source3/rpcclient/cmd_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4
   5    Copyright (C) Tim Potter              2000
   6    Copyright (C) Rafal Szczesniak        2002
   7    Copyright (C) Guenther Deschner       2008
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpcclient.h"
  25 #include "../libcli/auth/libcli_auth.h"
  26 #include "../librpc/gen_ndr/ndr_lsa.h"
  27 #include "../librpc/gen_ndr/cli_lsa.h"
  28 #include "rpc_client/cli_lsarpc.h"
  29 #include "rpc_client/init_lsa.h"
  30
  31 /* useful function to allow entering a name instead of a SID and
  32  * looking it up automatically */
  33 static NTSTATUS name_to_sid(struct rpc_pipe_client *cli,
  34                             TALLOC_CTX *mem_ctx,
  35                             struct dom_sid *sid, const char *name)
  36 {
  37         struct policy_handle pol;
  38         enum lsa_SidType *sid_types;
  39         NTSTATUS result;
  40         struct dom_sid *sids;
  41
  42         /* maybe its a raw SID */
  43         if (strncmp(name, "S-", 2) == 0 &&
  44             string_to_sid(sid, name)) {
  45                 return NT_STATUS_OK;
  46         }
  47
  48         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
  49                                      SEC_FLAG_MAXIMUM_ALLOWED,
  50                                      &pol);
  51         if (!NT_STATUS_IS_OK(result))
  52                 goto done;
  53
  54         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, NULL, 1, &sids, &sid_types);
  55         if (!NT_STATUS_IS_OK(result))
  56                 goto done;
  57
  58         rpccli_lsa_Close(cli, mem_ctx, &pol);
  59
  60         *sid = sids[0];
  61
  62 done:
  63         return result;
  64 }
  65
  66 static void display_query_info_1(struct lsa_AuditLogInfo *r)
  67 {
  68         d_printf("percent_full:\t%d\n", r->percent_full);
  69         d_printf("maximum_log_size:\t%d\n", r->maximum_log_size);
  70         d_printf("retention_time:\t%lld\n", (long long)r->retention_time);
  71         d_printf("shutdown_in_progress:\t%d\n", r->shutdown_in_progress);
  72         d_printf("time_to_shutdown:\t%lld\n", (long long)r->time_to_shutdown);
  73         d_printf("next_audit_record:\t%d\n", r->next_audit_record);
  74 }
  75
  76 static void display_query_info_2(struct lsa_AuditEventsInfo *r)
  77 {
  78         int i;
  79         d_printf("Auditing enabled:\t%d\n", r->auditing_mode);
  80         d_printf("Auditing categories:\t%d\n", r->count);
  81         d_printf("Auditsettings:\n");
  82         for (i=0; i<r->count; i++) {
  83                 const char *val = audit_policy_str(talloc_tos(), r->settings[i]);
  84                 const char *policy = audit_description_str(i);
  85                 d_printf("%s:\t%s\n", policy, val);
  86         }
  87 }
  88
  89 static void display_query_info_3(struct lsa_DomainInfo *r)
  90 {
  91         d_printf("Domain Name: %s\n", r->name.string);
  92         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
  93 }
  94
  95 static void display_query_info_5(struct lsa_DomainInfo *r)
  96 {
  97         d_printf("Domain Name: %s\n", r->name.string);
  98         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
  99 }
 100
 101 static void display_query_info_10(struct lsa_AuditFullSetInfo *r)
 102 {
 103         d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
 104 }
 105
 106 static void display_query_info_11(struct lsa_AuditFullQueryInfo *r)
 107 {
 108         d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
 109         d_printf("Log is full: %d\n", r->log_is_full);
 110 }
 111
 112 static void display_query_info_12(struct lsa_DnsDomainInfo *r)
 113 {
 114         d_printf("Domain NetBios Name: %s\n", r->name.string);
 115         d_printf("Domain DNS Name: %s\n", r->dns_domain.string);
 116         d_printf("Domain Forest Name: %s\n", r->dns_forest.string);
 117         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
 118         d_printf("Domain GUID: %s\n", GUID_string(talloc_tos(),
 119                                                       &r->domain_guid));
 120 }
 121
 122 static void display_lsa_query_info(union lsa_PolicyInformation *info,
 123                                    enum lsa_PolicyInfo level)
 124 {
 125         switch (level) {
 126                 case 1:
 127                         display_query_info_1(&info->audit_log);
 128                         break;
 129                 case 2:
 130                         display_query_info_2(&info->audit_events);
 131                         break;
 132                 case 3:
 133                         display_query_info_3(&info->domain);
 134                         break;
 135                 case 5:
 136                         display_query_info_5(&info->account_domain);
 137                         break;
 138                 case 10:
 139                         display_query_info_10(&info->auditfullset);
 140                         break;
 141                 case 11:
 142                         display_query_info_11(&info->auditfullquery);
 143                         break;
