Fix a bunch of compiler warnings about wrong format types.
[ira/wip.git] / source3 / utils / net_sam.c
index 851c3e86deee753ac9059bc3cccc30176d125170..6b3f5e572117781bb7c880fa76b214c060748a44 100644 (file)
@@ -5,7 +5,7 @@
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
- *  the Free Software Foundation; either version 2 of the License, or
+ *  the Free Software Foundation; either version 3 of the License, or
  *  (at your option) any later version.
  *
  *  This program is distributed in the hope that it will be useful,
@@ -14,8 +14,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 
@@ -26,8 +25,9 @@
  * Set a user's data
  */
 
-static int net_sam_userset(int argc, const char **argv, const char *field,
-                          BOOL (*fn)(struct samu *, const char *,
+static int net_sam_userset(struct net_context *c, int argc, const char **argv,
+                          const char *field,
+                          bool (*fn)(struct samu *, const char *,
                                      enum pdb_value_state))
 {
        struct samu *sam_acct = NULL;
@@ -36,13 +36,13 @@ static int net_sam_userset(int argc, const char **argv, const char *field,
        const char *dom, *name;
        NTSTATUS status;
 
-       if (argc != 2) {
+       if (argc != 2 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam set %s <user> <value>\n",
                          field);
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &dom, &name, &sid, &type)) {
                d_fprintf(stderr, "Could not find name %s\n", argv[0]);
                return -1;
@@ -82,39 +82,45 @@ static int net_sam_userset(int argc, const char **argv, const char *field,
        return 0;
 }
 
-static int net_sam_set_fullname(int argc, const char **argv)
+static int net_sam_set_fullname(struct net_context *c, int argc,
+                               const char **argv)
 {
-       return net_sam_userset(argc, argv, "fullname",
+       return net_sam_userset(c, argc, argv, "fullname",
                               pdb_set_fullname);
 }
 
-static int net_sam_set_logonscript(int argc, const char **argv)
+static int net_sam_set_logonscript(struct net_context *c, int argc,
+                                  const char **argv)
 {
-       return net_sam_userset(argc, argv, "logonscript",
+       return net_sam_userset(c, argc, argv, "logonscript",
                               pdb_set_logon_script);
 }
 
-static int net_sam_set_profilepath(int argc, const char **argv)
+static int net_sam_set_profilepath(struct net_context *c, int argc,
+                                  const char **argv)
 {
-       return net_sam_userset(argc, argv, "profilepath",
+       return net_sam_userset(c, argc, argv, "profilepath",
                               pdb_set_profile_path);
 }
 
-static int net_sam_set_homedrive(int argc, const char **argv)
+static int net_sam_set_homedrive(struct net_context *c, int argc,
+                                const char **argv)
 {
-       return net_sam_userset(argc, argv, "homedrive",
+       return net_sam_userset(c, argc, argv, "homedrive",
                               pdb_set_dir_drive);
 }
 
-static int net_sam_set_homedir(int argc, const char **argv)
+static int net_sam_set_homedir(struct net_context *c, int argc,
+                              const char **argv)
 {
-       return net_sam_userset(argc, argv, "homedir",
+       return net_sam_userset(c, argc, argv, "homedir",
                               pdb_set_homedir);
 }
 
-static int net_sam_set_workstations(int argc, const char **argv)
+static int net_sam_set_workstations(struct net_context *c, int argc,
+                                   const char **argv)
 {
-       return net_sam_userset(argc, argv, "workstations",
+       return net_sam_userset(c, argc, argv, "workstations",
                               pdb_set_workstations);
 }
 
@@ -122,7 +128,8 @@ static int net_sam_set_workstations(int argc, const char **argv)
  * Set account flags
  */
 
-static int net_sam_set_userflag(int argc, const char **argv, const char *field,
+static int net_sam_set_userflag(struct net_context *c, int argc,
+                               const char **argv, const char *field,
                                uint16 flag)
 {
        struct samu *sam_acct = NULL;
@@ -132,14 +139,15 @@ static int net_sam_set_userflag(int argc, const char **argv, const char *field,
        NTSTATUS status;
        uint16 acct_flags;
 
-       if ((argc != 2) || (!strequal(argv[1], "yes") &&
-                           !strequal(argv[1], "no"))) {
+       if ((argc != 2) || c->display_usage ||
+           (!strequal(argv[1], "yes") &&
+            !strequal(argv[1], "no"))) {
                d_fprintf(stderr, "usage: net sam set %s <user> [yes|no]\n",
                          field);
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &dom, &name, &sid, &type)) {
                d_fprintf(stderr, "Could not find name %s\n", argv[0]);
                return -1;
@@ -185,31 +193,36 @@ static int net_sam_set_userflag(int argc, const char **argv, const char *field,
        return 0;
 }
 
-static int net_sam_set_disabled(int argc, const char **argv)
+static int net_sam_set_disabled(struct net_context *c, int argc,
+                               const char **argv)
 {
-       return net_sam_set_userflag(argc, argv, "disabled", ACB_DISABLED);
+       return net_sam_set_userflag(c, argc, argv, "disabled", ACB_DISABLED);
 }
 
-static int net_sam_set_pwnotreq(int argc, const char **argv)
+static int net_sam_set_pwnotreq(struct net_context *c, int argc,
+                               const char **argv)
 {
-       return net_sam_set_userflag(argc, argv, "pwnotreq", ACB_PWNOTREQ);
+       return net_sam_set_userflag(c, argc, argv, "pwnotreq", ACB_PWNOTREQ);
 }
 
-static int net_sam_set_autolock(int argc, const char **argv)
+static int net_sam_set_autolock(struct net_context *c, int argc,
+                               const char **argv)
 {
-       return net_sam_set_userflag(argc, argv, "autolock", ACB_AUTOLOCK);
+       return net_sam_set_userflag(c, argc, argv, "autolock", ACB_AUTOLOCK);
 }
 
-static int net_sam_set_pwnoexp(int argc, const char **argv)
+static int net_sam_set_pwnoexp(struct net_context *c, int argc,
+                              const char **argv)
 {
-       return net_sam_set_userflag(argc, argv, "pwnoexp", ACB_PWNOEXP);
+       return net_sam_set_userflag(c, argc, argv, "pwnoexp", ACB_PWNOEXP);
 }
 
