source3/rpcclient/cmd_samr.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4
   5    Copyright (C) Andrew Tridgell              1992-2000,
   6    Copyright (C) Luke Kenneth Casson Leighton 1996-2000,
   7    Copyright (C) Elrond                            2000,
   8    Copyright (C) Tim Potter                        2000
   9    Copyright (C) Guenther Deschner                 2008
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "rpcclient.h"
  27
  28 extern DOM_SID domain_sid;
  29
  30 /****************************************************************************
  31  display samr_user_info_7 structure
  32  ****************************************************************************/
  33 static void display_samr_user_info_7(struct samr_UserInfo7 *r)
  34 {
  35         printf("\tUser Name   :\t%s\n", r->account_name.string);
  36 }
  37
  38 /****************************************************************************
  39  display samr_user_info_9 structure
  40  ****************************************************************************/
  41 static void display_samr_user_info_9(struct samr_UserInfo9 *r)
  42 {
  43         printf("\tPrimary group RID   :\tox%x\n", r->primary_gid);
  44 }
  45
  46 /****************************************************************************
  47  display samr_user_info_16 structure
  48  ****************************************************************************/
  49 static void display_samr_user_info_16(struct samr_UserInfo16 *r)
  50 {
  51         printf("\tAcct Flags   :\tox%x\n", r->acct_flags);
  52 }
  53
  54 /****************************************************************************
  55  display samr_user_info_20 structure
  56  ****************************************************************************/
  57 static void display_samr_user_info_20(struct samr_UserInfo20 *r)
  58 {
  59         printf("\tRemote Dial :\n");
  60         dump_data(0, (uint8_t *)r->parameters.array, r->parameters.length*2);
  61 }
  62
  63
  64 /****************************************************************************
  65  display samr_user_info_21 structure
  66  ****************************************************************************/
  67 static void display_samr_user_info_21(struct samr_UserInfo21 *r)
  68 {
  69         printf("\tUser Name   :\t%s\n", r->account_name.string);
  70         printf("\tFull Name   :\t%s\n", r->full_name.string);
  71         printf("\tHome Drive  :\t%s\n", r->home_directory.string);
  72         printf("\tDir Drive   :\t%s\n", r->home_drive.string);
  73         printf("\tProfile Path:\t%s\n", r->profile_path.string);
  74         printf("\tLogon Script:\t%s\n", r->logon_script.string);
  75         printf("\tDescription :\t%s\n", r->description.string);
  76         printf("\tWorkstations:\t%s\n", r->workstations.string);
  77         printf("\tComment     :\t%s\n", r->comment.string);
  78         printf("\tRemote Dial :\n");
  79         dump_data(0, (uint8_t *)r->parameters.array, r->parameters.length*2);
  80
  81         printf("\tLogon Time               :\t%s\n",
  82                http_timestring(talloc_tos(), nt_time_to_unix(r->last_logon)));
  83         printf("\tLogoff Time              :\t%s\n",
  84                http_timestring(talloc_tos(), nt_time_to_unix(r->last_logoff)));
  85         printf("\tKickoff Time             :\t%s\n",
  86                http_timestring(talloc_tos(), nt_time_to_unix(r->acct_expiry)));
  87         printf("\tPassword last set Time   :\t%s\n",
  88                http_timestring(talloc_tos(), nt_time_to_unix(r->last_password_change)));
  89         printf("\tPassword can change Time :\t%s\n",
  90                http_timestring(talloc_tos(), nt_time_to_unix(r->allow_password_change)));
  91         printf("\tPassword must change Time:\t%s\n",
  92                http_timestring(talloc_tos(), nt_time_to_unix(r->force_password_change)));
  93
  94         printf("\tunknown_2[0..31]...\n"); /* user passwords? */
  95
  96         printf("\tuser_rid :\t0x%x\n"  , r->rid); /* User ID */
  97         printf("\tgroup_rid:\t0x%x\n"  , r->primary_gid); /* Group ID */
  98         printf("\tacb_info :\t0x%08x\n", r->acct_flags); /* Account Control Info */
  99
 100         printf("\tfields_present:\t0x%08x\n", r->fields_present); /* 0x00ff ffff */
 101         printf("\tlogon_divs:\t%d\n", r->logon_hours.units_per_week); /* 0x0000 00a8 which is 168 which is num hrs in a week */
 102         printf("\tbad_password_count:\t0x%08x\n", r->bad_password_count);
 103         printf("\tlogon_count:\t0x%08x\n", r->logon_count);
 104
 105         printf("\tpadding1[0..7]...\n");
 106
 107         if (r->logon_hours.bits) {
 108                 printf("\tlogon_hrs[0..%d]...\n", r->logon_hours.units_per_week/8);
 109         }
 110 }
 111
 112
 113 static void display_password_properties(uint32_t password_properties)
 114 {
 115         printf("password_properties: 0x%08x\n", password_properties);
 116
 117         if (password_properties & DOMAIN_PASSWORD_COMPLEX)
 118                 printf("\tDOMAIN_PASSWORD_COMPLEX\n");
 119
 120         if (password_properties & DOMAIN_PASSWORD_NO_ANON_CHANGE)
 121                 printf("\tDOMAIN_PASSWORD_NO_ANON_CHANGE\n");
 122
 123         if (password_properties & DOMAIN_PASSWORD_NO_CLEAR_CHANGE)
 124                 printf("\tDOMAIN_PASSWORD_NO_CLEAR_CHANGE\n");
 125
 126         if (password_properties & DOMAIN_PASSWORD_LOCKOUT_ADMINS)
 127                 printf("\tDOMAIN_PASSWORD_LOCKOUT_ADMINS\n");
 128
 129         if (password_properties & DOMAIN_PASSWORD_STORE_CLEARTEXT)
 130                 printf("\tDOMAIN_PASSWORD_STORE_CLEARTEXT\n");
 131
 132         if (password_properties & DOMAIN_REFUSE_PASSWORD_CHANGE)
 133                 printf("\tDOMAIN_REFUSE_PASSWORD_CHANGE\n");
 134 }
 135
 136 static void display_sam_dom_info_1(struct samr_DomInfo1 *info1)
 137 {
 138         printf("Minimum password length:\t\t\t%d\n",
 139                 info1->min_password_length);
 140         printf("Password uniqueness (remember x passwords):\t%d\n",
 141                 info1->password_history_length);
 142         display_password_properties(info1->password_properties);
 143         printf("password expire in:\t\t\t\t%s\n",
 144                 display_time(info1->max_password_age));
 145         printf("Min password age (allow changing in x days):\t%s\n",
 146                 display_time(info1->min_password_age));
 147 }
 148
 149 static void display_sam_dom_info_2(struct samr_DomGeneralInformation *general)
 150 {
 151         printf("Domain:\t\t%s\n", general->domain_name.string);
 152         printf("Server:\t\t%s\n", general->primary.string);
 153         printf("Comment:\t%s\n", general->oem_information.string);
 154
 155         printf("Total Users:\t%d\n", general->num_users);
 156         printf("Total Groups:\t%d\n", general->num_groups);
 157         printf("Total Aliases:\t%d\n", general->num_aliases);
 158
 159         printf("Sequence No:\t%llu\n", (unsigned long long)general->sequence_num);
 160
 161         printf("Force Logoff:\t%d\n",
 162                 (int)nt_time_to_unix_abs(&general->force_logoff_time));
 163
 164         printf("Domain Server State:\t0x%x\n", general->domain_server_state);
 165         printf("Server Role:\t%s\n", server_role_str(general->role));
 166         printf("Unknown 3:\t0x%x\n", general->unknown3);
 167 }
 168
 169 static void display_sam_dom_info_3(struct samr_DomInfo3 *info3)
 170 {
 171         printf("Force Logoff:\t%d\n",
 172                 (int)nt_time_to_unix_abs(&info3->force_logoff_time));
 173 }
 174
 175 static void display_sam_dom_info_4(struct samr_DomOEMInformation *oem)
 176 {
 177         printf("Comment:\t%s\n", oem->oem_information.string);
 178 }
 179
 180 static void display_sam_dom_info_5(struct samr_DomInfo5 *info5)
 181 {
 182         printf("Domain:\t\t%s\n", info5->domain_name.string);
 183 }
 184
 185 static void display_sam_dom_info_6(struct samr_DomInfo6 *info6)
 186 {
 187         printf("Server:\t\t%s\n", info6->primary.string);
 188 }
 189
 190 static void display_sam_dom_info_7(struct samr_DomInfo7 *info7)
 191 {
 192         printf("Server Role:\t%s\n", server_role_str(info7->role));
 193 }
 194
 195 static void display_sam_dom_info_8(struct samr_DomInfo8 *info8)
 196 {
 197         printf("Sequence No:\t%llu\n", (unsigned long long)info8->sequence_num);
 198         printf("Domain Create Time:\t%s\n",
 199                 http_timestring(talloc_tos(), nt_time_to_unix(info8->domain_create_time)));
 200 }
 201
 202 static void display_sam_dom_info_9(struct samr_DomInfo9 *info9)
 203 {
 204         printf("Domain Server State:\t0x%x\n", info9->domain_server_state);
 205 }
 206
 207 static void display_sam_dom_info_12(struct samr_DomInfo12 *info12)
 208 {
 209         printf("Bad password lockout duration:               %s\n",
 210                 display_time(info12->lockout_duration));
 211         printf("Reset Lockout after:                         %s\n",
 212                 display_time(info12->lockout_window));
 213         printf("Lockout after bad attempts:                  %d\n",
 214                 info12->lockout_threshold);
 215 }
 216
 217 static void display_sam_dom_info_13(struct samr_DomInfo13 *info13)
 218 {
 219         printf("Sequence No:\t%llu\n", (unsigned long long)info13->sequence_num);
 220         printf("Domain Create Time:\t%s\n",
 221                 http_timestring(talloc_tos(), nt_time_to_unix(info13->domain_create_time)));
 222         printf("Unknown1:\t%d\n", info13->unknown1);
 223         printf("Unknown2:\t%d\n", info13->unknown2);
 224
 225 }
 226
 227 static void display_sam_info_1(struct samr_DispEntryGeneral *r)
 228 {
 229         printf("index: 0x%x ", r->idx);
 230         printf("RID: 0x%x ", r->rid);
 231         printf("acb: 0x%08x ", r->acct_flags);
 232         printf("Account: %s\t", r->account_name.string);
 233         printf("Name: %s\t", r->full_name.string);
 234         printf("Desc: %s\n", r->description.string);
 235 }
 236
 237 static void display_sam_info_2(struct samr_DispEntryFull *r)
 238 {
 239         printf("index: 0x%x ", r->idx);
 240         printf("RID: 0x%x ", r->rid);
 241         printf("acb: 0x%08x ", r->acct_flags);
 242         printf("Account: %s\t", r->account_name.string);
 243         printf("Desc: %s\n", r->description.string);
 244 }
 245
 246 static void display_sam_info_3(struct samr_DispEntryFullGroup *r)
 247 {
 248         printf("index: 0x%x ", r->idx);
 249         printf("RID: 0x%x ", r->rid);
 250         printf("acb: 0x%08x ", r->acct_flags);
 251         printf("Account: %s\t", r->account_name.string);
 252         printf("Desc: %s\n", r->description.string);
 253 }
 254
 255 static void display_sam_info_4(struct samr_DispEntryAscii *r)
 256 {
 257         printf("index: 0x%x ", r->idx);
 258         printf("Account: %s\n", r->account_name.string);
 259 }
 260
 261 static void display_sam_info_5(struct samr_DispEntryAscii *r)
 262 {
 263         printf("index: 0x%x ", r->idx);
 264         printf("Account: %s\n", r->account_name.string);
 265 }
 266
 267 /****************************************************************************
 268  ****************************************************************************/
 269
 270 static NTSTATUS get_domain_handle(struct rpc_pipe_client *cli,
 271                                   TALLOC_CTX *mem_ctx,
 272                                   const char *sam,
 273                                   struct policy_handle *connect_pol,
 274                                   uint32_t access_mask,
 275                                   struct dom_sid *_domain_sid,
 276                                   struct policy_handle *domain_pol)
 277 {
 278
 279         if (StrCaseCmp(sam, "domain") == 0) {
 280                 return rpccli_samr_OpenDomain(cli, mem_ctx,
 281                                               connect_pol,
 282                                               access_mask,
 283                                               _domain_sid,
 284                                               domain_pol);
 285         } else if (StrCaseCmp(sam, "builtin") == 0) {
 286                 return rpccli_samr_OpenDomain(cli, mem_ctx,
 287                                               connect_pol,
 288                                               access_mask,
 289                                               CONST_DISCARD(struct dom_sid2 *, &global_sid_Builtin),
 290                                               domain_pol);
 291         }
 292
 293         return NT_STATUS_INVALID_PARAMETER;
 294 }
 295
 296 /**********************************************************************
 297  * Query user information
 298  */
 299 static NTSTATUS cmd_samr_query_user(struct rpc_pipe_client *cli,
 300                                     TALLOC_CTX *mem_ctx,
 301                                     int argc, const char **argv)
 302 {
 303         POLICY_HND connect_pol, domain_pol, user_pol;
 304         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 305         uint32 info_level = 21;
 306         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
 307         union samr_UserInfo *info = NULL;
 308         uint32 user_rid = 0;
 309
 310         if ((argc < 2) || (argc > 4)) {
 311                 printf("Usage: %s rid [info level] [access mask] \n", argv[0]);
 312                 return NT_STATUS_OK;
 313         }
 314
 315         sscanf(argv[1], "%i", &user_rid);
 316
 317         if (argc > 2)
 318                 sscanf(argv[2], "%i", &info_level);
 319
 320         if (argc > 3)
 321                 sscanf(argv[3], "%x", &access_mask);
 322
 323
 324         result = rpccli_try_samr_connects(cli, mem_ctx,
 325                                           MAXIMUM_ALLOWED_ACCESS,
 326                                           &connect_pol);
 327
 328         if (!NT_STATUS_IS_OK(result))
 329                 goto done;
 330