 144                 case 12:
 145                         display_query_info_12(&info->dns);
 146                         break;
 147                 default:
 148                         printf("can't display info level: %d\n", level);
 149                         break;
 150         }
 151 }
 152
 153 static NTSTATUS cmd_lsa_query_info_policy(struct rpc_pipe_client *cli,
 154                                           TALLOC_CTX *mem_ctx, int argc,
 155                                           const char **argv)
 156 {
 157         struct policy_handle pol;
 158         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 159         union lsa_PolicyInformation *info = NULL;
 160
 161         uint32 info_class = 3;
 162
 163         if (argc > 2) {
 164                 printf("Usage: %s [info_class]\n", argv[0]);
 165                 return NT_STATUS_OK;
 166         }
 167
 168         if (argc == 2)
 169                 info_class = atoi(argv[1]);
 170
 171         switch (info_class) {
 172         case 12:
 173                 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 174                                                  SEC_FLAG_MAXIMUM_ALLOWED,
 175                                                  &pol);
 176
 177                 if (!NT_STATUS_IS_OK(result))
 178                         goto done;
 179
 180                 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
 181                                                      &pol,
 182                                                      info_class,
 183                                                      &info);
 184                 break;
 185         default:
 186                 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 187                                                 SEC_FLAG_MAXIMUM_ALLOWED,
 188                                                 &pol);
 189
 190                 if (!NT_STATUS_IS_OK(result))
 191                         goto done;
 192
 193                 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
 194                                                     &pol,
 195                                                     info_class,
 196                                                     &info);
 197         }
 198
 199         if (NT_STATUS_IS_OK(result)) {
 200                 display_lsa_query_info(info, info_class);
 201         }
 202
 203         rpccli_lsa_Close(cli, mem_ctx, &pol);
 204
 205  done:
 206         return result;
 207 }
 208
 209 /* Resolve a list of names to a list of sids */
 210
 211 static NTSTATUS cmd_lsa_lookup_names(struct rpc_pipe_client *cli,
 212                                      TALLOC_CTX *mem_ctx, int argc,
 213                                      const char **argv)
 214 {
 215         struct policy_handle pol;
 216         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 217         struct dom_sid *sids;
 218         enum lsa_SidType *types;
 219         int i;
 220
 221         if (argc == 1) {
 222                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 223                 return NT_STATUS_OK;
 224         }
 225
 226         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 227                                      SEC_FLAG_MAXIMUM_ALLOWED,
 228                                      &pol);
 229
 230         if (!NT_STATUS_IS_OK(result))
 231                 goto done;
 232
 233         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
 234                                       (const char**)(argv + 1), NULL, 1, &sids, &types);
 235
 236         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 237             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 238                 goto done;
 239
 240         result = NT_STATUS_OK;
 241
 242         /* Print results */
 243
 244         for (i = 0; i < (argc - 1); i++) {
 245                 fstring sid_str;
 246                 sid_to_fstring(sid_str, &sids[i]);
 247                 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
 248                        sid_type_lookup(types[i]), types[i]);
 249         }
 250
 251         rpccli_lsa_Close(cli, mem_ctx, &pol);
 252
 253  done:
 254         return result;
 255 }
 256
 257 /* Resolve a list of names to a list of sids */
 258
 259 static NTSTATUS cmd_lsa_lookup_names_level(struct rpc_pipe_client *cli,
 260                                            TALLOC_CTX *mem_ctx, int argc,
 261                                            const char **argv)
 262 {
 263         struct policy_handle pol;
 264         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 265         struct dom_sid *sids;
 266         enum lsa_SidType *types;
 267         int i, level;
 268
 269         if (argc < 3) {
 270                 printf("Usage: %s [level] [name1 [name2 [...]]]\n", argv[0]);
 271                 return NT_STATUS_OK;
 272         }
 273
 274         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 275                                      SEC_FLAG_MAXIMUM_ALLOWED,
 276                                      &pol);
 277
 278         if (!NT_STATUS_IS_OK(result))