 /*
  * Set pass last change time, based on force pass change now
  */
 
-static int net_sam_set_pwdmustchangenow(int argc, const char **argv)
+static int net_sam_set_pwdmustchangenow(struct net_context *c, int argc,
+                                       const char **argv)
 {
        struct samu *sam_acct = NULL;
        DOM_SID sid;
@@ -217,13 +230,14 @@ static int net_sam_set_pwdmustchangenow(int argc, const char **argv)
        const char *dom, *name;
        NTSTATUS status;
 
-       if ((argc != 2) || (!strequal(argv[1], "yes") &&
-                           !strequal(argv[1], "no"))) {
+       if ((argc != 2) || c->display_usage ||
+           (!strequal(argv[1], "yes") &&
+            !strequal(argv[1], "no"))) {
                d_fprintf(stderr, "usage: net sam set pwdmustchangenow <user> [yes|no]\n");
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &dom, &name, &sid, &type)) {
                d_fprintf(stderr, "Could not find name %s\n", argv[0]);
                return -1;
@@ -270,7 +284,8 @@ static int net_sam_set_pwdmustchangenow(int argc, const char **argv)
  * Set a user's or a group's comment
  */
 
-static int net_sam_set_comment(int argc, const char **argv)
+static int net_sam_set_comment(struct net_context *c, int argc,
+                              const char **argv)
 {
        GROUP_MAP map;
        DOM_SID sid;
@@ -278,20 +293,20 @@ static int net_sam_set_comment(int argc, const char **argv)
        const char *dom, *name;
        NTSTATUS status;
 
-       if (argc != 2) {
+       if (argc != 2 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam set comment <name> "
                          "<comment>\n");
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &dom, &name, &sid, &type)) {
                d_fprintf(stderr, "Could not find name %s\n", argv[0]);
                return -1;
        }
 
        if (type == SID_NAME_USER) {
-               return net_sam_userset(argc, argv, "comment",
+               return net_sam_userset(c, argc, argv, "comment",
                                       pdb_set_acct_desc);
        }
 
@@ -323,51 +338,124 @@ static int net_sam_set_comment(int argc, const char **argv)
        return 0;
 }
 
-static int net_sam_set(int argc, const char **argv)
+static int net_sam_set(struct net_context *c, int argc, const char **argv)
 {
-       struct functable2 func[] = {
-               { "homedir", net_sam_set_homedir,
-                 "Change a user's home directory" },
-               { "profilepath", net_sam_set_profilepath,
-                 "Change a user's profile path" },
-               { "comment", net_sam_set_comment,
-                 "Change a users or groups description" },
-               { "fullname", net_sam_set_fullname,
-                 "Change a user's full name" },
-               { "logonscript", net_sam_set_logonscript,
-                 "Change a user's logon script" },
-               { "homedrive", net_sam_set_homedrive,
-                 "Change a user's home drive" },
-               { "workstations", net_sam_set_workstations,
-                 "Change a user's allowed workstations" },
-               { "disabled", net_sam_set_disabled,
-                 "Disable/Enable a user" },
-               { "pwnotreq", net_sam_set_pwnotreq,
-                 "Disable/Enable the password not required flag" },
-               { "autolock", net_sam_set_autolock,
-                 "Disable/Enable a user's lockout flag" },
-               { "pwnoexp", net_sam_set_pwnoexp,
-                 "Disable/Enable whether a user's pw does not expire" },
-               { "pwdmustchangenow", net_sam_set_pwdmustchangenow,
-                 "Force users password must change at next logon" },
-               {NULL, NULL}
+       struct functable func[] = {
+               {
+                       "homedir",
+                       net_sam_set_homedir,
+                       NET_TRANSPORT_LOCAL,
+                       "Change a user's home directory",
+                       "net sam set homedir\n"
+                       "    Change a user's home directory"
+               },
+               {
+                       "profilepath",
+                       net_sam_set_profilepath,
+                       NET_TRANSPORT_LOCAL,
+                       "Change a user's profile path",
+                       "net sam set profilepath\n"
+                       "    Change a user's profile path"
+               },
+               {
+                       "comment",
+                       net_sam_set_comment,
+                       NET_TRANSPORT_LOCAL,
+                       "Change a users or groups description",
+                       "net sam set comment\n"
+                       "    Change a users or groups description"
+               },
+               {
+                       "fullname",
+                       net_sam_set_fullname,
+                       NET_TRANSPORT_LOCAL,
+                       "Change a user's full name",
+                       "net sam set fullname\n"
+                       "    Change a user's full name"
+               },
+               {
+                       "logonscript",
+                       net_sam_set_logonscript,
+                       NET_TRANSPORT_LOCAL,
+                       "Change a user's logon script",
+                       "net sam set logonscript\n"
+                       "    Change a user's logon script"
+               },
+               {
+                       "homedrive",
+                       net_sam_set_homedrive,
+                       NET_TRANSPORT_LOCAL,
+                       "Change a user's home drive",
+                       "net sam set homedrive\n"
+                       "    Change a user's home drive"
+               },
+               {
+                       "workstations",
+                       net_sam_set_workstations,
+                       NET_TRANSPORT_LOCAL,
+                       "Change a user's allowed workstations",
+                       "net sam set workstations\n"
+                       "    Change a user's allowed workstations"
+               },
+               {
+                       "disabled",
+                       net_sam_set_disabled,
+                       NET_TRANSPORT_LOCAL,
+                       "Disable/Enable a user",
+                       "net sam set disable\n"
+                       "    Disable/Enable a user"
+               },
+               {
+                       "pwnotreq",
+                       net_sam_set_pwnotreq,
+                       NET_TRANSPORT_LOCAL,
+                       "Disable/Enable the password not required flag",
+                       "net sam set pwnotreq\n"
+                       "    Disable/Enable the password not required flag"
+               },
+               {
+                       "autolock",
+                       net_sam_set_autolock,
+                       NET_TRANSPORT_LOCAL,
+                       "Disable/Enable a user's lockout flag",
+                       "net sam set autolock\n"
+                       "    Disable/Enable a user's lockout flag"
+               },
+               {
+                       "pwnoexp",
+                       net_sam_set_pwnoexp,
+                       NET_TRANSPORT_LOCAL,
+                       "Disable/Enable whether a user's pw does not expire",
+                       "net sam set pwnoexp\n"
+                       "    Disable/Enable whether a user's pw does not expire"
+               },
+               {
+                       "pwdmustchangenow",
+                       net_sam_set_pwdmustchangenow,
+                       NET_TRANSPORT_LOCAL,
+                       "Force users password must change at next logon",
+                       "net sam set pwdmustchangenow\n"
+                       "    Force users password must change at next logon"
+               },
+               {NULL, NULL, 0, NULL, NULL}
        };
 