 331         result = rpccli_samr_OpenDomain(cli, mem_ctx,
 332                                         &connect_pol,
 333                                         MAXIMUM_ALLOWED_ACCESS,
 334                                         &domain_sid,
 335                                         &domain_pol);
 336         if (!NT_STATUS_IS_OK(result))
 337                 goto done;
 338
 339         result = rpccli_samr_OpenUser(cli, mem_ctx,
 340                                       &domain_pol,
 341                                       access_mask,
 342                                       user_rid,
 343                                       &user_pol);
 344
 345         if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER) &&
 346             (user_rid == 0)) {
 347
 348                 /* Probably this was a user name, try lookupnames */
 349                 struct samr_Ids rids, types;
 350                 struct lsa_String lsa_acct_name;
 351
 352                 init_lsa_String(&lsa_acct_name, argv[1]);
 353
 354                 result = rpccli_samr_LookupNames(cli, mem_ctx,
 355                                                  &domain_pol,
 356                                                  1,
 357                                                  &lsa_acct_name,
 358                                                  &rids,
 359                                                  &types);
 360
 361                 if (NT_STATUS_IS_OK(result)) {
 362                         result = rpccli_samr_OpenUser(cli, mem_ctx,
 363                                                       &domain_pol,
 364                                                       access_mask,
 365                                                       rids.ids[0],
 366                                                       &user_pol);
 367                 }
 368         }
 369
 370
 371         if (!NT_STATUS_IS_OK(result))
 372                 goto done;
 373
 374         result = rpccli_samr_QueryUserInfo(cli, mem_ctx,
 375                                            &user_pol,
 376                                            info_level,
 377                                            &info);
 378
 379         if (!NT_STATUS_IS_OK(result))
 380                 goto done;
 381
 382         switch (info_level) {
 383         case 7:
 384                 display_samr_user_info_7(&info->info7);
 385                 break;
 386         case 9:
 387                 display_samr_user_info_9(&info->info9);
 388                 break;
 389         case 16:
 390                 display_samr_user_info_16(&info->info16);
 391                 break;
 392         case 20:
 393                 display_samr_user_info_20(&info->info20);
 394                 break;
 395         case 21:
 396                 display_samr_user_info_21(&info->info21);
 397                 break;
 398         default:
 399                 printf("Unsupported infolevel: %d\n", info_level);
 400                 break;
 401         }
 402
 403         rpccli_samr_Close(cli, mem_ctx, &user_pol);
 404         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 405         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 406
 407 done:
 408         return result;
 409 }
 410
 411 /****************************************************************************
 412  display group info
 413  ****************************************************************************/
 414 static void display_group_info1(struct samr_GroupInfoAll *info1)
 415 {
 416         printf("\tGroup Name:\t%s\n", info1->name.string);
 417         printf("\tDescription:\t%s\n", info1->description.string);
 418         printf("\tGroup Attribute:%d\n", info1->attributes);
 419         printf("\tNum Members:%d\n", info1->num_members);
 420 }
 421
 422 /****************************************************************************
 423  display group info
 424  ****************************************************************************/
 425 static void display_group_info2(struct lsa_String *info2)
 426 {
 427         printf("\tGroup Description:%s\n", info2->string);
 428 }
 429
 430
 431 /****************************************************************************
 432  display group info
 433  ****************************************************************************/
 434 static void display_group_info3(struct samr_GroupInfoAttributes *info3)
 435 {
 436         printf("\tGroup Attribute:%d\n", info3->attributes);
 437 }
 438
 439
 440 /****************************************************************************
 441  display group info
 442  ****************************************************************************/
 443 static void display_group_info4(struct lsa_String *info4)
 444 {
 445         printf("\tGroup Description:%s\n", info4->string);
 446 }
 447
 448 /****************************************************************************
 449  display group info
 450  ****************************************************************************/
 451 static void display_group_info5(struct samr_GroupInfoAll *info5)
 452 {
 453         printf("\tGroup Name:\t%s\n", info5->name.string);
 454         printf("\tDescription:\t%s\n", info5->description.string);
 455         printf("\tGroup Attribute:%d\n", info5->attributes);
 456         printf("\tNum Members:%d\n", info5->num_members);
 457 }
 458
 459 /****************************************************************************
 460  display sam sync structure
 461  ****************************************************************************/
 462 static void display_group_info(union samr_GroupInfo *info,
 463                                enum samr_GroupInfoEnum level)
 464 {
 465         switch (level) {
 466                 case 1:
 467                         display_group_info1(&info->all);
 468                         break;
 469                 case 2:
 470                         display_group_info2(&info->name);
 471                         break;
 472                 case 3:
 473                         display_group_info3(&info->attributes);
 474                         break;
 475                 case 4:
 476                         display_group_info4(&info->description);
 477                         break;
 478                 case 5:
 479                         display_group_info5(&info->all2);
 480                         break;
 481         }
 482 }
 483
 484 /***********************************************************************
 485  * Query group information
 486  */
 487 static NTSTATUS cmd_samr_query_group(struct rpc_pipe_client *cli,
 488                                      TALLOC_CTX *mem_ctx,
 489                                      int argc, const char **argv)
 490 {
 491         POLICY_HND connect_pol, domain_pol, group_pol;
 492         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 493         enum samr_GroupInfoEnum info_level = GROUPINFOALL;
 494         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
 495         union samr_GroupInfo *group_info = NULL;
 496         uint32 group_rid;
 497
 498         if ((argc < 2) || (argc > 4)) {
 499                 printf("Usage: %s rid [info level] [access mask]\n", argv[0]);
 500                 return NT_STATUS_OK;
 501         }
 502
 503         sscanf(argv[1], "%i", &group_rid);
 504
 505         if (argc > 2)
 506                 info_level = atoi(argv[2]);
 507
 508         if (argc > 3)
 509                 sscanf(argv[3], "%x", &access_mask);
 510
 511         result = rpccli_try_samr_connects(cli, mem_ctx,
 512                                           MAXIMUM_ALLOWED_ACCESS,
 513                                           &connect_pol);
 514
 515         if (!NT_STATUS_IS_OK(result))
 516                 goto done;
 517
 518         result = rpccli_samr_OpenDomain(cli, mem_ctx,
 519                                         &connect_pol,
 520                                         MAXIMUM_ALLOWED_ACCESS,
 521                                         &domain_sid,
 522                                         &domain_pol);
 523
 524         if (!NT_STATUS_IS_OK(result))
 525                 goto done;
 526
 527         result = rpccli_samr_OpenGroup(cli, mem_ctx,
 528                                        &domain_pol,
 529                                        access_mask,
 530                                        group_rid,
 531                                        &group_pol);
 532
 533         if (!NT_STATUS_IS_OK(result))
 534                 goto done;
 535
 536         result = rpccli_samr_QueryGroupInfo(cli, mem_ctx,
 537                                             &group_pol,
 538                                             info_level,
 539                                             &group_info);
 540         if (!NT_STATUS_IS_OK(result)) {
 541                 goto done;
 542         }
 543
 544         display_group_info(group_info, info_level);
 545
 546         rpccli_samr_Close(cli, mem_ctx, &group_pol);
 547         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 548         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 549 done:
 550         return result;
 551 }
 552
 553 /* Query groups a user is a member of */
 554
 555 static NTSTATUS cmd_samr_query_usergroups(struct rpc_pipe_client *cli,
 556                                           TALLOC_CTX *mem_ctx,
 557                                           int argc, const char **argv)
 558 {
 559         POLICY_HND              connect_pol,
 560                                 domain_pol,
 561                                 user_pol;
 562         NTSTATUS                result = NT_STATUS_UNSUCCESSFUL;
 563         uint32                  user_rid;
 564         uint32                  access_mask = MAXIMUM_ALLOWED_ACCESS;
 565         int                     i;
 566         struct samr_RidWithAttributeArray *rid_array = NULL;
 567
 568         if ((argc < 2) || (argc > 3)) {
 569                 printf("Usage: %s rid [access mask]\n", argv[0]);
 570                 return NT_STATUS_OK;
 571         }
 572
 573         sscanf(argv[1], "%i", &user_rid);
 574
 575         if (argc > 2)
 576                 sscanf(argv[2], "%x", &access_mask);
 577
 578         result = rpccli_try_samr_connects(cli, mem_ctx,
 579                                           MAXIMUM_ALLOWED_ACCESS,
 580                                           &connect_pol);
 581
 582         if (!NT_STATUS_IS_OK(result))
 583                 goto done;
 584
 585         result = rpccli_samr_OpenDomain(cli, mem_ctx,
 586                                         &connect_pol,
 587                                         MAXIMUM_ALLOWED_ACCESS,
 588                                         &domain_sid, &domain_pol);
 589
 590         if (!NT_STATUS_IS_OK(result))
 591                 goto done;
 592
 593         result = rpccli_samr_OpenUser(cli, mem_ctx,
 594                                       &domain_pol,
 595                                       access_mask,
 596                                       user_rid,
 597                                       &user_pol);
 598
 599         if (!NT_STATUS_IS_OK(result))
 600                 goto done;
 601
 602         result = rpccli_samr_GetGroupsForUser(cli, mem_ctx,
 603                                               &user_pol,
 604                                               &rid_array);
 605
 606         if (!NT_STATUS_IS_OK(result))
 607                 goto done;
 608
 609         for (i = 0; i < rid_array->count; i++) {
 610                 printf("\tgroup rid:[0x%x] attr:[0x%x]\n",
 611                        rid_array->rids[i].rid,
 612                        rid_array->rids[i].attributes);
 613         }
 614
 615         rpccli_samr_Close(cli, mem_ctx, &user_pol);
 616         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 617         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 618  done:
 619         return result;
 620 }
 621
 622 /* Query aliases a user is a member of */
 623
 624 static NTSTATUS cmd_samr_query_useraliases(struct rpc_pipe_client *cli,
 625                                            TALLOC_CTX *mem_ctx,
 626                                            int argc, const char **argv)
 627 {
 628         POLICY_HND              connect_pol, domain_pol;
 629         NTSTATUS                result = NT_STATUS_UNSUCCESSFUL;
 630         DOM_SID                *sids;
 631         size_t                     num_sids;
 632         uint32                  access_mask = MAXIMUM_ALLOWED_ACCESS;
 633         int                     i;
 634         struct lsa_SidArray sid_array;
 635         struct samr_Ids alias_rids;
 636
 637         if (argc < 3) {
 638                 printf("Usage: %s builtin|domain sid1 sid2 ...\n", argv[0]);
 639                 return NT_STATUS_INVALID_PARAMETER;
 640         }
 641
 642         sids = NULL;
 643         num_sids = 0;
 644
 645         for (i=2; i<argc; i++) {
 646                 DOM_SID tmp_sid;
 647                 if (!string_to_sid(&tmp_sid, argv[i])) {
 648                         printf("%s is not a legal SID\n", argv[i]);
 649                         return NT_STATUS_INVALID_PARAMETER;
 650                 }
 651                 result = add_sid_to_array(mem_ctx, &tmp_sid, &sids, &num_sids);
 652                 if (!NT_STATUS_IS_OK(result)) {
 653                         return result;
 654                 }
 655         }
 656
 657         if (num_sids) {
 658                 sid_array.sids = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_SidPtr, num_sids);
 659                 if (sid_array.sids == NULL)
 660                         return NT_STATUS_NO_MEMORY;
 661         } else {
 662                 sid_array.sids = NULL;
 663         }
 664
 665         for (i=0; i<num_sids; i++) {
 666                 sid_array.sids[i].sid = sid_dup_talloc(mem_ctx, &sids[i]);
 667                 if (!sid_array.sids[i].sid) {
 668                         return NT_STATUS_NO_MEMORY;
 669                 }
 670         }
 671