 279                 goto done;
 280
 281         level = atoi(argv[1]);
 282
 283         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 2,
 284                                       (const char**)(argv + 2), NULL, level, &sids, &types);
 285
 286         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 287             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 288                 goto done;
 289
 290         result = NT_STATUS_OK;
 291
 292         /* Print results */
 293
 294         for (i = 0; i < (argc - 2); i++) {
 295                 fstring sid_str;
 296                 sid_to_fstring(sid_str, &sids[i]);
 297                 printf("%s %s (%s: %d)\n", argv[i + 2], sid_str,
 298                        sid_type_lookup(types[i]), types[i]);
 299         }
 300
 301         rpccli_lsa_Close(cli, mem_ctx, &pol);
 302
 303  done:
 304         return result;
 305 }
 306
 307 static NTSTATUS cmd_lsa_lookup_names4(struct rpc_pipe_client *cli,
 308                                       TALLOC_CTX *mem_ctx, int argc,
 309                                       const char **argv)
 310 {
 311         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 312
 313         uint32_t num_names;
 314         struct lsa_String *names;
 315         struct lsa_RefDomainList *domains;
 316         struct lsa_TransSidArray3 sids;
 317         uint32_t count = 0;
 318         int i;
 319
 320         if (argc == 1) {
 321                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 322                 return NT_STATUS_OK;
 323         }
 324
 325         ZERO_STRUCT(sids);
 326
 327         num_names = argc-1;
 328         names = talloc_array(mem_ctx, struct lsa_String, num_names);
 329         NT_STATUS_HAVE_NO_MEMORY(names);
 330
 331         for (i=0; i < num_names; i++) {
 332                 init_lsa_String(&names[i], argv[i+1]);
 333         }
 334
 335         result = rpccli_lsa_LookupNames4(cli, mem_ctx,
 336                                          num_names,
 337                                          names,
 338                                          &domains,
 339                                          &sids,
 340                                          1,
 341                                          &count,
 342                                          0,
 343                                          0);
 344         if (!NT_STATUS_IS_OK(result)) {
 345                 return result;
 346         }
 347
 348         for (i = 0; i < sids.count; i++) {
 349                 fstring sid_str;
 350                 sid_to_fstring(sid_str, sids.sids[i].sid);
 351                 printf("%s %s (%s: %d)\n", argv[i+1], sid_str,
 352                        sid_type_lookup(sids.sids[i].sid_type),
 353                        sids.sids[i].sid_type);
 354         }
 355
 356         return result;
 357 }
 358
 359 /* Resolve a list of SIDs to a list of names */
 360
 361 static NTSTATUS cmd_lsa_lookup_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 362                                     int argc, const char **argv)
 363 {
 364         struct policy_handle pol;
 365         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 366         struct dom_sid *sids;
 367         char **domains;
 368         char **names;
 369         enum lsa_SidType *types;
 370         int i;
 371
 372         if (argc == 1) {
 373                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 374                 return NT_STATUS_OK;
 375         }
 376
 377         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 378                                      SEC_FLAG_MAXIMUM_ALLOWED,
 379                                      &pol);
 380
 381         if (!NT_STATUS_IS_OK(result))
 382                 goto done;
 383
 384         /* Convert arguments to sids */
 385
 386         sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, argc - 1);
 387
 388         if (!sids) {
 389                 printf("could not allocate memory for %d sids\n", argc - 1);
 390                 goto done;
 391         }
 392
 393         for (i = 0; i < argc - 1; i++)
 394                 if (!string_to_sid(&sids[i], argv[i + 1])) {
 395                         result = NT_STATUS_INVALID_SID;
 396                         goto done;
 397                 }
 398
 399         /* Lookup the SIDs */
 400
 401         result = rpccli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
 402                                      &domains, &names, &types);
 403
 404         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 405             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 406                 goto done;
 407
 408         result = NT_STATUS_OK;
 409
 410         /* Print results */
 411
 412         for (i = 0; i < (argc - 1); i++) {
 413                 fstring sid_str;
 414
 415                 sid_to_fstring(sid_str, &sids[i]);
 416                 printf("%s %s\\%s (%d)\n", sid_str,
 417                        domains[i] ? domains[i] : "*unknown*",
 418                        names[i] ? names[i] : "*unknown*", types[i]);
 419         }