-       return net_run_function2(argc, argv, "net sam set", func);
+       return net_run_function(c, argc, argv, "net sam set", func);
 }
 
 /*
  * Manage account policies
  */
 
-static int net_sam_policy_set(int argc, const char **argv)
+static int net_sam_policy_set(struct net_context *c, int argc, const char **argv)
 {
        const char *account_policy = NULL;
-       uint32 value, old_value;
+       uint32 value = 0;
+       uint32 old_value = 0;
        int field;
        char *endptr;
 
-        if (argc != 2) {
+        if (argc != 2 || c->display_usage) {
                 d_fprintf(stderr, "usage: net sam policy set " 
                          "\"<account policy>\" <value> \n");
                 return -1;
@@ -410,34 +498,35 @@ static int net_sam_policy_set(int argc, const char **argv)
        if (!pdb_get_account_policy(field, &old_value)) {
                d_fprintf(stderr, "Valid account policy, but unable to fetch "
                          "value!\n");
+       } else {
+               d_printf("Account policy \"%s\" value was: %d\n", account_policy,
+                       old_value);
        }
 
        if (!pdb_set_account_policy(field, value)) {
                d_fprintf(stderr, "Valid account policy, but unable to "
                          "set value!\n");
                return -1;
+       } else {
+               d_printf("Account policy \"%s\" value is now: %d\n", account_policy,
+                       value);
        }
 
-       d_printf("Account policy \"%s\" value was: %d\n", account_policy,
-                old_value);
-
-       d_printf("Account policy \"%s\" value is now: %d\n", account_policy,
-                value);
        return 0;
 }
 
-static int net_sam_policy_show(int argc, const char **argv)
+static int net_sam_policy_show(struct net_context *c, int argc, const char **argv)
 {
        const char *account_policy = NULL;
         uint32 old_value;
         int field;
 
-        if (argc != 1) {
+        if (argc != 1 || c->display_usage) {
                 d_fprintf(stderr, "usage: net sam policy show"
                          " \"<account policy>\" \n");
                 return -1;
         }
-       
+
        account_policy = argv[0];
         field = account_policy_name_to_fieldnum(account_policy);
 
@@ -463,7 +552,7 @@ static int net_sam_policy_show(int argc, const char **argv)
                         "fetch value!\n");
                 return -1;
         }
-       
+
        printf("Account policy \"%s\" description: %s\n",
               account_policy, account_policy_get_desc(field));
         printf("Account policy \"%s\" value is: %d\n", account_policy,
@@ -471,11 +560,19 @@ static int net_sam_policy_show(int argc, const char **argv)
         return 0;
 }
 
-static int net_sam_policy_list(int argc, const char **argv)
+static int net_sam_policy_list(struct net_context *c, int argc, const char **argv)
 {
        const char **names;
        int count;
        int i;
+
+       if (c->display_usage) {
+               d_printf("Usage:\n"
+                        "net sam policy list\n"
+                        "    List account policies\n");
+               return 0;
+       }
+
        account_policy_names_list(&names, &count);
         if (count != 0) {
                d_fprintf(stderr, "Valid account policies "
@@ -488,19 +585,189 @@ static int net_sam_policy_list(int argc, const char **argv)
         return -1;
 }
 
-static int net_sam_policy(int argc, const char **argv)
+static int net_sam_policy(struct net_context *c, int argc, const char **argv)
 {
-        struct functable2 func[] = {
-               { "list", net_sam_policy_list,
-                  "List account policies" },
-                { "show", net_sam_policy_show,
-                  "Show account policies" },
-               { "set", net_sam_policy_set,
-                  "Change account policies" },
-                {NULL, NULL}
+        struct functable func[] = {
+               {
+                       "list",
+                       net_sam_policy_list,
+                       NET_TRANSPORT_LOCAL,
+                       "List account policies",
+                       "net sam policy list\n"
+                       "    List account policies"
+               },
+                {
+                       "show",
+                       net_sam_policy_show,
+                       NET_TRANSPORT_LOCAL,
+                       "Show account policies",
+                       "net sam policy show\n"
+                       "    Show account policies"
+               },
+               {
+                       "set",
+                       net_sam_policy_set,
+                       NET_TRANSPORT_LOCAL,
+                       "Change account policies",
+                       "net sam policy set\n"
+                       "    Change account policies"
+               },
+                {NULL, NULL, 0, NULL, NULL}
         };
 