 672         sid_array.num_sids = num_sids;
 673
 674         result = rpccli_try_samr_connects(cli, mem_ctx,
 675                                           MAXIMUM_ALLOWED_ACCESS,
 676                                           &connect_pol);
 677
 678         if (!NT_STATUS_IS_OK(result))
 679                 goto done;
 680
 681         result = get_domain_handle(cli, mem_ctx, argv[1],
 682                                    &connect_pol,
 683                                    access_mask,
 684                                    &domain_sid,
 685                                    &domain_pol);
 686
 687         if (!NT_STATUS_IS_OK(result))
 688                 goto done;
 689
 690         result = rpccli_samr_GetAliasMembership(cli, mem_ctx,
 691                                                 &domain_pol,
 692                                                 &sid_array,
 693                                                 &alias_rids);
 694         if (!NT_STATUS_IS_OK(result))
 695                 goto done;
 696
 697         for (i = 0; i < alias_rids.count; i++) {
 698                 printf("\tgroup rid:[0x%x]\n", alias_rids.ids[i]);
 699         }
 700
 701         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 702         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 703  done:
 704         return result;
 705 }
 706
 707 /* Query members of a group */
 708
 709 static NTSTATUS cmd_samr_query_groupmem(struct rpc_pipe_client *cli,
 710                                         TALLOC_CTX *mem_ctx,
 711                                         int argc, const char **argv)
 712 {
 713         POLICY_HND connect_pol, domain_pol, group_pol;
 714         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 715         uint32 group_rid;
 716         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
 717         int i;
 718         unsigned int old_timeout;
 719         struct samr_RidTypeArray *rids = NULL;
 720
 721         if ((argc < 2) || (argc > 3)) {
 722                 printf("Usage: %s rid [access mask]\n", argv[0]);
 723                 return NT_STATUS_OK;
 724         }
 725
 726         sscanf(argv[1], "%i", &group_rid);
 727
 728         if (argc > 2)
 729                 sscanf(argv[2], "%x", &access_mask);
 730
 731         result = rpccli_try_samr_connects(cli, mem_ctx,
 732                                           MAXIMUM_ALLOWED_ACCESS,
 733                                           &connect_pol);
 734
 735         if (!NT_STATUS_IS_OK(result))
 736                 goto done;
 737
 738         result = rpccli_samr_OpenDomain(cli, mem_ctx,
 739                                         &connect_pol,
 740                                         MAXIMUM_ALLOWED_ACCESS,
 741                                         &domain_sid,
 742                                         &domain_pol);
 743
 744         if (!NT_STATUS_IS_OK(result))
 745                 goto done;
 746
 747         result = rpccli_samr_OpenGroup(cli, mem_ctx,
 748                                        &domain_pol,
 749                                        access_mask,
 750                                        group_rid,
 751                                        &group_pol);
 752
 753         if (!NT_STATUS_IS_OK(result))
 754                 goto done;
 755
 756         /* Make sure to wait for our DC's reply */
 757         old_timeout = rpccli_set_timeout(cli, 30000); /* 30 seconds. */
 758         rpccli_set_timeout(cli, MAX(30000, old_timeout)); /* At least 30 sec */
 759
 760         result = rpccli_samr_QueryGroupMember(cli, mem_ctx,
 761                                               &group_pol,
 762                                               &rids);
 763
 764         rpccli_set_timeout(cli, old_timeout);
 765
 766         if (!NT_STATUS_IS_OK(result))
 767                 goto done;
 768
 769         for (i = 0; i < rids->count; i++) {
 770                 printf("\trid:[0x%x] attr:[0x%x]\n", rids->rids[i],
 771                        rids->types[i]);
 772         }
 773
 774         rpccli_samr_Close(cli, mem_ctx, &group_pol);
 775         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 776         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 777  done:
 778         return result;
 779 }
 780
 781 /* Enumerate domain users */
 782
 783 static NTSTATUS cmd_samr_enum_dom_users(struct rpc_pipe_client *cli,
 784                                         TALLOC_CTX *mem_ctx,
 785                                         int argc, const char **argv)
 786 {
 787         POLICY_HND connect_pol, domain_pol;
 788         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 789         uint32 start_idx, size, num_dom_users, i;
 790         struct samr_SamArray *dom_users = NULL;
 791         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
 792         uint32 acb_mask = ACB_NORMAL;
 793         bool got_connect_pol = False, got_domain_pol = False;
 794
 795         if ((argc < 1) || (argc > 3)) {
 796                 printf("Usage: %s [access_mask] [acb_mask]\n", argv[0]);
 797                 return NT_STATUS_OK;
 798         }
 799
 800         if (argc > 1)
 801                 sscanf(argv[1], "%x", &access_mask);
 802
 803         if (argc > 2)
 804                 sscanf(argv[2], "%x", &acb_mask);
 805
 806         /* Get sam policy handle */
 807
 808         result = rpccli_try_samr_connects(cli, mem_ctx,
 809                                           MAXIMUM_ALLOWED_ACCESS,
 810                                           &connect_pol);
 811
 812         if (!NT_STATUS_IS_OK(result))
 813                 goto done;
 814
 815         got_connect_pol = True;
 816
 817         /* Get domain policy handle */
 818
 819         result = rpccli_samr_OpenDomain(cli, mem_ctx,
 820                                         &connect_pol,
 821                                         access_mask,
 822                                         &domain_sid,
 823                                         &domain_pol);
 824
 825         if (!NT_STATUS_IS_OK(result))
 826                 goto done;
 827
 828         got_domain_pol = True;
 829
 830         /* Enumerate domain users */
 831
 832         start_idx = 0;
 833         size = 0xffff;
 834
 835         do {
 836                 result = rpccli_samr_EnumDomainUsers(cli, mem_ctx,
 837                                                      &domain_pol,
 838                                                      &start_idx,
 839                                                      acb_mask,
 840                                                      &dom_users,
 841                                                      size,
 842                                                      &num_dom_users);
 843
 844                 if (NT_STATUS_IS_OK(result) ||
 845                     NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES)) {
 846
 847                         for (i = 0; i < num_dom_users; i++)
 848                                printf("user:[%s] rid:[0x%x]\n",
 849                                        dom_users->entries[i].name.string,
 850                                        dom_users->entries[i].idx);
 851                 }
 852
 853         } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES));
 854
 855  done:
 856         if (got_domain_pol)
 857                 rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 858
 859         if (got_connect_pol)
 860                 rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 861
 862         return result;
 863 }
 864
 865 /* Enumerate domain groups */
 866
 867 static NTSTATUS cmd_samr_enum_dom_groups(struct rpc_pipe_client *cli,
 868                                          TALLOC_CTX *mem_ctx,
 869                                          int argc, const char **argv)
 870 {
 871         POLICY_HND connect_pol, domain_pol;
 872         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 873         uint32 start_idx, size, num_dom_groups, i;
 874         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
 875         struct samr_SamArray *dom_groups = NULL;
 876         bool got_connect_pol = False, got_domain_pol = False;
 877
 878         if ((argc < 1) || (argc > 2)) {
 879                 printf("Usage: %s [access_mask]\n", argv[0]);
 880                 return NT_STATUS_OK;
 881         }
 882
 883         if (argc > 1)
 884                 sscanf(argv[1], "%x", &access_mask);
 885
 886         /* Get sam policy handle */
 887
 888         result = rpccli_try_samr_connects(cli, mem_ctx,
 889                                           MAXIMUM_ALLOWED_ACCESS,
 890                                           &connect_pol);
 891
 892         if (!NT_STATUS_IS_OK(result))
 893                 goto done;
 894
 895         got_connect_pol = True;
 896
 897         /* Get domain policy handle */
 898
 899         result = rpccli_samr_OpenDomain(cli, mem_ctx,
 900                                         &connect_pol,
 901                                         access_mask,
 902                                         &domain_sid,
 903                                         &domain_pol);
 904
 905         if (!NT_STATUS_IS_OK(result))
 906                 goto done;
 907
 908         got_domain_pol = True;
 909
 910         /* Enumerate domain groups */
 911
 912         start_idx = 0;
 913         size = 0xffff;
 914
 915         do {
 916                 result = rpccli_samr_EnumDomainGroups(cli, mem_ctx,
 917                                                       &domain_pol,
 918                                                       &start_idx,
 919                                                       &dom_groups,
 920                                                       size,
 921                                                       &num_dom_groups);
 922                 if (NT_STATUS_IS_OK(result) ||
 923                     NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES)) {
 924
 925                         for (i = 0; i < num_dom_groups; i++)
 926                                 printf("group:[%s] rid:[0x%x]\n",
 927                                        dom_groups->entries[i].name.string,
 928                                        dom_groups->entries[i].idx);
 929                 }
 930
 931         } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES));
 932
 933  done:
 934         if (got_domain_pol)
 935                 rpccli_samr_Close(cli, mem_ctx, &domain_pol);
 936
 937         if (got_connect_pol)
 938                 rpccli_samr_Close(cli, mem_ctx, &connect_pol);
 939
 940         return result;
 941 }
 942
 943 /* Enumerate alias groups */
 944
 945 static NTSTATUS cmd_samr_enum_als_groups(struct rpc_pipe_client *cli,
 946                                          TALLOC_CTX *mem_ctx,
 947                                          int argc, const char **argv)
 948 {
 949         POLICY_HND connect_pol, domain_pol;
 950         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 951         uint32 start_idx, size, num_als_groups, i;
 952         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
 953         struct samr_SamArray *als_groups = NULL;
 954         bool got_connect_pol = False, got_domain_pol = False;
 955
 956         if ((argc < 2) || (argc > 3)) {
 957                 printf("Usage: %s builtin|domain [access mask]\n", argv[0]);
 958                 return NT_STATUS_OK;
 959         }
 960
 961         if (argc > 2)
 962                 sscanf(argv[2], "%x", &access_mask);
 963
 964         /* Get sam policy handle */
 965
 966         result = rpccli_try_samr_connects(cli, mem_ctx,
 967                                           MAXIMUM_ALLOWED_ACCESS,
 968                                           &connect_pol);
 969
 970         if (!NT_STATUS_IS_OK(result))
 971                 goto done;
 972
 973         got_connect_pol = True;
 974
 975         /* Get domain policy handle */
 976
 977         result = get_domain_handle(cli, mem_ctx, argv[1],
 978                                    &connect_pol,
 979                                    access_mask,
 980                                    &domain_sid,
 981                                    &domain_pol);
 982
 983         if (!NT_STATUS_IS_OK(result))
 984                 goto done;
 985
 986         got_domain_pol = True;
 987
 988         /* Enumerate alias groups */
 989
 990         start_idx = 0;
 991         size = 0xffff;          /* Number of groups to retrieve */
 992
 993         do {
 994                 result = rpccli_samr_EnumDomainAliases(cli, mem_ctx,
 995                                                        &domain_pol,
 996                                                        &start_idx,
 997                                                        &als_groups,
 998                                                        size,
 999                                                        &num_als_groups);
1000
1001                 if (NT_STATUS_IS_OK(result) ||
1002                     NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES)) {
1003
1004                         for (i = 0; i < num_als_groups; i++)
1005                                 printf("group:[%s] rid:[0x%x]\n",
1006                                        als_groups->entries[i].name.string,
1007                                        als_groups->entries[i].idx);
1008                 }
1009         } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES));
1010
1011  done:
1012         if (got_domain_pol)
1013                 rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1014
1015         if (got_connect_pol)
1016                 rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1017
1018         return result;
1019 }
1020
1021 /* Enumerate domains */
1022
1023 static NTSTATUS cmd_samr_enum_domains(struct rpc_pipe_client *cli,
1024                                       TALLOC_CTX *mem_ctx,
1025                                       int argc, const char **argv)
1026 {
