859                                          true,
1860                                          SEC_FLAG_MAXIMUM_ALLOWED,
1861                                          &handle);
1862         if (!NT_STATUS_IS_OK(status)) {
1863                 return status;
1864         }
1865
1866         init_lsa_StringLarge(&info.name, argv[1]);
1867         info.sid = &sid;
1868         string_to_sid(&sid, argv[2]);
1869
1870         status = rpccli_lsa_CreateTrustedDomain(cli, mem_ctx,
1871                                                 &handle,
1872                                                 &info,
1873                                                 SEC_FLAG_MAXIMUM_ALLOWED,
1874                                                 &trustdom_handle);
1875         if (!NT_STATUS_IS_OK(status)) {
1876                 goto done;
1877         }
1878
1879  done:
1880         if (is_valid_policy_hnd(&trustdom_handle)) {
1881                 rpccli_lsa_Close(cli, mem_ctx, &trustdom_handle);
1882         }
1883
1884         if (is_valid_policy_hnd(&handle)) {
1885                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1886         }
1887
1888         return status;
1889 }
1890
1891 static NTSTATUS cmd_lsa_delete_trusted_domain(struct rpc_pipe_client *cli,
1892                                               TALLOC_CTX *mem_ctx, int argc,
1893                                               const char **argv)
1894 {
1895         NTSTATUS status;
1896         struct policy_handle handle, trustdom_handle;
1897         struct lsa_String name;
1898         struct dom_sid *sid = NULL;
1899
1900         if (argc < 2) {
1901                 printf("Usage: %s name\n", argv[0]);
1902                 return NT_STATUS_OK;
1903         }
1904
1905         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1906                                          true,
1907                                          SEC_FLAG_MAXIMUM_ALLOWED,
1908                                          &handle);
1909         if (!NT_STATUS_IS_OK(status)) {
1910                 return status;
1911         }
1912
1913         init_lsa_String(&name, argv[1]);
1914
1915         status = rpccli_lsa_OpenTrustedDomainByName(cli, mem_ctx,
1916                                                     &handle,
1917                                                     name,
1918                                                     SEC_FLAG_MAXIMUM_ALLOWED,
1919                                                     &trustdom_handle);
1920         if (NT_STATUS_IS_OK(status)) {
1921                 goto delete_object;
1922         }
1923
1924         {
1925                 uint32_t resume_handle = 0;
1926                 struct lsa_DomainList domains;
1927                 int i;
1928
1929                 status = rpccli_lsa_EnumTrustDom(cli, mem_ctx,
1930                                                  &handle,
1931                                                  &resume_handle,
1932                                                  &domains,
1933                                                  0xffff);
1934                 if (!NT_STATUS_IS_OK(status)) {
1935                         goto done;
1936                 }
1937
1938                 for (i=0; i < domains.count; i++) {
1939                         if (strequal(domains.domains[i].name.string, argv[1])) {
1940                                 sid = domains.domains[i].sid;
1941                                 break;
1942                         }
1943                 }
1944
1945                 if (!sid) {
1946                         return NT_STATUS_INVALID_SID;
1947                 }
1948         }
1949
1950         status = rpccli_lsa_OpenTrustedDomain(cli, mem_ctx,
1951                                               &handle,
1952                                               sid,
1953                                               SEC_FLAG_MAXIMUM_ALLOWED,
1954                                               &trustdom_handle);
1955         if (!NT_STATUS_IS_OK(status)) {
1956                 goto done;
1957         }
1958
1959  delete_object:
1960         status = rpccli_lsa_DeleteObject(cli, mem_ctx,
1961                                          &trustdom_handle);
1962         if (!NT_STATUS_IS_OK(status)) {
1963                 goto done;
1964         }
1965
1966  done:
1967         if (is_valid_policy_hnd(&trustdom_handle)) {
1968                 rpccli_lsa_Close(cli, mem_ctx, &trustdom_handle);
1969         }
1970
1971         if (is_valid_policy_hnd(&handle)) {
1972                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1973         }
1974
1975         return status;
1976 }
1977
1978
1979 /* List of commands exported by this module */
1980
1981 struct cmd_set lsarpc_commands[] = {
1982
1983         { "LSARPC" },
1984
1985         { "lsaquery",            RPC_RTYPE_NTSTATUS, cmd_lsa_query_info_policy,  NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query info policy",                    "" },