-        return net_run_function2(argc, argv, "net sam policy", func);
+        return net_run_function(c, argc, argv, "net sam policy", func);
+}
+
+extern PRIVS privs[];
+
+static int net_sam_rights_list(struct net_context *c, int argc,
+                              const char **argv)
+{
+       SE_PRIV mask;
+
+       if (argc > 1 || c->display_usage) {
+               d_fprintf(stderr, "usage: net sam rights list [privilege name]\n");
+               return -1;
+       }
+
+       if (argc == 0) {
+               int i;
+               int num = count_all_privileges();
+
+               for (i=0; i<num; i++) {
+                       d_printf("%s\n", privs[i].name);
+               }
+               return 0;
+       }
+
+       if (se_priv_from_name(argv[0], &mask)) {
+               DOM_SID *sids;
+               int i, num_sids;
+               NTSTATUS status;
+
+               status = privilege_enum_sids(&mask, talloc_tos(),
+                                            &sids, &num_sids);
+               if (!NT_STATUS_IS_OK(status)) {
+                       d_fprintf(stderr, "Could not list rights: %s\n",
+                                 nt_errstr(status));
+                       return -1;
+               }
+
+               for (i=0; i<num_sids; i++) {
+                       const char *dom, *name;
+                       enum lsa_SidType type;
+
+                       if (lookup_sid(talloc_tos(), &sids[i], &dom, &name,
+                                      &type)) {
+                               d_printf("%s\\%s\n", dom, name);
+                       }
+                       else {
+                               d_printf("%s\n", sid_string_tos(&sids[i]));
+                       }
+               }
+               return 0;
+       }
+
+       return -1;
+}
+
+static int net_sam_rights_grant(struct net_context *c, int argc,
+                               const char **argv)
+{
+       DOM_SID sid;
+       enum lsa_SidType type;
+       const char *dom, *name;
+       SE_PRIV mask;
+
+       if (argc != 2 || c->display_usage) {
+               d_fprintf(stderr, "usage: net sam rights grant <name> "
+                         "<right>\n");
+               return -1;
+       }
+
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
+                        &dom, &name, &sid, &type)) {
+               d_fprintf(stderr, "Could not find name %s\n", argv[0]);
+               return -1;
+       }
+
+       if (!se_priv_from_name(argv[1], &mask)) {
+               d_fprintf(stderr, "%s unknown\n", argv[1]);
+               return -1;
+       }
+
+       if (!grant_privilege(&sid, &mask)) {
+               d_fprintf(stderr, "Could not grant privilege\n");
+               return -1;
+       }
+
+       d_printf("Granted %s to %s\\%s\n", argv[1], dom, name);
+       return 0;
+}
+
+static int net_sam_rights_revoke(struct net_context *c, int argc, const char **argv)
+{
+       DOM_SID sid;
+       enum lsa_SidType type;
+       const char *dom, *name;
+       SE_PRIV mask;
+
+       if (argc != 2 || c->display_usage) {
+               d_fprintf(stderr, "usage: net sam rights revoke <name> "
+                         "<right>\n");
+               return -1;
+       }
+
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
+                        &dom, &name, &sid, &type)) {
+               d_fprintf(stderr, "Could not find name %s\n", argv[0]);
+               return -1;
+       }
+
+       if (!se_priv_from_name(argv[1], &mask)) {
+               d_fprintf(stderr, "%s unknown\n", argv[1]);
+               return -1;
+       }
+
+       if (!revoke_privilege(&sid, &mask)) {
+               d_fprintf(stderr, "Could not revoke privilege\n");
+               return -1;
+       }
+
+       d_printf("Revoked %s from %s\\%s\n", argv[1], dom, name);
+       return 0;
+}
+
+static int net_sam_rights(struct net_context *c, int argc, const char **argv)
+{
+       struct functable func[] = {
+               {
+                       "list",
+                       net_sam_rights_list,
+                       NET_TRANSPORT_LOCAL,
+                       "List possible user rights",
+                       "net sam rights list\n"
+                       "    List possible user rights"
+               },
+               {
+                       "grant",
+                       net_sam_rights_grant,
+                       NET_TRANSPORT_LOCAL,
+                       "Grant a right",
+                       "net sam rights grant\n"
+                       "    Grant a right"
+               },
+               {
+                       "revoke",
+                       net_sam_rights_revoke,
+                       NET_TRANSPORT_LOCAL,
+                       "Revoke a right",
+                       "net sam rights revoke\n"
+                       "    Revoke a right"
+               },
+               {NULL, NULL, 0, NULL, NULL}
+       };
+        return net_run_function(c, argc, argv, "net sam rights", func);
 }
 
 /*
@@ -521,18 +788,18 @@ static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *pmap)
        map.gid = grp->gr_gid;
        grpname = grp->gr_name;
 
-       if (lookup_name(tmp_talloc_ctx(), grpname, LOOKUP_NAME_ISOLATED,
+       if (lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
                        &dom, &name, NULL, NULL)) {
 
                const char *tmp = talloc_asprintf(
-                       tmp_talloc_ctx(), "Unix Group %s", grp->gr_name);
+                       talloc_tos(), "Unix Group %s", grp->gr_name);
 
                DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
                          grpname, dom, name, tmp));
                grpname = tmp;
        }
 
-       if (lookup_name(tmp_talloc_ctx(), grpname, LOOKUP_NAME_ISOLATED,
+       if (lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
                        NULL, NULL, NULL, NULL)) {
                DEBUG(3, ("\"%s\" exists, can't map it\n", grp->gr_name));
                return NT_STATUS_GROUP_EXISTS;
@@ -552,7 +819,7 @@ static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *pmap)
 
        sid_compose(&map.sid, get_global_sam_sid(), rid);
        map.sid_name_use = SID_NAME_DOM_GRP;
-       fstrcpy(map.comment, talloc_asprintf(tmp_talloc_ctx(), "Unix Group %s",
+       fstrcpy(map.comment, talloc_asprintf(talloc_tos(), "Unix Group %s",
                                             grp->gr_name));
 
        status = pdb_add_group_mapping_entry(&map);
@@ -562,13 +829,13 @@ static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *pmap)
        return status;
 }
 
-static int net_sam_mapunixgroup(int argc, const char **argv)
+static int net_sam_mapunixgroup(struct net_context *c, int argc, const char **argv)
 {
        NTSTATUS status;
        GROUP_MAP map;
        struct group *grp;
 
-       if (argc != 1) {
+       if (argc != 1 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam mapunixgroup <name>\n");
                return -1;
        }
@@ -588,7 +855,7 @@ static int net_sam_mapunixgroup(int argc, const char **argv)
        }
 
        d_printf("Mapped unix group %s to SID %s\n", argv[0],
-                sid_string_static(&map.sid));
+                sid_string_tos(&map.sid));
 
        return 0;
 }
@@ -607,7 +874,7 @@ static NTSTATUS unmap_unix_group(const struct group *grp, GROUP_MAP *pmap)
         map.gid = grp->gr_gid;
         grpname = grp->gr_name;
 
-        if (!lookup_name(tmp_talloc_ctx(), grpname, LOOKUP_NAME_ISOLATED,
+        if (!lookup_name(talloc_tos(), grpname, LOOKUP_NAME_LOCAL,
                         NULL, NULL, NULL, NULL)) {
                 DEBUG(3, ("\"%s\" does not exist, can't unmap it\n", grp->gr_name));
                 return NT_STATUS_NO_SUCH_GROUP;
@@ -624,13 +891,13 @@ static NTSTATUS unmap_unix_group(const struct group *grp, GROUP_MAP *pmap)
         return status;
 }
 
-static int net_sam_unmapunixgroup(int argc, const char **argv)
+static int net_sam_unmapunixgroup(struct net_context *c, int argc, const char **argv)
 {
        NTSTATUS status;
        GROUP_MAP map;
        struct group *grp;
 
-       if (argc != 1) {
+       if (argc != 1 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam unmapunixgroup <name>\n");
                return -1;
        }
@@ -658,12 +925,12 @@ static int net_sam_unmapunixgroup(int argc, const char **argv)
  * Create a local group
  */
 