1027         POLICY_HND connect_pol;
1028         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1029         uint32 start_idx, size, num_entries, i;
1030         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1031         bool got_connect_pol = false;
1032         struct samr_SamArray *sam = NULL;
1033
1034         if ((argc < 1) || (argc > 2)) {
1035                 printf("Usage: %s [access mask]\n", argv[0]);
1036                 return NT_STATUS_OK;
1037         }
1038
1039         if (argc > 1) {
1040                 sscanf(argv[1], "%x", &access_mask);
1041         }
1042
1043         /* Get sam policy handle */
1044
1045         result = rpccli_try_samr_connects(cli, mem_ctx,
1046                                           access_mask,
1047                                           &connect_pol);
1048
1049         if (!NT_STATUS_IS_OK(result)) {
1050                 goto done;
1051         }
1052
1053         got_connect_pol = true;
1054
1055         /* Enumerate alias groups */
1056
1057         start_idx = 0;
1058         size = 0xffff;
1059
1060         do {
1061                 result = rpccli_samr_EnumDomains(cli, mem_ctx,
1062                                                  &connect_pol,
1063                                                  &start_idx,
1064                                                  &sam,
1065                                                  size,
1066                                                  &num_entries);
1067
1068                 if (NT_STATUS_IS_OK(result) ||
1069                     NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES)) {
1070
1071                         for (i = 0; i < num_entries; i++)
1072                                 printf("name:[%s] idx:[0x%x]\n",
1073                                        sam->entries[i].name.string,
1074                                        sam->entries[i].idx);
1075                 }
1076         } while (NT_STATUS_V(result) == NT_STATUS_V(STATUS_MORE_ENTRIES));
1077
1078  done:
1079         if (got_connect_pol) {
1080                 rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1081         }
1082
1083         return result;
1084 }
1085
1086
1087 /* Query alias membership */
1088
1089 static NTSTATUS cmd_samr_query_aliasmem(struct rpc_pipe_client *cli,
1090                                         TALLOC_CTX *mem_ctx,
1091                                         int argc, const char **argv)
1092 {
1093         POLICY_HND connect_pol, domain_pol, alias_pol;
1094         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1095         uint32 alias_rid, i;
1096         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
1097         struct lsa_SidArray sid_array;
1098
1099         if ((argc < 3) || (argc > 4)) {
1100                 printf("Usage: %s builtin|domain rid [access mask]\n", argv[0]);
1101                 return NT_STATUS_OK;
1102         }
1103
1104         sscanf(argv[2], "%i", &alias_rid);
1105
1106         if (argc > 3)
1107                 sscanf(argv[3], "%x", &access_mask);
1108
1109         /* Open SAMR handle */
1110
1111         result = rpccli_try_samr_connects(cli, mem_ctx,
1112                                           MAXIMUM_ALLOWED_ACCESS,
1113                                           &connect_pol);
1114
1115         if (!NT_STATUS_IS_OK(result))
1116                 goto done;
1117
1118         /* Open handle on domain */
1119
1120         result = get_domain_handle(cli, mem_ctx, argv[1],
1121                                    &connect_pol,
1122                                    MAXIMUM_ALLOWED_ACCESS,
1123                                    &domain_sid,
1124                                    &domain_pol);
1125
1126         if (!NT_STATUS_IS_OK(result))
1127                 goto done;
1128
1129         /* Open handle on alias */
1130
1131         result = rpccli_samr_OpenAlias(cli, mem_ctx,
1132                                        &domain_pol,
1133                                        access_mask,
1134                                        alias_rid,
1135                                        &alias_pol);
1136         if (!NT_STATUS_IS_OK(result))
1137                 goto done;
1138
1139         result = rpccli_samr_GetMembersInAlias(cli, mem_ctx,
1140                                                &alias_pol,
1141                                                &sid_array);
1142
1143         if (!NT_STATUS_IS_OK(result))
1144                 goto done;
1145
1146         for (i = 0; i < sid_array.num_sids; i++) {
1147                 fstring sid_str;
1148
1149                 sid_to_fstring(sid_str, sid_array.sids[i].sid);
1150                 printf("\tsid:[%s]\n", sid_str);
1151         }
1152
1153         rpccli_samr_Close(cli, mem_ctx, &alias_pol);
1154         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1155         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1156  done:
1157         return result;
1158 }
1159
1160 /* Query alias info */
1161
1162 static NTSTATUS cmd_samr_query_aliasinfo(struct rpc_pipe_client *cli,
1163                                          TALLOC_CTX *mem_ctx,
1164                                          int argc, const char **argv)
1165 {
1166         POLICY_HND connect_pol, domain_pol, alias_pol;
1167         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1168         uint32_t alias_rid;
1169         uint32_t access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1170         union samr_AliasInfo *info = NULL;
1171         enum samr_AliasInfoEnum level = ALIASINFOALL;
1172
1173         if ((argc < 3) || (argc > 4)) {
1174                 printf("Usage: %s builtin|domain rid [level] [access mask]\n",
1175                         argv[0]);
1176                 return NT_STATUS_OK;
1177         }
1178
1179         sscanf(argv[2], "%i", &alias_rid);
1180
1181         if (argc > 2) {
1182                 level = atoi(argv[3]);
1183         }
1184
1185         if (argc > 3) {
1186                 sscanf(argv[4], "%x", &access_mask);
1187         }
1188
1189         /* Open SAMR handle */
1190
1191         result = rpccli_try_samr_connects(cli, mem_ctx,
1192                                           SEC_FLAG_MAXIMUM_ALLOWED,
1193                                           &connect_pol);
1194
1195         if (!NT_STATUS_IS_OK(result)) {
1196                 goto done;
1197         }
1198
1199         /* Open handle on domain */
1200
1201         result = get_domain_handle(cli, mem_ctx, argv[1],
1202                                    &connect_pol,
1203                                    SEC_FLAG_MAXIMUM_ALLOWED,
1204                                    &domain_sid,
1205                                    &domain_pol);
1206
1207         if (!NT_STATUS_IS_OK(result)) {
1208                 goto done;
1209         }
1210
1211         /* Open handle on alias */
1212
1213         result = rpccli_samr_OpenAlias(cli, mem_ctx,
1214                                        &domain_pol,
1215                                        access_mask,
1216                                        alias_rid,
1217                                        &alias_pol);
1218         if (!NT_STATUS_IS_OK(result)) {
1219                 goto done;
1220         }
1221
1222         result = rpccli_samr_QueryAliasInfo(cli, mem_ctx,
1223                                             &alias_pol,
1224                                             level,
1225                                             &info);
1226
1227         if (!NT_STATUS_IS_OK(result)) {
1228                 goto done;
1229         }
1230
1231         switch (level) {
1232                 case ALIASINFOALL:
1233                         printf("Name: %s\n", info->all.name.string);
1234                         printf("Description: %s\n", info->all.description.string);
1235                         printf("Num Members: %d\n", info->all.num_members);
1236                         break;
1237                 case ALIASINFONAME:
1238                         printf("Name: %s\n", info->name.string);
1239                         break;
1240                 case ALIASINFODESCRIPTION:
1241                         printf("Description: %s\n", info->description.string);
1242                         break;
1243                 default:
1244                         break;
1245         }
1246
1247         rpccli_samr_Close(cli, mem_ctx, &alias_pol);
1248         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1249         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1250  done:
1251         return result;
1252 }
1253
1254
1255 /* Query delete an alias membership */
1256
1257 static NTSTATUS cmd_samr_delete_alias(struct rpc_pipe_client *cli,
1258                                       TALLOC_CTX *mem_ctx,
1259                                       int argc, const char **argv)
1260 {
1261         POLICY_HND connect_pol, domain_pol, alias_pol;
1262         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1263         uint32 alias_rid;
1264         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
1265
1266         if (argc != 3) {
1267                 printf("Usage: %s builtin|domain [rid|name]\n", argv[0]);
1268                 return NT_STATUS_OK;
1269         }
1270
1271         alias_rid = strtoul(argv[2], NULL, 10);
1272
1273         /* Open SAMR handle */
1274
1275         result = rpccli_try_samr_connects(cli, mem_ctx,
1276                                           MAXIMUM_ALLOWED_ACCESS,
1277                                           &connect_pol);
1278
1279         if (!NT_STATUS_IS_OK(result))
1280                 goto done;
1281
1282         /* Open handle on domain */
1283
1284         result = get_domain_handle(cli, mem_ctx, argv[1],
1285                                    &connect_pol,
1286                                    MAXIMUM_ALLOWED_ACCESS,
1287                                    &domain_sid,
1288                                    &domain_pol);
1289
1290         if (!NT_STATUS_IS_OK(result))
1291                 goto done;
1292
1293         /* Open handle on alias */
1294
1295         result = rpccli_samr_OpenAlias(cli, mem_ctx,
1296                                        &domain_pol,
1297                                        access_mask,
1298                                        alias_rid,
1299                                        &alias_pol);
1300         if (!NT_STATUS_IS_OK(result) && (alias_rid == 0)) {
1301                 /* Probably this was a user name, try lookupnames */
1302                 struct samr_Ids rids, types;
1303                 struct lsa_String lsa_acct_name;
1304
1305                 init_lsa_String(&lsa_acct_name, argv[2]);
1306
1307                 result = rpccli_samr_LookupNames(cli, mem_ctx,
1308                                                  &domain_pol,
1309                                                  1,
1310                                                  &lsa_acct_name,
1311                                                  &rids,
1312                                                  &types);
1313
1314                 if (NT_STATUS_IS_OK(result)) {
1315                         result = rpccli_samr_OpenAlias(cli, mem_ctx,
1316                                                        &domain_pol,
1317                                                        access_mask,
1318                                                        rids.ids[0],
1319                                                        &alias_pol);
1320                 }
1321         }
1322
1323         result = rpccli_samr_DeleteDomAlias(cli, mem_ctx,
1324                                             &alias_pol);
1325
1326         if (!NT_STATUS_IS_OK(result))
1327                 goto done;
1328
1329         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1330         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1331  done:
1332         return result;
1333 }
1334
1335 /* Query display info */
1336
1337 static NTSTATUS cmd_samr_query_dispinfo_internal(struct rpc_pipe_client *cli,
1338                                                  TALLOC_CTX *mem_ctx,
1339                                                  int argc, const char **argv,
1340                                                  uint32_t opcode)
1341 {
1342         POLICY_HND connect_pol, domain_pol;
1343         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1344         uint32 start_idx=0, max_entries=250, max_size = 0xffff, num_entries = 0, i;
1345         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
1346         uint32 info_level = 1;
1347         union samr_DispInfo info;
1348         int loop_count = 0;
1349         bool got_params = False; /* Use get_query_dispinfo_params() or not? */
1350         uint32_t total_size, returned_size;
1351
1352         if (argc > 6) {
1353                 printf("Usage: %s [info level] [start index] [max entries] [max size] [access mask]\n", argv[0]);
1354                 return NT_STATUS_OK;
1355         }
1356
1357         if (argc >= 2)
1358                 sscanf(argv[1], "%i", &info_level);
1359
1360         if (argc >= 3)
1361                 sscanf(argv[2], "%i", &start_idx);
1362
1363         if (argc >= 4) {
1364                 sscanf(argv[3], "%i", &max_entries);
1365                 got_params = True;
1366         }
1367
1368         if (argc >= 5) {
1369                 sscanf(argv[4], "%i", &max_size);
1370                 got_params = True;
1371         }
1372
1373         if (argc >= 6)
1374                 sscanf(argv[5], "%x", &access_mask);
1375
1376         /* Get sam policy handle */
1377
1378         result = rpccli_try_samr_connects(cli, mem_ctx,
1379                                           MAXIMUM_ALLOWED_ACCESS,
1380                                           &connect_pol);
1381
1382         if (!NT_STATUS_IS_OK(result))
1383                 goto done;
1384
1385         /* Get domain policy handle */
1386
1387         result = rpccli_samr_OpenDomain(cli, mem_ctx,
1388                                         &connect_pol,