1986         { "lookupsids",          RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids,        NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert SIDs to names",                "" },
1987         { "lookupsids3",         RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids3,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert SIDs to names",                "" },
1988         { "lookupnames",         RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1989         { "lookupnames4",        RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names4,      NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1990         { "lookupnames_level",   RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names_level, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1991         { "enumtrust",           RPC_RTYPE_NTSTATUS, cmd_lsa_enum_trust_dom,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate trusted domains",            "Usage: [preferred max number] [enum context (0)]" },
1992         { "enumprivs",           RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privilege,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate privileges",                 "" },
1993         { "getdispname",         RPC_RTYPE_NTSTATUS, cmd_lsa_get_dispname,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get the privilege name",               "" },
1994         { "lsaenumsid",          RPC_RTYPE_NTSTATUS, cmd_lsa_enum_sids,          NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the LSA SIDS",               "" },
1995         { "lsacreateaccount",    RPC_RTYPE_NTSTATUS, cmd_lsa_create_account,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create a new lsa account",   "" },
1996         { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privsaccounts, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the privileges of an SID",   "" },
1997         { "lsaenumacctrights",   RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_rights,   NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the rights of an SID",   "" },
1998         { "lsaaddpriv",          RPC_RTYPE_NTSTATUS, cmd_lsa_add_priv,           NULL, &ndr_table_lsarpc.syntax_id, NULL, "Assign a privilege to a SID", "" },
1999         { "lsadelpriv",          RPC_RTYPE_NTSTATUS, cmd_lsa_del_priv,           NULL, &ndr_table_lsarpc.syntax_id, NULL, "Revoke a privilege from a SID", "" },
2000         { "lsaaddacctrights",    RPC_RTYPE_NTSTATUS, cmd_lsa_add_acct_rights,    NULL, &ndr_table_lsarpc.syntax_id, NULL, "Add rights to an account",   "" },
2001         { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_remove_acct_rights, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Remove rights from an account",   "" },
2002         { "lsalookupprivvalue",  RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_priv_value,  NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get a privilege value given its name", "" },
2003         { "lsaquerysecobj",      RPC_RTYPE_NTSTATUS, cmd_lsa_query_secobj,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA security object", "" },
2004         { "lsaquerytrustdominfo",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfo, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a SID)", "" },
2005         { "lsaquerytrustdominfobyname",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobyname, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a name), only works for Windows > 2k", "" },
2006         { "lsaquerytrustdominfobysid",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobysid, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a SID)", "" },
2007         { "getusername",          RPC_RTYPE_NTSTATUS, cmd_lsa_get_username, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get username", "" },
2008         { "createsecret",         RPC_RTYPE_NTSTATUS, cmd_lsa_create_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create Secret", "" },
2009         { "deletesecret",         RPC_RTYPE_NTSTATUS, cmd_lsa_delete_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Delete Secret", "" },
2010         { "querysecret",          RPC_RTYPE_NTSTATUS, cmd_lsa_query_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query Secret", "" },
2011         { "setsecret",            RPC_RTYPE_NTSTATUS, cmd_lsa_set_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Set Secret", "" },
2012         { "retrieveprivatedata",  RPC_RTYPE_NTSTATUS, cmd_lsa_retrieve_private_data, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Retrieve Private Data", "" },
2013         { "storeprivatedata",     RPC_RTYPE_NTSTATUS, cmd_lsa_store_private_data, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Store Private Data", "" },
2014         { "createtrustdom",       RPC_RTYPE_NTSTATUS, cmd_lsa_create_trusted_domain, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create Trusted Domain", "" },
2015         { "deletetrustdom",       RPC_RTYPE_NTSTATUS, cmd_lsa_delete_trusted_domain, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Delete Trusted Domain", "" },
2016
2017         { NULL }
2018 };
2019