-static int net_sam_createlocalgroup(int argc, const char **argv)
+static int net_sam_createlocalgroup(struct net_context *c, int argc, const char **argv)
 {
        NTSTATUS status;
        uint32 rid;
 
-       if (argc != 1) {
+       if (argc != 1 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam createlocalgroup <name>\n");
                return -1;
        }
@@ -691,19 +958,19 @@ static int net_sam_createlocalgroup(int argc, const char **argv)
  * Delete a local group
  */
 
-static int net_sam_deletelocalgroup(int argc, const char **argv)
+static int net_sam_deletelocalgroup(struct net_context *c, int argc, const char **argv)
 {
        DOM_SID sid;
         enum lsa_SidType type;
         const char *dom, *name;
        NTSTATUS status;
 
-       if (argc != 1) {
+       if (argc != 1 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam deletelocalgroup <name>\n");
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &dom, &name, &sid, &type)) {
                d_fprintf(stderr, "Could not find %s.\n", argv[0]);
                return -1;
@@ -729,10 +996,10 @@ static int net_sam_deletelocalgroup(int argc, const char **argv)
 }
 
 /*
- * Create a local group
+ * Create a builtin group
  */
 
-static int net_sam_createbuiltingroup(int argc, const char **argv)
+static int net_sam_createbuiltingroup(struct net_context *c, int argc, const char **argv)
 {
        NTSTATUS status;
        uint32 rid;
@@ -740,28 +1007,28 @@ static int net_sam_createbuiltingroup(int argc, const char **argv)
        fstring groupname;
        DOM_SID sid;
 
-       if (argc != 1) {
+       if (argc != 1 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam createbuiltingroup <name>\n");
                return -1;
        }
 
        if (!winbind_ping()) {
-               d_fprintf(stderr, "winbind seems not to run. createlocalgroup "
+               d_fprintf(stderr, "winbind seems not to run. createbuiltingroup "
                          "only works when winbind runs.\n");
                return -1;
        }
 
        /* validate the name and get the group */
-       
+
        fstrcpy( groupname, "BUILTIN\\" );
        fstrcat( groupname, argv[0] );
-       
-       if ( !lookup_name(tmp_talloc_ctx(), groupname, LOOKUP_NAME_ALL, NULL,
+
+       if ( !lookup_name(talloc_tos(), groupname, LOOKUP_NAME_ALL, NULL,
                          NULL, &sid, &type)) {
                d_fprintf(stderr, "%s is not a BUILTIN group\n", argv[0]);
                return -1;
        }
-       
+
        if ( !sid_peek_rid( &sid, &rid ) ) {
                d_fprintf(stderr, "Failed to get RID for %s\n", argv[0]);
                return -1;
@@ -784,19 +1051,19 @@ static int net_sam_createbuiltingroup(int argc, const char **argv)
  * Add a group member
  */
 
-static int net_sam_addmem(int argc, const char **argv)
+static int net_sam_addmem(struct net_context *c, int argc, const char **argv)
 {
        const char *groupdomain, *groupname, *memberdomain, *membername;
        DOM_SID group, member;
        enum lsa_SidType grouptype, membertype;
        NTSTATUS status;
 
-       if (argc != 2) {
+       if (argc != 2 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam addmem <group> <member>\n");
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &groupdomain, &groupname, &group, &grouptype)) {
                d_fprintf(stderr, "Could not find group %s\n", argv[0]);
                return -1;
@@ -804,7 +1071,7 @@ static int net_sam_addmem(int argc, const char **argv)
 
        /* check to see if the member to be added is a name or a SID */
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[1], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
                         &memberdomain, &membername, &member, &membertype))
        {
                /* try it as a SID */
@@ -814,8 +1081,8 @@ static int net_sam_addmem(int argc, const char **argv)
                        return -1;
                }
 
-               if ( !lookup_sid(tmp_talloc_ctx(), &member, &memberdomain, 
-                       &membername, &membertype) ) 
+               if ( !lookup_sid(talloc_tos(), &member, &memberdomain,
+                       &membername, &membertype) )
                {
                        d_fprintf(stderr, "Could not resolve SID %s\n", argv[1]);
                        return -1;
@@ -845,7 +1112,7 @@ static int net_sam_addmem(int argc, const char **argv)
                return -1;
        }
 
-       d_printf("Added %s\\%s to %s\\%s\n", memberdomain, membername, 
+       d_printf("Added %s\\%s to %s\\%s\n", memberdomain, membername,
                groupdomain, groupname);
 
        return 0;
@@ -855,7 +1122,7 @@ static int net_sam_addmem(int argc, const char **argv)
  * Delete a group member
  */
 
-static int net_sam_delmem(int argc, const char **argv)
+static int net_sam_delmem(struct net_context *c, int argc, const char **argv)
 {
        const char *groupdomain, *groupname;
        const char *memberdomain = NULL;
@@ -864,18 +1131,18 @@ static int net_sam_delmem(int argc, const char **argv)
        enum lsa_SidType grouptype;
        NTSTATUS status;
 
-       if (argc != 2) {
+       if (argc != 2 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam delmem <group> <member>\n");
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &groupdomain, &groupname, &group, &grouptype)) {
                d_fprintf(stderr, "Could not find group %s\n", argv[0]);
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[1], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
                         &memberdomain, &membername, &member, NULL)) {
                if (!string_to_sid(&member, argv[1])) {
                        d_fprintf(stderr, "Could not find member %s\n",
@@ -905,7 +1172,7 @@ static int net_sam_delmem(int argc, const char **argv)
                         memberdomain, membername, groupdomain, groupname);
        } else {
                d_printf("Deleted %s from %s\\%s\n",
-                        sid_string_static(&member), groupdomain, groupname);
+                        sid_string_tos(&member), groupdomain, groupname);
        }
 
        return 0;
@@ -915,19 +1182,19 @@ static int net_sam_delmem(int argc, const char **argv)
  * List group members
  */
 
-static int net_sam_listmem(int argc, const char **argv)
+static int net_sam_listmem(struct net_context *c, int argc, const char **argv)
 {
        const char *groupdomain, *groupname;
        DOM_SID group;
        enum lsa_SidType grouptype;
        NTSTATUS status;
 