 420
 421         rpccli_lsa_Close(cli, mem_ctx, &pol);
 422
 423  done:
 424         return result;
 425 }
 426
 427 /* Resolve a list of SIDs to a list of names */
 428
 429 static NTSTATUS cmd_lsa_lookup_sids3(struct rpc_pipe_client *cli,
 430                                      TALLOC_CTX *mem_ctx,
 431                                      int argc, const char **argv)
 432 {
 433         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 434         int i;
 435         struct lsa_SidArray sids;
 436         struct lsa_RefDomainList *domains;
 437         struct lsa_TransNameArray2 names;
 438         uint32_t count = 0;
 439
 440         if (argc == 1) {
 441                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 442                 return NT_STATUS_OK;
 443         }
 444
 445         ZERO_STRUCT(names);
 446
 447         /* Convert arguments to sids */
 448
 449         sids.num_sids = argc-1;
 450         sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
 451         if (!sids.sids) {
 452                 printf("could not allocate memory for %d sids\n", sids.num_sids);
 453                 goto done;
 454         }
 455
 456         for (i = 0; i < sids.num_sids; i++) {
 457                 sids.sids[i].sid = talloc(sids.sids, struct dom_sid);
 458                 if (sids.sids[i].sid == NULL) {
 459                         result = NT_STATUS_NO_MEMORY;
 460                         goto done;
 461                 }
 462                 if (!string_to_sid(sids.sids[i].sid, argv[i+1])) {
 463                         result = NT_STATUS_INVALID_SID;
 464                         goto done;
 465                 }
 466         }
 467
 468         /* Lookup the SIDs */
 469         result = rpccli_lsa_LookupSids3(cli, mem_ctx,
 470                                         &sids,
 471                                         &domains,
 472                                         &names,
 473                                         1,
 474                                         &count,
 475                                         0,
 476                                         0);
 477
 478         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 479             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 480                 goto done;
 481
 482         result = NT_STATUS_OK;
 483
 484         /* Print results */
 485
 486         for (i = 0; i < count; i++) {
 487                 fstring sid_str;
 488
 489                 sid_to_fstring(sid_str, sids.sids[i].sid);
 490                 printf("%s %s (%d)\n", sid_str,
 491                        names.names[i].name.string,
 492                        names.names[i].sid_type);
 493         }
 494
 495  done:
 496         return result;
 497 }
 498
 499
 500 /* Enumerate list of trusted domains */
 501
 502 static NTSTATUS cmd_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
 503                                        TALLOC_CTX *mem_ctx, int argc,
 504                                        const char **argv)
 505 {
 506         struct policy_handle pol;
 507         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 508         struct lsa_DomainList domain_list;
 509
 510         /* defaults, but may be changed using params */
 511         uint32 enum_ctx = 0;
 512         int i;
 513         uint32_t max_size = (uint32_t)-1;
 514
 515         if (argc > 2) {
 516                 printf("Usage: %s [enum context (0)]\n", argv[0]);
 517                 return NT_STATUS_OK;
 518         }
 519
 520         if (argc == 2 && argv[1]) {
 521                 enum_ctx = atoi(argv[2]);
 522         }
 523
 524         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 525                                      LSA_POLICY_VIEW_LOCAL_INFORMATION,
 526                                      &pol);
 527
 528         if (!NT_STATUS_IS_OK(result))
 529                 goto done;
 530
 531         result = STATUS_MORE_ENTRIES;
 532
 533         while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
 534
 535                 /* Lookup list of trusted domains */
 536
 537                 result = rpccli_lsa_EnumTrustDom(cli, mem_ctx,
 538                                                  &pol,
 539                                                  &enum_ctx,
 540                                                  &domain_list,
 541                                                  max_size);
 542                 if (!NT_STATUS_IS_OK(result) &&
 543                     !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
 544                     !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
 545                         goto done;
 546
 547                 /* Print results: list of names and sids returned in this
 548                  * response. */
 549                 for (i = 0; i < domain_list.count; i++) {
 550                         fstring sid_str;
 551
 552                         sid_to_fstring(sid_str, domain_list.domains[i].sid);
 553                         printf("%s %s\n",
 554                                 domain_list.domains[i].name.string ?