1389                                         access_mask,
1390                                         &domain_sid,
1391                                         &domain_pol);
1392
1393         if (!NT_STATUS_IS_OK(result))
1394                 goto done;
1395
1396         /* Query display info */
1397
1398         do {
1399
1400                 if (!got_params)
1401                         get_query_dispinfo_params(
1402                                 loop_count, &max_entries, &max_size);
1403
1404                 switch (opcode) {
1405                 case NDR_SAMR_QUERYDISPLAYINFO:
1406                         result = rpccli_samr_QueryDisplayInfo(cli, mem_ctx,
1407                                                               &domain_pol,
1408                                                               info_level,
1409                                                               start_idx,
1410                                                               max_entries,
1411                                                               max_size,
1412                                                               &total_size,
1413                                                               &returned_size,
1414                                                               &info);
1415                         break;
1416                 case NDR_SAMR_QUERYDISPLAYINFO2:
1417                         result = rpccli_samr_QueryDisplayInfo2(cli, mem_ctx,
1418                                                                &domain_pol,
1419                                                                info_level,
1420                                                                start_idx,
1421                                                                max_entries,
1422                                                                max_size,
1423                                                                &total_size,
1424                                                                &returned_size,
1425                                                                &info);
1426
1427                         break;
1428                 case NDR_SAMR_QUERYDISPLAYINFO3:
1429                         result = rpccli_samr_QueryDisplayInfo3(cli, mem_ctx,
1430                                                                &domain_pol,
1431                                                                info_level,
1432                                                                start_idx,
1433                                                                max_entries,
1434                                                                max_size,
1435                                                                &total_size,
1436                                                                &returned_size,
1437                                                                &info);
1438
1439                         break;
1440                 default:
1441                         return NT_STATUS_INVALID_PARAMETER;
1442                 }
1443
1444                 if (!NT_STATUS_IS_OK(result) &&
1445                     !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
1446                     !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
1447                         break;
1448                 }
1449
1450                 loop_count++;
1451
1452                 switch (info_level) {
1453                         case 1:
1454                                 num_entries = info.info1.count;
1455                                 break;
1456                         case 2:
1457                                 num_entries = info.info2.count;
1458                                 break;
1459                         case 3:
1460                                 num_entries = info.info3.count;
1461                                 break;
1462                         case 4:
1463                                 num_entries = info.info4.count;
1464                                 break;
1465                         case 5:
1466                                 num_entries = info.info5.count;
1467                                 break;
1468                         default:
1469                                 break;
1470                 }
1471
1472                 start_idx += num_entries;
1473
1474                 if (num_entries == 0)
1475                         break;
1476
1477                 for (i = 0; i < num_entries; i++) {
1478                         switch (info_level) {
1479                         case 1:
1480                                 display_sam_info_1(&info.info1.entries[i]);
1481                                 break;
1482                         case 2:
1483                                 display_sam_info_2(&info.info2.entries[i]);
1484                                 break;
1485                         case 3:
1486                                 display_sam_info_3(&info.info3.entries[i]);
1487                                 break;
1488                         case 4:
1489                                 display_sam_info_4(&info.info4.entries[i]);
1490                                 break;
1491                         case 5:
1492                                 display_sam_info_5(&info.info5.entries[i]);
1493                                 break;
1494                         }
1495                 }
1496         } while ( NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES));
1497
1498         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1499         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1500  done:
1501         return result;
1502 }
1503
1504 static NTSTATUS cmd_samr_query_dispinfo(struct rpc_pipe_client *cli,
1505                                         TALLOC_CTX *mem_ctx,
1506                                         int argc, const char **argv)
1507 {
1508         return cmd_samr_query_dispinfo_internal(cli, mem_ctx, argc, argv,
1509                                                 NDR_SAMR_QUERYDISPLAYINFO);
1510 }
1511
1512 static NTSTATUS cmd_samr_query_dispinfo2(struct rpc_pipe_client *cli,
1513                                          TALLOC_CTX *mem_ctx,
1514                                          int argc, const char **argv)
1515 {
1516         return cmd_samr_query_dispinfo_internal(cli, mem_ctx, argc, argv,
1517                                                 NDR_SAMR_QUERYDISPLAYINFO2);
1518 }
1519
1520 static NTSTATUS cmd_samr_query_dispinfo3(struct rpc_pipe_client *cli,
1521                                          TALLOC_CTX *mem_ctx,
1522                                          int argc, const char **argv)
1523 {
1524         return cmd_samr_query_dispinfo_internal(cli, mem_ctx, argc, argv,
1525                                                 NDR_SAMR_QUERYDISPLAYINFO3);
1526 }
1527
1528 /* Query domain info */
1529
1530 static NTSTATUS cmd_samr_query_dominfo(struct rpc_pipe_client *cli,
1531                                        TALLOC_CTX *mem_ctx,
1532                                        int argc, const char **argv)
1533 {
1534         POLICY_HND connect_pol, domain_pol;
1535         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1536         uint32 switch_level = 2;
1537         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
1538         union samr_DomainInfo *info = NULL;
1539
1540         if (argc > 3) {
1541                 printf("Usage: %s [info level] [access mask]\n", argv[0]);
1542                 return NT_STATUS_OK;
1543         }
1544
1545         if (argc > 1)
1546                 sscanf(argv[1], "%i", &switch_level);
1547
1548         if (argc > 2)
1549                 sscanf(argv[2], "%x", &access_mask);
1550
1551         /* Get sam policy handle */
1552
1553         result = rpccli_try_samr_connects(cli, mem_ctx,
1554                                           MAXIMUM_ALLOWED_ACCESS,
1555                                           &connect_pol);
1556
1557         if (!NT_STATUS_IS_OK(result))
1558                 goto done;
1559
1560         /* Get domain policy handle */
1561
1562         result = rpccli_samr_OpenDomain(cli, mem_ctx,
1563                                         &connect_pol,
1564                                         access_mask,
1565                                         &domain_sid,
1566                                         &domain_pol);
1567
1568         if (!NT_STATUS_IS_OK(result))
1569                 goto done;
1570
1571         /* Query domain info */
1572
1573         result = rpccli_samr_QueryDomainInfo(cli, mem_ctx,
1574                                              &domain_pol,
1575                                              switch_level,
1576                                              &info);
1577
1578         if (!NT_STATUS_IS_OK(result))
1579                 goto done;
1580
1581         /* Display domain info */
1582
1583         switch (switch_level) {
1584         case 1:
1585                 display_sam_dom_info_1(&info->info1);
1586                 break;
1587         case 2:
1588                 display_sam_dom_info_2(&info->general);
1589                 break;
1590         case 3:
1591                 display_sam_dom_info_3(&info->info3);
1592                 break;
1593         case 4:
1594                 display_sam_dom_info_4(&info->oem);
1595                 break;
1596         case 5:
1597                 display_sam_dom_info_5(&info->info5);
1598                 break;
1599         case 6:
1600                 display_sam_dom_info_6(&info->info6);
1601                 break;
1602         case 7:
1603                 display_sam_dom_info_7(&info->info7);
1604                 break;
1605         case 8:
1606                 display_sam_dom_info_8(&info->info8);
1607                 break;
1608         case 9:
1609                 display_sam_dom_info_9(&info->info9);
1610                 break;
1611         case 12:
1612                 display_sam_dom_info_12(&info->info12);
1613                 break;
1614         case 13:
1615                 display_sam_dom_info_13(&info->info13);
1616                 break;
1617
1618         default:
1619                 printf("cannot display domain info for switch value %d\n",
1620                        switch_level);
1621                 break;
1622         }
1623
1624  done:
1625
1626         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1627         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1628         return result;
1629 }
1630
1631 /* Create domain user */
1632
1633 static NTSTATUS cmd_samr_create_dom_user(struct rpc_pipe_client *cli,
1634                                          TALLOC_CTX *mem_ctx,
1635                                          int argc, const char **argv)
1636 {
1637         POLICY_HND connect_pol, domain_pol, user_pol;
1638         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1639         struct lsa_String acct_name;
1640         uint32 acb_info;
1641         uint32 acct_flags, user_rid;
1642         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
1643         uint32_t access_granted = 0;
1644
1645         if ((argc < 2) || (argc > 3)) {
1646                 printf("Usage: %s username [access mask]\n", argv[0]);
1647                 return NT_STATUS_OK;
1648         }
1649
1650         init_lsa_String(&acct_name, argv[1]);
1651
1652         if (argc > 2)
1653                 sscanf(argv[2], "%x", &access_mask);
1654
1655         /* Get sam policy handle */
1656
1657         result = rpccli_try_samr_connects(cli, mem_ctx,
1658                                           MAXIMUM_ALLOWED_ACCESS,
1659                                           &connect_pol);
1660
1661         if (!NT_STATUS_IS_OK(result))
1662                 goto done;
1663
1664         /* Get domain policy handle */
1665
1666         result = rpccli_samr_OpenDomain(cli, mem_ctx,
1667                                         &connect_pol,
1668                                         access_mask,
1669                                         &domain_sid,
1670                                         &domain_pol);
1671
1672         if (!NT_STATUS_IS_OK(result))
1673                 goto done;
1674
1675         /* Create domain user */
1676
1677         acb_info = ACB_NORMAL;
1678         acct_flags = SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
1679                      SEC_STD_WRITE_DAC | SEC_STD_DELETE |
1680                      SAMR_USER_ACCESS_SET_PASSWORD |
1681                      SAMR_USER_ACCESS_GET_ATTRIBUTES |
1682                      SAMR_USER_ACCESS_SET_ATTRIBUTES;
1683
1684         result = rpccli_samr_CreateUser2(cli, mem_ctx,
1685                                          &domain_pol,
1686                                          &acct_name,
1687                                          acb_info,
1688                                          acct_flags,
1689                                          &user_pol,
1690                                          &access_granted,
1691                                          &user_rid);
1692
1693         if (!NT_STATUS_IS_OK(result))
1694                 goto done;
1695
1696         result = rpccli_samr_Close(cli, mem_ctx, &user_pol);
1697         if (!NT_STATUS_IS_OK(result)) goto done;
1698
1699         result = rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1700         if (!NT_STATUS_IS_OK(result)) goto done;
1701
1702         result = rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1703         if (!NT_STATUS_IS_OK(result)) goto done;
1704
1705  done:
1706         return result;
1707 }
1708
1709 /* Create domain group */
1710
1711 static NTSTATUS cmd_samr_create_dom_group(struct rpc_pipe_client *cli,
1712                                           TALLOC_CTX *mem_ctx,
1713                                           int argc, const char **argv)
1714 {
1715         POLICY_HND connect_pol, domain_pol, group_pol;
1716         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1717         struct lsa_String grp_name;