-       if (argc != 1) {
+       if (argc != 1 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam listmem <group>\n");
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &groupdomain, &groupname, &group, &grouptype)) {
                d_fprintf(stderr, "Could not find group %s\n", argv[0]);
                return -1;
@@ -937,7 +1204,7 @@ static int net_sam_listmem(int argc, const char **argv)
            (grouptype == SID_NAME_WKN_GRP)) {
                DOM_SID *members = NULL;
                size_t i, num_members = 0;
-               
+
                status = pdb_enum_aliasmem(&group, &members, &num_members);
 
                if (!NT_STATUS_IS_OK(status)) {
@@ -950,12 +1217,11 @@ static int net_sam_listmem(int argc, const char **argv)
                         (unsigned int)num_members);
                for (i=0; i<num_members; i++) {
                        const char *dom, *name;
-                       if (lookup_sid(tmp_talloc_ctx(), &members[i],
+                       if (lookup_sid(talloc_tos(), &members[i],
                                       &dom, &name, NULL)) {
                                d_printf(" %s\\%s\n", dom, name);
                        } else {
-                               d_printf(" %s\n",
-                                        sid_string_static(&members[i]));
+                               d_printf(" %s\n", sid_string_tos(&members[i]));
                        }
                }
 
@@ -972,12 +1238,12 @@ static int net_sam_listmem(int argc, const char **argv)
 /*
  * Do the listing
  */
-static int net_sam_do_list(int argc, const char **argv,
+static int net_sam_do_list(struct net_context *c, int argc, const char **argv,
                           struct pdb_search *search, const char *what)
 {
-       BOOL verbose = (argc == 1);
+       bool verbose = (argc == 1);
 
-       if ((argc > 1) ||
+       if ((argc > 1) || c->display_usage ||
            ((argc == 1) && !strequal(argv[0], "verbose"))) {
                d_fprintf(stderr, "usage: net sam list %s [verbose]\n", what);
                return -1;
@@ -988,7 +1254,7 @@ static int net_sam_do_list(int argc, const char **argv,
                return -1;
        }
 
-       while (True) {
+       while (true) {
                struct samr_displayentry entry;
                if (!search->next_entry(search, &entry)) {
                        break;
@@ -1003,39 +1269,48 @@ static int net_sam_do_list(int argc, const char **argv,
                }
        }
 
-       search->search_end(search);
+       TALLOC_FREE(search);
        return 0;
 }
 
-static int net_sam_list_users(int argc, const char **argv)
+static int net_sam_list_users(struct net_context *c, int argc,
+                             const char **argv)
 {
-       return net_sam_do_list(argc, argv, pdb_search_users(ACB_NORMAL),
+       return net_sam_do_list(c, argc, argv,
+                              pdb_search_users(talloc_tos(), ACB_NORMAL),
                               "users");
 }
 
-static int net_sam_list_groups(int argc, const char **argv)
+static int net_sam_list_groups(struct net_context *c, int argc,
+                              const char **argv)
 {
-       return net_sam_do_list(argc, argv, pdb_search_groups(), "groups");
+       return net_sam_do_list(c, argc, argv, pdb_search_groups(talloc_tos()),
+                              "groups");
 }
 
-static int net_sam_list_localgroups(int argc, const char **argv)
+static int net_sam_list_localgroups(struct net_context *c, int argc,
+                                   const char **argv)
 {
-       return net_sam_do_list(argc, argv,
-                              pdb_search_aliases(get_global_sam_sid()),
+       return net_sam_do_list(c, argc, argv,
+                              pdb_search_aliases(talloc_tos(),
+                                                 get_global_sam_sid()),
                               "localgroups");
 }
 
-static int net_sam_list_builtin(int argc, const char **argv)
+static int net_sam_list_builtin(struct net_context *c, int argc,
+                               const char **argv)
 {
-       return net_sam_do_list(argc, argv,
-                              pdb_search_aliases(&global_sid_Builtin),
+       return net_sam_do_list(c, argc, argv,
+                              pdb_search_aliases(talloc_tos(),
+                                                 &global_sid_Builtin),
                               "builtin");
 }
 
-static int net_sam_list_workstations(int argc, const char **argv)
+static int net_sam_list_workstations(struct net_context *c, int argc,
+                                    const char **argv)
 {
-       return net_sam_do_list(argc, argv,
-                              pdb_search_users(ACB_WSTRUST),
+       return net_sam_do_list(c, argc, argv,
+                              pdb_search_users(talloc_tos(), ACB_WSTRUST),
                               "workstations");
 }
 
@@ -1043,48 +1318,78 @@ static int net_sam_list_workstations(int argc, const char **argv)
  * List stuff
  */
 
-static int net_sam_list(int argc, const char **argv)
+static int net_sam_list(struct net_context *c, int argc, const char **argv)
 {
-       struct functable2 func[] = {
-               { "users", net_sam_list_users,
-                 "List SAM users" },
-               { "groups", net_sam_list_groups,
-                 "List SAM groups" },
-               { "localgroups", net_sam_list_localgroups,
-                 "List SAM local groups" },
-               { "builtin", net_sam_list_builtin,
-                 "List builtin groups" },
-               { "workstations", net_sam_list_workstations,
-                 "List domain member workstations" },
-               {NULL, NULL}
+       struct functable func[] = {
+               {
+                       "users",
+                       net_sam_list_users,
+                       NET_TRANSPORT_LOCAL,
+                       "List SAM users",
+                       "net sam list users\n"
+                       "    List SAM users"
+               },
+               {
+                       "groups",
+                       net_sam_list_groups,
+                       NET_TRANSPORT_LOCAL,
+                       "List SAM groups",
+                       "net sam list groups\n"
+                       "    List SAM groups"
+               },
+               {
+                       "localgroups",
+                       net_sam_list_localgroups,
+                       NET_TRANSPORT_LOCAL,
+                       "List SAM local groups",
+                       "net sam list localgroups\n"
+                       "    List SAM local groups"
+               },
+               {
+                       "builtin",
+                       net_sam_list_builtin,
+                       NET_TRANSPORT_LOCAL,
+                       "List builtin groups",
+                       "net sam list builtin\n"
+                       "    List builtin groups"
+               },
+               {
+                       "workstations",
+                       net_sam_list_workstations,
+                       NET_TRANSPORT_LOCAL,
+                       "List domain member workstations",
+                       "net sam list workstations\n"
+                       "    List domain member workstations"
+               },
+               {NULL, NULL, 0, NULL, NULL}
        };
 
-       return net_run_function2(argc, argv, "net sam list", func);
+       return net_run_function(c, argc, argv, "net sam list", func);
 }
 
 /*
  * Show details of SAM entries
  */
 
-static int net_sam_show(int argc, const char **argv)
+static int net_sam_show(struct net_context *c, int argc, const char **argv)
 {
        DOM_SID sid;
        enum lsa_SidType type;
        const char *dom, *name;
 
-       if (argc != 1) {
+       if (argc != 1 || c->display_usage) {
                d_fprintf(stderr, "usage: net sam show <name>\n");
                return -1;
        }
 
-       if (!lookup_name(tmp_talloc_ctx(), argv[0], LOOKUP_NAME_ISOLATED,
+       if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
                         &dom, &name, &sid, &type)) {
                d_fprintf(stderr, "Could not find name %s\n", argv[0]);
                return -1;
        }
 
        d_printf("%s\\%s is a %s with SID %s\n", dom, name,
-                sid_type_lookup(type), sid_string_static(&sid));
+                sid_type_lookup(type), sid_string_tos(&sid));
 
        return 0;
 }
@@ -1096,7 +1401,7 @@ static int net_sam_show(int argc, const char **argv)
  * if ldapsam:editposix is enabled
  */
 
-static int net_sam_provision(int argc, const char **argv)
+static int net_sam_provision(struct net_context *c, int argc, const char **argv)
 {
        TALLOC_CTX *tc;
        char *ldap_bk;
@@ -1110,6 +1415,13 @@ static int net_sam_provision(int argc, const char **argv)
        struct samu *samuser;
        struct passwd *pwd;
 
+       if (c->display_usage) {
+               d_printf("Usage:\n"
+                        "net sam provision\n"
+                        "    Init an LDAP tree with default users/groups\n");
+               return 0;
+       }
+
        tc = talloc_new(NULL);
        if (!tc) {
                d_fprintf(stderr, "Out of Memory!\n");
@@ -1135,8 +1447,8 @@ static int net_sam_provision(int argc, const char **argv)
                goto failed;
        }
        
-       if (!lp_parm_bool(-1, "ldapsam", "trusted", False) ||
-           !lp_parm_bool(-1, "ldapsam", "editposix", False)) {
+       if (!lp_parm_bool(-1, "ldapsam", "trusted", false) ||
+           !lp_parm_bool(-1, "ldapsam", "editposix", false)) {
 
                d_fprintf(stderr, "Provisioning works only if ldapsam:trusted"
                                  " and ldapsam:editposix are enabled.\n");
@@ -1178,7 +1490,7 @@ static int net_sam_provision(int argc, const char **argv)
                uname = talloc_strdup(tc, "domusers");
                wname = talloc_strdup(tc, "Domain Users");
                dn = talloc_asprintf(tc, "cn=%s,%s", "domusers", lp_ldap_group_suffix());
-               gidstr = talloc_asprintf(tc, "%d", domusers_gid);
+               gidstr = talloc_asprintf(tc, "%u", (unsigned int)domusers_gid);
                gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
 
                if (!uname || !wname || !dn || !gidstr || !gtype) {
@@ -1186,12 +1498,13 @@ static int net_sam_provision(int argc, const char **argv)
                        goto failed;
                }
 
-               smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_POSIXGROUP);
+               smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
-               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", sid_string_static(&gsid));
+               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
+                               sid_string_talloc(tc, &gsid));
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
 
                talloc_autofree_ldapmod(tc, mods);
@@ -1232,7 +1545,7 @@ domu_done:
                uname = talloc_strdup(tc, "domadmins");
                wname = talloc_strdup(tc, "Domain Admins");
                dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins", lp_ldap_group_suffix());
-               gidstr = talloc_asprintf(tc, "%d", domadmins_gid);
+               gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
                gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
 
                if (!uname || !wname || !dn || !gidstr || !gtype) {
@@ -1240,12 +1553,13 @@ domu_done:
                        goto failed;
                }
 
-               smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_POSIXGROUP);
+               smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
-               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", sid_string_static(&gsid));
+               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
+                               sid_string_talloc(tc, &gsid));
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
 
                talloc_autofree_ldapmod(tc, mods);
@@ -1294,8 +1608,8 @@ doma_done:
                }
                name = talloc_strdup(tc, "Administrator");
                dn = talloc_asprintf(tc, "uid=Administrator,%s", lp_ldap_user_suffix());
-               uidstr = talloc_asprintf(tc, "%d", uid);
-               gidstr = talloc_asprintf(tc, "%d", domadmins_gid);
+               uidstr = talloc_asprintf(tc, "%u", (unsigned int)uid);
+               gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
                dir = talloc_sub_specified(tc, lp_template_homedir(),
                                                "Administrator",
                                                get_global_sam_name(),
@@ -1322,7 +1636,8 @@ doma_done:
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", dir);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
-               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID", sid_string_static(&sid));
+               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
+                               sid_string_talloc(tc, &sid));
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
                                pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
                                NEW_PW_FORMAT_SPACE_PADDED_LEN));
@@ -1384,8 +1699,8 @@ doma_done:
                sid_compose(&sid, get_global_sam_sid(), DOMAIN_USER_RID_GUEST);
 
                dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name, lp_ldap_user_suffix ());
-               uidstr = talloc_asprintf(tc, "%d", pwd->pw_uid);
-               gidstr = talloc_asprintf(tc, "%d", pwd->pw_gid);
+               uidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_uid);
+               gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
                if (!dn || !uidstr || !gidstr) {
                        d_fprintf(stderr, "Out of Memory!\n");
                        goto failed;
@@ -1405,7 +1720,8 @@ doma_done:
                if ((pwd->pw_shell != NULL) && (pwd->pw_shell[0] != '\0')) {
                        smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", pwd->pw_shell);
                }
-               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID", sid_string_static(&sid));
+               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
+                               sid_string_talloc(tc, &sid));
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
                                pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
                                NEW_PW_FORMAT_SPACE_PADDED_LEN));
@@ -1423,7 +1739,7 @@ doma_done:
 
        d_printf("Checking Guest's group.\n");
 