1718         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
1719         uint32_t rid = 0;
1720
1721         if ((argc < 2) || (argc > 3)) {
1722                 printf("Usage: %s groupname [access mask]\n", argv[0]);
1723                 return NT_STATUS_OK;
1724         }
1725
1726         init_lsa_String(&grp_name, argv[1]);
1727
1728         if (argc > 2)
1729                 sscanf(argv[2], "%x", &access_mask);
1730
1731         /* Get sam policy handle */
1732
1733         result = rpccli_try_samr_connects(cli, mem_ctx,
1734                                           MAXIMUM_ALLOWED_ACCESS,
1735                                           &connect_pol);
1736
1737         if (!NT_STATUS_IS_OK(result))
1738                 goto done;
1739
1740         /* Get domain policy handle */
1741
1742         result = rpccli_samr_OpenDomain(cli, mem_ctx,
1743                                         &connect_pol,
1744                                         access_mask,
1745                                         &domain_sid,
1746                                         &domain_pol);
1747
1748         if (!NT_STATUS_IS_OK(result))
1749                 goto done;
1750
1751         /* Create domain user */
1752         result = rpccli_samr_CreateDomainGroup(cli, mem_ctx,
1753                                                &domain_pol,
1754                                                &grp_name,
1755                                                MAXIMUM_ALLOWED_ACCESS,
1756                                                &group_pol,
1757                                                &rid);
1758
1759         if (!NT_STATUS_IS_OK(result))
1760                 goto done;
1761
1762         result = rpccli_samr_Close(cli, mem_ctx, &group_pol);
1763         if (!NT_STATUS_IS_OK(result)) goto done;
1764
1765         result = rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1766         if (!NT_STATUS_IS_OK(result)) goto done;
1767
1768         result = rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1769         if (!NT_STATUS_IS_OK(result)) goto done;
1770
1771  done:
1772         return result;
1773 }
1774
1775 /* Create domain alias */
1776
1777 static NTSTATUS cmd_samr_create_dom_alias(struct rpc_pipe_client *cli,
1778                                           TALLOC_CTX *mem_ctx,
1779                                           int argc, const char **argv)
1780 {
1781         POLICY_HND connect_pol, domain_pol, alias_pol;
1782         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1783         struct lsa_String alias_name;
1784         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
1785         uint32_t rid = 0;
1786
1787         if ((argc < 2) || (argc > 3)) {
1788                 printf("Usage: %s aliasname [access mask]\n", argv[0]);
1789                 return NT_STATUS_OK;
1790         }
1791
1792         init_lsa_String(&alias_name, argv[1]);
1793
1794         if (argc > 2)
1795                 sscanf(argv[2], "%x", &access_mask);
1796
1797         /* Get sam policy handle */
1798
1799         result = rpccli_try_samr_connects(cli, mem_ctx,
1800                                           MAXIMUM_ALLOWED_ACCESS,
1801                                           &connect_pol);
1802
1803         if (!NT_STATUS_IS_OK(result))
1804                 goto done;
1805
1806         /* Get domain policy handle */
1807
1808         result = rpccli_samr_OpenDomain(cli, mem_ctx,
1809                                         &connect_pol,
1810                                         access_mask,
1811                                         &domain_sid,
1812                                         &domain_pol);
1813
1814         if (!NT_STATUS_IS_OK(result))
1815                 goto done;
1816
1817         /* Create domain user */
1818
1819         result = rpccli_samr_CreateDomAlias(cli, mem_ctx,
1820                                             &domain_pol,
1821                                             &alias_name,
1822                                             MAXIMUM_ALLOWED_ACCESS,
1823                                             &alias_pol,
1824                                             &rid);
1825
1826         if (!NT_STATUS_IS_OK(result))
1827                 goto done;
1828
1829         result = rpccli_samr_Close(cli, mem_ctx, &alias_pol);
1830         if (!NT_STATUS_IS_OK(result)) goto done;
1831
1832         result = rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1833         if (!NT_STATUS_IS_OK(result)) goto done;
1834
1835         result = rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1836         if (!NT_STATUS_IS_OK(result)) goto done;
1837
1838  done:
1839         return result;
1840 }
1841
1842 /* Lookup sam names */
1843
1844 static NTSTATUS cmd_samr_lookup_names(struct rpc_pipe_client *cli,
1845                                       TALLOC_CTX *mem_ctx,
1846                                       int argc, const char **argv)
1847 {
1848         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1849         POLICY_HND connect_pol, domain_pol;
1850         uint32 num_names;
1851         struct samr_Ids rids, name_types;
1852         int i;
1853         struct lsa_String *names = NULL;;
1854
1855         if (argc < 3) {
1856                 printf("Usage: %s  domain|builtin name1 [name2 [name3] [...]]\n", argv[0]);
1857                 printf("check on the domain SID: S-1-5-21-x-y-z\n");
1858                 printf("or check on the builtin SID: S-1-5-32\n");
1859                 return NT_STATUS_OK;
1860         }
1861
1862         /* Get sam policy and domain handles */
1863
1864         result = rpccli_try_samr_connects(cli, mem_ctx,
1865                                           MAXIMUM_ALLOWED_ACCESS,
1866                                           &connect_pol);
1867
1868         if (!NT_STATUS_IS_OK(result))
1869                 goto done;
1870
1871         result = get_domain_handle(cli, mem_ctx, argv[1],
1872                                    &connect_pol,
1873                                    MAXIMUM_ALLOWED_ACCESS,
1874                                    &domain_sid,
1875                                    &domain_pol);
1876
1877         if (!NT_STATUS_IS_OK(result))
1878                 goto done;
1879
1880         /* Look up names */
1881
1882         num_names = argc - 2;
1883
1884         if ((names = TALLOC_ARRAY(mem_ctx, struct lsa_String, num_names)) == NULL) {
1885                 rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1886                 rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1887                 result = NT_STATUS_NO_MEMORY;
1888                 goto done;
1889         }
1890
1891         for (i = 0; i < num_names; i++) {
1892                 init_lsa_String(&names[i], argv[i + 2]);
1893         }
1894
1895         result = rpccli_samr_LookupNames(cli, mem_ctx,
1896                                          &domain_pol,
1897                                          num_names,
1898                                          names,
1899                                          &rids,
1900                                          &name_types);
1901
1902         if (!NT_STATUS_IS_OK(result))
1903                 goto done;
1904
1905         /* Display results */
1906
1907         for (i = 0; i < num_names; i++)
1908                 printf("name %s: 0x%x (%d)\n", names[i].string, rids.ids[i],
1909                        name_types.ids[i]);
1910
1911         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1912         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1913  done:
1914         return result;
1915 }
1916
1917 /* Lookup sam rids */
1918
1919 static NTSTATUS cmd_samr_lookup_rids(struct rpc_pipe_client *cli,
1920                                      TALLOC_CTX *mem_ctx,
1921                                      int argc, const char **argv)
1922 {
1923         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1924         POLICY_HND connect_pol, domain_pol;
1925         uint32_t num_rids, *rids;
1926         struct lsa_Strings names;
1927         struct samr_Ids types;
1928
1929         int i;
1930
1931         if (argc < 3) {
1932                 printf("Usage: %s domain|builtin rid1 [rid2 [rid3] [...]]\n", argv[0]);
1933                 return NT_STATUS_OK;
1934         }
1935
1936         /* Get sam policy and domain handles */
1937
1938         result = rpccli_try_samr_connects(cli, mem_ctx,
1939                                           MAXIMUM_ALLOWED_ACCESS,
1940                                           &connect_pol);
1941
1942         if (!NT_STATUS_IS_OK(result))
1943                 goto done;
1944
1945         result = get_domain_handle(cli, mem_ctx, argv[1],
1946                                    &connect_pol,
1947                                    MAXIMUM_ALLOWED_ACCESS,
1948                                    &domain_sid,
1949                                    &domain_pol);
1950
1951         if (!NT_STATUS_IS_OK(result))
1952                 goto done;
1953
1954         /* Look up rids */
1955
1956         num_rids = argc - 2;
1957
1958         if ((rids = TALLOC_ARRAY(mem_ctx, uint32, num_rids)) == NULL) {
1959                 rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1960                 rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1961                 result = NT_STATUS_NO_MEMORY;
1962                 goto done;
1963         }
1964
1965         for (i = 0; i < argc - 2; i++)
1966                 sscanf(argv[i + 2], "%i", &rids[i]);
1967
1968         result = rpccli_samr_LookupRids(cli, mem_ctx,
1969                                         &domain_pol,
1970                                         num_rids,
1971                                         rids,
1972                                         &names,
1973                                         &types);
1974
1975         if (!NT_STATUS_IS_OK(result) &&
1976             !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
1977                 goto done;
1978
1979         /* Display results */
1980
1981         for (i = 0; i < num_rids; i++) {
1982                 printf("rid 0x%x: %s (%d)\n",
1983                         rids[i], names.names[i].string, types.ids[i]);
1984         }
1985
1986         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
1987         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
1988  done:
1989         return result;
1990 }
1991
1992 /* Delete domain group */
1993
1994 static NTSTATUS cmd_samr_delete_dom_group(struct rpc_pipe_client *cli,
1995                                          TALLOC_CTX *mem_ctx,
1996                                          int argc, const char **argv)
1997 {
1998         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1999         POLICY_HND connect_pol, domain_pol, group_pol;
2000         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
2001
2002         if ((argc < 2) || (argc > 3)) {
2003                 printf("Usage: %s groupname\n", argv[0]);
2004                 return NT_STATUS_OK;
2005         }
2006
2007         if (argc > 2)
2008                 sscanf(argv[2], "%x", &access_mask);
2009
2010         /* Get sam policy and domain handles */
2011
2012         result = rpccli_try_samr_connects(cli, mem_ctx,
2013                                           MAXIMUM_ALLOWED_ACCESS,
2014                                           &connect_pol);
2015
2016         if (!NT_STATUS_IS_OK(result))
2017                 goto done;
2018
2019         result = rpccli_samr_OpenDomain(cli, mem_ctx,
2020                                         &connect_pol,
2021                                         MAXIMUM_ALLOWED_ACCESS,
2022                                         &domain_sid,
2023                                         &domain_pol);
2024
2025         if (!NT_STATUS_IS_OK(result))
2026                 goto done;
2027
2028         /* Get handle on group */
2029
2030         {
2031                 struct samr_Ids group_rids, name_types;
2032                 struct lsa_String lsa_acct_name;
2033
2034                 init_lsa_String(&lsa_acct_name, argv[1]);
2035
2036                 result = rpccli_samr_LookupNames(cli, mem_ctx,
2037                                                  &domain_pol,
2038                                                  1,
2039                                                  &lsa_acct_name,
2040                                                  &group_rids,
2041                                                  &name_types);
2042                 if (!NT_STATUS_IS_OK(result))
2043                         goto done;
2044
2045                 result = rpccli_samr_OpenGroup(cli, mem_ctx,
2046                                                &domain_pol,
2047                                                access_mask,
2048                                                group_rids.ids[0],
2049                                                &group_pol);
2050
2051                 if (!NT_STATUS_IS_OK(result))
2052                         goto done;
2053         }
2054
2055         /* Delete group */
2056
2057         result = rpccli_samr_DeleteDomainGroup(cli, mem_ctx,
2058                                                &group_pol);
2059
2060         if (!NT_STATUS_IS_OK(result))
2061                 goto done;
2062
2063         /* Display results */
2064
2065         rpccli_samr_Close(cli, mem_ctx, &group_pol);
2066         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
2067         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
2068
2069  done:
2070         return result;
2071 }
2072
2073 /* Delete domain user */
2074
2075 static NTSTATUS cmd_samr_delete_dom_user(struct rpc_pipe_client *cli,
2076                                          TALLOC_CTX *mem_ctx,
2077                                          int argc, const char **argv)
2078 {
2079         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2080         POLICY_HND connect_pol, domain_pol, user_pol;
2081         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