-       pwd = getpwnam_alloc(NULL, lp_guestaccount());
+       pwd = getpwnam_alloc(talloc_autofree_context(), lp_guestaccount());
        if (!pwd) {
                d_fprintf(stderr, "Failed to find just created Guest account!\n"
                                  "   Is nss properly configured?!\n");
@@ -1449,7 +1765,7 @@ doma_done:
                uname = talloc_strdup(tc, "domguests");
                wname = talloc_strdup(tc, "Domain Guests");
                dn = talloc_asprintf(tc, "cn=%s,%s", "domguests", lp_ldap_group_suffix());
-               gidstr = talloc_asprintf(tc, "%d", pwd->pw_gid);
+               gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
                gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
 
                if (!uname || !wname || !dn || !gidstr || !gtype) {
@@ -1459,12 +1775,13 @@ doma_done:
 
                sid_compose(&gsid, get_global_sam_sid(), DOMAIN_GROUP_RID_GUESTS);
 
-               smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectclass", LDAP_OBJ_POSIXGROUP);
+               smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
-               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid", sid_string_static(&gsid));
+               smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
+                               sid_string_talloc(tc, &gsid));
                smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
 
                talloc_autofree_ldapmod(tc, mods);
@@ -1493,47 +1810,133 @@ failed:
 /***********************************************************
  migrated functionality from smbgroupedit
  **********************************************************/
-int net_sam(int argc, const char **argv)
+int net_sam(struct net_context *c, int argc, const char **argv)
 {
-       struct functable2 func[] = {
-               { "createbuiltingroup", net_sam_createbuiltingroup,
-                 "Create a new BUILTIN group" },
-               { "createlocalgroup", net_sam_createlocalgroup,
-                 "Create a new local group" },
-               { "deletelocalgroup", net_sam_deletelocalgroup,
-                 "Delete an existing local group" },
-               { "mapunixgroup", net_sam_mapunixgroup,
-                 "Map a unix group to a domain group" },
-               { "unmapunixgroup", net_sam_unmapunixgroup,
-                 "Remove a group mapping of an unix group to a domain group" },
-               { "addmem", net_sam_addmem,
-                 "Add a member to a group" },
-               { "delmem", net_sam_delmem,
-                 "Delete a member from a group" },
-               { "listmem", net_sam_listmem,
-                 "List group members" },
-               { "list", net_sam_list,
-                 "List users, groups and local groups" },
-               { "show", net_sam_show,
-                 "Show details of a SAM entry" },
-               { "set", net_sam_set,
-                 "Set details of a SAM account" },
-               { "policy", net_sam_policy,
-                 "Set account policies" },
+       struct functable func[] = {
+               {
+                       "createbuiltingroup",
+                       net_sam_createbuiltingroup,
+                       NET_TRANSPORT_LOCAL,
+                       "Create a new BUILTIN group",
+                       "net sam createbuiltingroup\n"
+                       "    Create a new BUILTIN group"
+               },
+               {
+                       "createlocalgroup",
+                       net_sam_createlocalgroup,
+                       NET_TRANSPORT_LOCAL,
+                       "Create a new local group",
+                       "net sam createlocalgroup\n"
+                       "    Create a new local group"
+               },
+               {
+                       "deletelocalgroup",
+                       net_sam_deletelocalgroup,
+                       NET_TRANSPORT_LOCAL,
+                       "Delete an existing local group",
+                       "net sam deletelocalgroup\n"
+                       "    Delete an existing local group"
+               },
+               {
+                       "mapunixgroup",
+                       net_sam_mapunixgroup,
+                       NET_TRANSPORT_LOCAL,
+                       "Map a unix group to a domain group",
+                       "net sam mapunixgroup\n"
+                       "    Map a unix group to a domain group"
+               },
+               {
+                       "unmapunixgroup",
+                       net_sam_unmapunixgroup,
+                       NET_TRANSPORT_LOCAL,
+                       "Remove a group mapping of an unix group to a domain "
+                       "group",
+                       "net sam unmapunixgroup\n"
+                       "    Remove a group mapping of an unix group to a "
+                       "domain group"
+               },
+               {
+                       "addmem",
+                       net_sam_addmem,
+                       NET_TRANSPORT_LOCAL,
+                       "Add a member to a group",
+                       "net sam addmem\n"
+                       "    Add a member to a group"
+               },
+               {
+                       "delmem",
+                       net_sam_delmem,
+                       NET_TRANSPORT_LOCAL,
+                       "Delete a member from a group",
+                       "net sam delmem\n"
+                       "    Delete a member from a group"
+               },
+               {
+                       "listmem",
+                       net_sam_listmem,
+                       NET_TRANSPORT_LOCAL,
+                       "List group members",
+                       "net sam listmem\n"
+                       "    List group members"
+               },
+               {
+                       "list",
+                       net_sam_list,
+                       NET_TRANSPORT_LOCAL,
+                       "List users, groups and local groups",
+                       "net sam list\n"
+                       "    List users, groups and local groups"
+               },
+               {
+                       "show",
+                       net_sam_show,
+                       NET_TRANSPORT_LOCAL,
+                       "Show details of a SAM entry",
+                       "net sam show\n"
+                       "    Show details of a SAM entry"
+               },
+               {
+                       "set",
+                       net_sam_set,
+                       NET_TRANSPORT_LOCAL,
+                       "Set details of a SAM account",
+                       "net sam set\n"
+                       "    Set details of a SAM account"
+               },
+               {
+                       "policy",
+                       net_sam_policy,
+                       NET_TRANSPORT_LOCAL,
+                       "Set account policies",
+                       "net sam policy\n"
+                       "    Set account policies"
+               },
+               {
+                       "rights",
+                       net_sam_rights,
+                       NET_TRANSPORT_LOCAL,
+                       "Manipulate user privileges",
+                       "net sam rights\n"
+                       "    Manipulate user privileges"
+               },
 #ifdef HAVE_LDAP
-               { "provision", net_sam_provision,
-                 "Provision a clean User Database" },
+               {
+                       "provision",
+                       net_sam_provision,
+                       NET_TRANSPORT_LOCAL,
+                       "Provision a clean user database",
+                       "net sam privison\n"
+                       "    Provision a clear user database"
+               },
 #endif
-               { NULL, NULL, NULL }
+               {NULL, NULL, 0, NULL, NULL}
        };
 
-       /* we shouldn't have silly checks like this */
        if (getuid() != 0) {
-               d_fprintf(stderr, "You must be root to edit the SAM "
-                         "directly.\n");
-               return -1;
+               d_fprintf(stderr, "You are not root, most things won't "
+                         "work\n");
        }
-       
-       return net_run_function2(argc, argv, "net sam", func);
+
+       return net_run_function(c, argc, argv, "net sam", func);
 }