2082
2083         if ((argc < 2) || (argc > 3)) {
2084                 printf("Usage: %s username\n", argv[0]);
2085                 return NT_STATUS_OK;
2086         }
2087
2088         if (argc > 2)
2089                 sscanf(argv[2], "%x", &access_mask);
2090
2091         /* Get sam policy and domain handles */
2092
2093         result = rpccli_try_samr_connects(cli, mem_ctx,
2094                                           MAXIMUM_ALLOWED_ACCESS,
2095                                           &connect_pol);
2096
2097         if (!NT_STATUS_IS_OK(result))
2098                 goto done;
2099
2100         result = rpccli_samr_OpenDomain(cli, mem_ctx,
2101                                         &connect_pol,
2102                                         MAXIMUM_ALLOWED_ACCESS,
2103                                         &domain_sid,
2104                                         &domain_pol);
2105
2106         if (!NT_STATUS_IS_OK(result))
2107                 goto done;
2108
2109         /* Get handle on user */
2110
2111         {
2112                 struct samr_Ids user_rids, name_types;
2113                 struct lsa_String lsa_acct_name;
2114
2115                 init_lsa_String(&lsa_acct_name, argv[1]);
2116
2117                 result = rpccli_samr_LookupNames(cli, mem_ctx,
2118                                                  &domain_pol,
2119                                                  1,
2120                                                  &lsa_acct_name,
2121                                                  &user_rids,
2122                                                  &name_types);
2123
2124                 if (!NT_STATUS_IS_OK(result))
2125                         goto done;
2126
2127                 result = rpccli_samr_OpenUser(cli, mem_ctx,
2128                                               &domain_pol,
2129                                               access_mask,
2130                                               user_rids.ids[0],
2131                                               &user_pol);
2132
2133                 if (!NT_STATUS_IS_OK(result))
2134                         goto done;
2135         }
2136
2137         /* Delete user */
2138
2139         result = rpccli_samr_DeleteUser(cli, mem_ctx,
2140                                         &user_pol);
2141
2142         if (!NT_STATUS_IS_OK(result))
2143                 goto done;
2144
2145         /* Display results */
2146
2147         rpccli_samr_Close(cli, mem_ctx, &user_pol);
2148         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
2149         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
2150
2151  done:
2152         return result;
2153 }
2154
2155 /**********************************************************************
2156  * Query user security object
2157  */
2158 static NTSTATUS cmd_samr_query_sec_obj(struct rpc_pipe_client *cli,
2159                                     TALLOC_CTX *mem_ctx,
2160                                     int argc, const char **argv)
2161 {
2162         POLICY_HND connect_pol, domain_pol, user_pol, *pol;
2163         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2164         uint32 sec_info = DACL_SECURITY_INFORMATION;
2165         uint32 user_rid = 0;
2166         TALLOC_CTX *ctx = NULL;
2167         SEC_DESC_BUF *sec_desc_buf=NULL;
2168         bool domain = False;
2169
2170         ctx=talloc_init("cmd_samr_query_sec_obj");
2171
2172         if ((argc < 1) || (argc > 3)) {
2173                 printf("Usage: %s [rid|-d] [sec_info]\n", argv[0]);
2174                 printf("\tSpecify rid for security on user, -d for security on domain\n");
2175                 talloc_destroy(ctx);
2176                 return NT_STATUS_OK;
2177         }
2178
2179         if (argc > 1) {
2180                 if (strcmp(argv[1], "-d") == 0)
2181                         domain = True;
2182                 else
2183                         sscanf(argv[1], "%i", &user_rid);
2184         }
2185
2186         if (argc == 3) {
2187                 sec_info = atoi(argv[2]);
2188         }
2189
2190         result = rpccli_try_samr_connects(cli, mem_ctx,
2191                                           MAXIMUM_ALLOWED_ACCESS,
2192                                           &connect_pol);
2193
2194         if (!NT_STATUS_IS_OK(result))
2195                 goto done;
2196
2197         if (domain || user_rid)
2198                 result = rpccli_samr_OpenDomain(cli, mem_ctx,
2199                                                 &connect_pol,
2200                                                 MAXIMUM_ALLOWED_ACCESS,
2201                                                 &domain_sid,
2202                                                 &domain_pol);
2203
2204         if (!NT_STATUS_IS_OK(result))
2205                 goto done;
2206
2207         if (user_rid)
2208                 result = rpccli_samr_OpenUser(cli, mem_ctx,
2209                                               &domain_pol,
2210                                               MAXIMUM_ALLOWED_ACCESS,
2211                                               user_rid,
2212                                               &user_pol);
2213
2214         if (!NT_STATUS_IS_OK(result))
2215                 goto done;
2216
2217         /* Pick which query pol to use */
2218
2219         pol = &connect_pol;
2220
2221         if (domain)
2222                 pol = &domain_pol;
2223
2224         if (user_rid)
2225                 pol = &user_pol;
2226
2227         /* Query SAM security object */
2228
2229         result = rpccli_samr_QuerySecurity(cli, mem_ctx,
2230                                            pol,
2231                                            sec_info,
2232                                            &sec_desc_buf);
2233
2234         if (!NT_STATUS_IS_OK(result))
2235                 goto done;
2236
2237         display_sec_desc(sec_desc_buf->sd);
2238
2239         rpccli_samr_Close(cli, mem_ctx, &user_pol);
2240         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
2241         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
2242 done:
2243         talloc_destroy(ctx);
2244         return result;
2245 }
2246
2247 static NTSTATUS cmd_samr_get_usrdom_pwinfo(struct rpc_pipe_client *cli,
2248                                            TALLOC_CTX *mem_ctx,
2249                                            int argc, const char **argv)
2250 {
2251         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2252         POLICY_HND connect_pol, domain_pol, user_pol;
2253         struct samr_PwInfo info;
2254         uint32_t rid;
2255
2256         if (argc != 2) {
2257                 printf("Usage: %s rid\n", argv[0]);
2258                 return NT_STATUS_OK;
2259         }
2260
2261         sscanf(argv[1], "%i", &rid);
2262
2263         result = rpccli_try_samr_connects(cli, mem_ctx,
2264                                           MAXIMUM_ALLOWED_ACCESS,
2265                                           &connect_pol);
2266
2267         if (!NT_STATUS_IS_OK(result)) {
2268                 goto done;
2269         }
2270
2271         result = rpccli_samr_OpenDomain(cli, mem_ctx,
2272                                         &connect_pol,
2273                                         MAXIMUM_ALLOWED_ACCESS,
2274                                         &domain_sid,
2275                                         &domain_pol);
2276
2277         if (!NT_STATUS_IS_OK(result)) {
2278                 goto done;
2279         }
2280
2281         result = rpccli_samr_OpenUser(cli, mem_ctx,
2282                                       &domain_pol,
2283                                       MAXIMUM_ALLOWED_ACCESS,
2284                                       rid,
2285                                       &user_pol);
2286
2287         if (!NT_STATUS_IS_OK(result)) {
2288                 goto done;
2289         }
2290
2291         result = rpccli_samr_GetUserPwInfo(cli, mem_ctx, &user_pol, &info);
2292         if (NT_STATUS_IS_OK(result)) {
2293                 printf("min_password_length: %d\n", info.min_password_length);
2294                 printf("%s\n",
2295                         NDR_PRINT_STRUCT_STRING(mem_ctx,
2296                                 samr_PasswordProperties, &info.password_properties));
2297         }
2298
2299  done:
2300         rpccli_samr_Close(cli, mem_ctx, &user_pol);
2301         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
2302         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
2303
2304         return result;
2305 }
2306
2307 static NTSTATUS cmd_samr_get_dom_pwinfo(struct rpc_pipe_client *cli,
2308                                         TALLOC_CTX *mem_ctx,
2309                                         int argc, const char **argv)
2310 {
2311         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2312         struct lsa_String domain_name;
2313         struct samr_PwInfo info;
2314
2315         if (argc < 1 || argc > 3) {
2316                 printf("Usage: %s <domain>\n", argv[0]);
2317                 return NT_STATUS_OK;
2318         }
2319
2320         init_lsa_String(&domain_name, argv[1]);
2321
2322         result = rpccli_samr_GetDomPwInfo(cli, mem_ctx, &domain_name, &info);
2323
2324         if (NT_STATUS_IS_OK(result)) {
2325                 printf("min_password_length: %d\n", info.min_password_length);
2326                 display_password_properties(info.password_properties);
2327         }
2328
2329         return result;
2330 }
2331
2332 /* Look up domain name */
2333
2334 static NTSTATUS cmd_samr_lookup_domain(struct rpc_pipe_client *cli,
2335                                        TALLOC_CTX *mem_ctx,
2336                                        int argc, const char **argv)
2337 {
2338         POLICY_HND connect_pol, domain_pol;
2339         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2340         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
2341         fstring sid_string;
2342         struct lsa_String domain_name;
2343         DOM_SID *sid = NULL;
2344
2345         if (argc != 2) {
2346                 printf("Usage: %s domain_name\n", argv[0]);
2347                 return NT_STATUS_OK;
2348         }
2349
2350         init_lsa_String(&domain_name, argv[1]);
2351
2352         result = rpccli_try_samr_connects(cli, mem_ctx,
2353                                           access_mask,
2354                                           &connect_pol);
2355
2356         if (!NT_STATUS_IS_OK(result))
2357                 goto done;
2358
2359         result = rpccli_samr_OpenDomain(cli, mem_ctx,
2360                                         &connect_pol,
2361                                         access_mask,
2362                                         &domain_sid,
2363                                         &domain_pol);
2364
2365         if (!NT_STATUS_IS_OK(result))
2366                 goto done;
2367
2368         result = rpccli_samr_LookupDomain(cli, mem_ctx,
2369                                           &connect_pol,
2370                                           &domain_name,
2371                                           &sid);
2372
2373         if (NT_STATUS_IS_OK(result)) {
2374                 sid_to_fstring(sid_string, sid);
2375                 printf("SAMR_LOOKUP_DOMAIN: Domain Name: %s Domain SID: %s\n",
2376                        argv[1], sid_string);
2377         }
2378
2379         rpccli_samr_Close(cli, mem_ctx, &domain_pol);
2380         rpccli_samr_Close(cli, mem_ctx, &connect_pol);
2381 done:
2382         return result;
2383 }
2384
2385 /* Change user password */
2386
2387 static NTSTATUS cmd_samr_chgpasswd(struct rpc_pipe_client *cli,
2388                                    TALLOC_CTX *mem_ctx,
2389                                    int argc, const char **argv)
2390 {
2391         POLICY_HND connect_pol, domain_pol, user_pol;
2392         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2393         const char *user, *oldpass, *newpass;
2394         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
2395         struct samr_Ids rids, types;
2396         struct lsa_String lsa_acct_name;
2397
2398         if (argc < 3) {
2399                 printf("Usage: %s username oldpass newpass\n", argv[0]);
2400                 return NT_STATUS_INVALID_PARAMETER;
2401         }
2402
2403         user = argv[1];
2404         oldpass = argv[2];
2405         newpass = argv[3];
2406
2407         /* Get sam policy handle */
2408
2409         result = rpccli_try_samr_connects(cli, mem_ctx,
2410                                           MAXIMUM_ALLOWED_ACCESS,
2411                                           &connect_pol);
2412
2413         if (!NT_STATUS_IS_OK(result)) {
2414                 goto done;
2415         }
2416
2417         /* Get domain policy handle */
2418
2419         result = rpccli_samr_OpenDomain(cli, mem_ctx,
2420                                         &connect_pol,
2421                                         access_mask,
2422                                         &domain_sid,
2423                                         &domain_pol);
2424
2425         if (!NT_STATUS_IS_OK(result)) {
2426                 goto done;
2427         }
2428
2429         init_lsa_String(&lsa_acct_name, user);
2430
2431         result = rpccli_samr_LookupNames(cli, mem_ctx,
2432                                          &domain_pol,
2433                                          1,
2434                                          &lsa_acct_name,
2435                                          &rids,
2436                                          &types);
2437
2438         if (!NT_STATUS_IS_OK(result)) {
2439                 goto done;
2440         }
2441
2442         result = rpccli_samr_OpenUser(cli, mem_ctx,
2443                                       &domain_pol,
2444                                       access_mask,
2445                                       rids.ids[0],
2446                                       &user_pol);
2447
2448         if (!NT_STATUS_IS_OK(result)) {
2449                 goto done;
2450         }
2451
2452         /* Change user password */
2453         result = rpccli_samr_chgpasswd_user(cli, mem_ctx,
2454                                             &user_pol,
2455                                             newpass,
2456                                             oldpass);
2457
2458         if (!NT_STATUS_IS_OK(result)) {
2459                 goto done;
2460         }
2461
2462  done:
2463         if (is_valid_policy_hnd(&user_pol)) {
2464                 rpccli_samr_Close(cli, mem_ctx, &user_pol);
2465         }
2466         if (is_valid_policy_hnd(&domain_pol)) {
2467                 rpccli_samr_Close(cli, mem_ctx, &domain_pol);
2468         }
2469         if (is_valid_policy_hnd(&connect_pol)) {
2470                 rpccli_samr_Close(cli, mem_ctx, &connect_pol);
2471         }
2472
2473         return result;
2474 }
2475
2476
2477 /* Change user password */
2478
2479 static NTSTATUS cmd_samr_chgpasswd2(struct rpc_pipe_client *cli,
2480                                     TALLOC_CTX *mem_ctx,
2481                                     int argc, const char **argv)
2482 {
2483         POLICY_HND connect_pol, domain_pol;
2484         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2485         const char *user, *oldpass, *newpass;
2486         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
2487
2488         if (argc < 3) {
2489                 printf("Usage: %s username oldpass newpass\n", argv[0]);
2490                 return NT_STATUS_INVALID_PARAMETER;
2491         }
2492
2493         user = argv[1];
2494         oldpass = argv[2];
2495         newpass = argv[3];
2496
2497         /* Get sam policy handle */
2498
2499         result = rpccli_try_samr_connects(cli, mem_ctx,
2500                                           MAXIMUM_ALLOWED_ACCESS,
2501                                           &connect_pol);
2502
2503         if (!NT_STATUS_IS_OK(result))
2504                 goto done;
2505
2506         /* Get domain policy handle */
2507
2508         result = rpccli_samr_OpenDomain(cli, mem_ctx,
2509                                         &connect_pol,
2510                                         access_mask,
2511                                         &domain_sid,
2512                                         &domain_pol);
2513
2514         if (!NT_STATUS_IS_OK(result))
2515                 goto done;
2516
2517         /* Change user password */
2518         result = rpccli_samr_chgpasswd_user2(cli, mem_ctx, user, newpass, oldpass);
2519
2520         if (!NT_STATUS_IS_OK(result))
2521                 goto done;
2522
2523         result = rpccli_samr_Close(cli, mem_ctx, &domain_pol);
2524         if (!NT_STATUS_IS_OK(result)) goto done;
2525
2526         result = rpccli_samr_Close(cli, mem_ctx, &connect_pol);
2527         if (!NT_STATUS_IS_OK(result)) goto done;
2528
2529  done:
2530         return result;
2531 }
2532
2533
2534 /* Change user password */
2535
2536 static NTSTATUS cmd_samr_chgpasswd3(struct rpc_pipe_client *cli,
2537                                     TALLOC_CTX *mem_ctx,
2538                                     int argc, const char **argv)
2539 {
2540         POLICY_HND connect_pol, domain_pol;
2541         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
2542         const char *user, *oldpass, *newpass;
2543         uint32 access_mask = MAXIMUM_ALLOWED_ACCESS;
2544         struct samr_DomInfo1 *info = NULL;
2545         struct samr_ChangeReject *reject = NULL;
2546
2547         if (argc < 3) {
2548                 printf("Usage: %s username oldpass newpass\n", argv[0]);
2549                 return NT_STATUS_INVALID_PARAMETER;
2550         }
2551
2552         user = argv[1];
2553         oldpass = argv[2];
2554         newpass = argv[3];
2555
2556         /* Get sam policy handle */
2557
2558         result = rpccli_try_samr_connects(cli, mem_ctx,
2559                                           MAXIMUM_ALLOWED_ACCESS,
2560                                           &connect_pol);
2561
2562         if (!NT_STATUS_IS_OK(result))
2563                 goto done;
2564
2565         /* Get domain policy handle */
2566
2567         result = rpccli_samr_OpenDomain(cli, mem_ctx,
2568                                         &connect_pol,
2569                                         access_mask,
2570                                         &domain_sid,
2571                                         &domain_pol);
2572
2573         if (!NT_STATUS_IS_OK(result))
2574                 goto done;
2575
2576         /* Change user password */
2577         result = rpccli_samr_chgpasswd_user3(cli, mem_ctx,
2578                                              user,
2579                                              newpass,
2580                                              oldpass,
2581                                              &info,
2582                                              &reject);
2583
2584         if (NT_STATUS_EQUAL(result, NT_STATUS_PASSWORD_RESTRICTION)) {
2585
2586                 display_sam_dom_info_1(info);
2587
2588                 switch (reject->reason) {
2589                         case SAMR_REJECT_TOO_SHORT:
2590                                 d_printf("SAMR_REJECT_TOO_SHORT\n");
2591                                 break;
2592                         case SAMR_REJECT_IN_HISTORY:
2593                                 d_printf("SAMR_REJECT_IN_HISTORY\n");
2594                                 break;
2595                         case SAMR_REJECT_COMPLEXITY:
2596                                 d_printf("SAMR_REJECT_COMPLEXITY\n");
2597                                 break;
2598                         case SAMR_REJECT_OTHER:
2599                                 d_printf("SAMR_REJECT_OTHER\n");
2600                                 break;
2601                         default:
2602                                 d_printf("unknown reject reason: %d\n",
2603                                         reject->reason);
2604                                 break;
2605                 }
2606         }
2607
2608         if (!NT_STATUS_IS_OK(result))
2609                 goto done;
2610
2611         result = rpccli_samr_Close(cli, mem_ctx, &domain_pol);
2612         if (!NT_STATUS_IS_OK(result)) goto done;
2613
2614         result = rpccli_samr_Close(cli, mem_ctx, &connect_pol);
2615         if (!NT_STATUS_IS_OK(result)) goto done;
2616
2617  done:
2618         return result;
2619 }
2620
2621 static NTSTATUS cmd_samr_get_dispinfo_idx(struct rpc_pipe_client *cli,
2622                                           TALLOC_CTX *mem_ctx,
2623                                           int argc, const char **argv)
2624 {
2625         NTSTATUS status;
2626         struct policy_handle connect_handle;
2627         struct policy_handle domain_handle;
2628         uint16_t level = 1;
2629         struct lsa_String name;
2630         uint32_t idx = 0;
2631
2632         if (argc < 2 || argc > 3) {
2633                 printf("Usage: %s name level\n", argv[0]);
2634                 return NT_STATUS_INVALID_PARAMETER;
2635         }
2636
2637         init_lsa_String(&name, argv[1]);
2638
2639         if (argc == 3) {
2640                 level = atoi(argv[2]);
2641         }
2642
2643         status = rpccli_try_samr_connects(cli, mem_ctx,
2644                                           SEC_RIGHTS_MAXIMUM_ALLOWED,
2645                                           &connect_handle);
2646
2647         if (!NT_STATUS_IS_OK(status)) {
2648                 goto done;
2649         }
2650
2651         status = rpccli_samr_OpenDomain(cli, mem_ctx,
2652                                         &connect_handle,
2653                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
2654                                         &domain_sid,
2655                                         &domain_handle);
2656
2657         if (!NT_STATUS_IS_OK(status))
2658                 goto done;
2659
2660
2661         status = rpccli_samr_GetDisplayEnumerationIndex(cli, mem_ctx,
2662                                                         &domain_handle,
2663                                                         level,
2664                                                         &name,
2665                                                         &idx);
2666
2667         if (NT_STATUS_IS_OK(status) ||
2668             NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES)) {
2669                 printf("idx: %d (0x%08x)\n", idx, idx);
2670         }
2671  done:
2672
2673         if (is_valid_policy_hnd(&domain_handle)) {
2674                 rpccli_samr_Close(cli, mem_ctx, &domain_handle);
2675         }
2676         if (is_valid_policy_hnd(&connect_handle)) {
2677                 rpccli_samr_Close(cli, mem_ctx, &connect_handle);
2678         }
2679
2680         return status;
2681
2682 }
2683 /* List of commands exported by this module */
2684
2685 struct cmd_set samr_commands[] = {
2686
2687         { "SAMR" },
2688
2689         { "queryuser",  RPC_RTYPE_NTSTATUS, cmd_samr_query_user,                NULL, &ndr_table_samr.syntax_id, NULL,  "Query user info",         "" },
2690         { "querygroup",         RPC_RTYPE_NTSTATUS, cmd_samr_query_group,               NULL, &ndr_table_samr.syntax_id, NULL,  "Query group info",        "" },
2691         { "queryusergroups",    RPC_RTYPE_NTSTATUS, cmd_samr_query_usergroups,  NULL, &ndr_table_samr.syntax_id, NULL,  "Query user groups",       "" },
2692         { "queryuseraliases",   RPC_RTYPE_NTSTATUS, cmd_samr_query_useraliases,         NULL, &ndr_table_samr.syntax_id, NULL,  "Query user aliases",      "" },
2693         { "querygroupmem",      RPC_RTYPE_NTSTATUS, cmd_samr_query_groupmem,    NULL, &ndr_table_samr.syntax_id, NULL,  "Query group membership",  "" },
2694         { "queryaliasmem",      RPC_RTYPE_NTSTATUS, cmd_samr_query_aliasmem,    NULL, &ndr_table_samr.syntax_id, NULL,  "Query alias membership",  "" },
2695         { "queryaliasinfo",     RPC_RTYPE_NTSTATUS, cmd_samr_query_aliasinfo,   NULL, &ndr_table_samr.syntax_id, NULL,  "Query alias info",       "" },
2696         { "deletealias",        RPC_RTYPE_NTSTATUS, cmd_samr_delete_alias,      NULL, &ndr_table_samr.syntax_id, NULL,  "Delete an alias",  "" },
2697         { "querydispinfo",      RPC_RTYPE_NTSTATUS, cmd_samr_query_dispinfo,    NULL, &ndr_table_samr.syntax_id, NULL,  "Query display info",      "" },
2698         { "querydispinfo2",     RPC_RTYPE_NTSTATUS, cmd_samr_query_dispinfo2,   NULL, &ndr_table_samr.syntax_id, NULL,  "Query display info",      "" },
2699         { "querydispinfo3",     RPC_RTYPE_NTSTATUS, cmd_samr_query_dispinfo3,   NULL, &ndr_table_samr.syntax_id, NULL,  "Query display info",      "" },
2700         { "querydominfo",       RPC_RTYPE_NTSTATUS, cmd_samr_query_dominfo,     NULL, &ndr_table_samr.syntax_id, NULL,  "Query domain info",       "" },
2701         { "enumdomusers",       RPC_RTYPE_NTSTATUS, cmd_samr_enum_dom_users,       NULL, &ndr_table_samr.syntax_id, NULL,       "Enumerate domain users", "" },
2702         { "enumdomgroups",      RPC_RTYPE_NTSTATUS, cmd_samr_enum_dom_groups,       NULL, &ndr_table_samr.syntax_id, NULL,      "Enumerate domain groups", "" },
2703         { "enumalsgroups",      RPC_RTYPE_NTSTATUS, cmd_samr_enum_als_groups,       NULL, &ndr_table_samr.syntax_id, NULL,      "Enumerate alias groups",  "" },
2704         { "enumdomains",        RPC_RTYPE_NTSTATUS, cmd_samr_enum_domains,          NULL, &ndr_table_samr.syntax_id, NULL,      "Enumerate domains",  "" },
2705
2706         { "createdomuser",      RPC_RTYPE_NTSTATUS, cmd_samr_create_dom_user,       NULL, &ndr_table_samr.syntax_id, NULL,      "Create domain user",      "" },
2707         { "createdomgroup",     RPC_RTYPE_NTSTATUS, cmd_samr_create_dom_group,      NULL, &ndr_table_samr.syntax_id, NULL,      "Create domain group",     "" },
2708         { "createdomalias",     RPC_RTYPE_NTSTATUS, cmd_samr_create_dom_alias,      NULL, &ndr_table_samr.syntax_id, NULL,      "Create domain alias",     "" },
2709         { "samlookupnames",     RPC_RTYPE_NTSTATUS, cmd_samr_lookup_names,          NULL, &ndr_table_samr.syntax_id, NULL,      "Look up names",           "" },
2710         { "samlookuprids",      RPC_RTYPE_NTSTATUS, cmd_samr_lookup_rids,           NULL, &ndr_table_samr.syntax_id, NULL,      "Look up names",           "" },
2711         { "deletedomgroup",     RPC_RTYPE_NTSTATUS, cmd_samr_delete_dom_group,      NULL, &ndr_table_samr.syntax_id, NULL,      "Delete domain group",     "" },
2712         { "deletedomuser",      RPC_RTYPE_NTSTATUS, cmd_samr_delete_dom_user,       NULL, &ndr_table_samr.syntax_id, NULL,      "Delete domain user",      "" },
2713         { "samquerysecobj",     RPC_RTYPE_NTSTATUS, cmd_samr_query_sec_obj,         NULL, &ndr_table_samr.syntax_id, NULL, "Query SAMR security object",   "" },
2714         { "getdompwinfo",       RPC_RTYPE_NTSTATUS, cmd_samr_get_dom_pwinfo,        NULL, &ndr_table_samr.syntax_id, NULL, "Retrieve domain password info", "" },
2715         { "getusrdompwinfo",    RPC_RTYPE_NTSTATUS, cmd_samr_get_usrdom_pwinfo,     NULL, &ndr_table_samr.syntax_id, NULL, "Retrieve user domain password info", "" },
2716
2717         { "lookupdomain",       RPC_RTYPE_NTSTATUS, cmd_samr_lookup_domain,         NULL, &ndr_table_samr.syntax_id, NULL, "Lookup Domain Name", "" },
2718         { "chgpasswd",          RPC_RTYPE_NTSTATUS, cmd_samr_chgpasswd,             NULL, &ndr_table_samr.syntax_id, NULL, "Change user password", "" },
2719         { "chgpasswd2",         RPC_RTYPE_NTSTATUS, cmd_samr_chgpasswd2,            NULL, &ndr_table_samr.syntax_id, NULL, "Change user password", "" },
2720         { "chgpasswd3",         RPC_RTYPE_NTSTATUS, cmd_samr_chgpasswd3,            NULL, &ndr_table_samr.syntax_id, NULL, "Change user password", "" },
2721         { "getdispinfoidx",     RPC_RTYPE_NTSTATUS, cmd_samr_get_dispinfo_idx,      NULL, &ndr_table_samr.syntax_id, NULL, "Get Display Information Index", "" },
2722         { NULL }
2723 };