 555                                 domain_list.domains[i].name.string : "*unknown*",
 556                                 sid_str);
 557                 }
 558         }
 559
 560         rpccli_lsa_Close(cli, mem_ctx, &pol);
 561  done:
 562         return result;
 563 }
 564
 565 /* Enumerates privileges */
 566
 567 static NTSTATUS cmd_lsa_enum_privilege(struct rpc_pipe_client *cli,
 568                                        TALLOC_CTX *mem_ctx, int argc,
 569                                        const char **argv)
 570 {
 571         struct policy_handle pol;
 572         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 573         struct lsa_PrivArray priv_array;
 574
 575         uint32 enum_context=0;
 576         uint32 pref_max_length=0x1000;
 577         int i;
 578
 579         if (argc > 3) {
 580                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 581                 return NT_STATUS_OK;
 582         }
 583
 584         if (argc>=2)
 585                 enum_context=atoi(argv[1]);
 586
 587         if (argc==3)
 588                 pref_max_length=atoi(argv[2]);
 589
 590         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 591                                      SEC_FLAG_MAXIMUM_ALLOWED,
 592                                      &pol);
 593
 594         if (!NT_STATUS_IS_OK(result))
 595                 goto done;
 596
 597         result = rpccli_lsa_EnumPrivs(cli, mem_ctx,
 598                                       &pol,
 599                                       &enum_context,
 600                                       &priv_array,
 601                                       pref_max_length);
 602         if (!NT_STATUS_IS_OK(result))
 603                 goto done;
 604
 605         /* Print results */
 606         printf("found %d privileges\n\n", priv_array.count);
 607
 608         for (i = 0; i < priv_array.count; i++) {
 609                 printf("%s \t\t%d:%d (0x%x:0x%x)\n",
 610                        priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*",
 611                        priv_array.privs[i].luid.high,
 612                        priv_array.privs[i].luid.low,
 613                        priv_array.privs[i].luid.high,
 614                        priv_array.privs[i].luid.low);
 615         }
 616
 617         rpccli_lsa_Close(cli, mem_ctx, &pol);
 618  done:
 619         return result;
 620 }
 621
 622 /* Get privilege name */
 623
 624 static NTSTATUS cmd_lsa_get_dispname(struct rpc_pipe_client *cli,
 625                                      TALLOC_CTX *mem_ctx, int argc,
 626                                      const char **argv)
 627 {
 628         struct policy_handle pol;
 629         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 630
 631         uint16 lang_id=0;
 632         uint16 lang_id_sys=0;
 633         uint16 lang_id_desc;
 634         struct lsa_String lsa_name;
 635         struct lsa_StringLarge *description = NULL;
 636
 637         if (argc != 2) {
 638                 printf("Usage: %s privilege name\n", argv[0]);
 639                 return NT_STATUS_OK;
 640         }
 641
 642         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 643                                      SEC_FLAG_MAXIMUM_ALLOWED,
 644                                      &pol);
 645
 646         if (!NT_STATUS_IS_OK(result))
 647                 goto done;
 648
 649         init_lsa_String(&lsa_name, argv[1]);
 650
 651         result = rpccli_lsa_LookupPrivDisplayName(cli, mem_ctx,
 652                                                   &pol,
 653                                                   &lsa_name,
 654                                                   lang_id,
 655                                                   lang_id_sys,
 656                                                   &description,
 657                                                   &lang_id_desc);
 658
 659         if (!NT_STATUS_IS_OK(result))
 660                 goto done;
 661
 662         /* Print results */
 663         printf("%s -> %s (language: 0x%x)\n", argv[1], description->string, lang_id_desc);
 664
 665         rpccli_lsa_Close(cli, mem_ctx, &pol);
 666  done:
 667         return result;
 668 }
 669
 670 /* Enumerate the LSA SIDS */
 671
 672 static NTSTATUS cmd_lsa_enum_sids(struct rpc_pipe_client *cli,
 673                                   TALLOC_CTX *mem_ctx, int argc,
 674                                   const char **argv)
 675 {
 676         struct policy_handle pol;
 677         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 678
 679         uint32 enum_context=0;
 680         uint32 pref_max_length=0x1000;
 681         struct lsa_SidArray sid_array;
 682         int i;
 683
 684         if (argc > 3) {
 685                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 686                 return NT_STATUS_OK;
 687         }
 688
 689         if (argc>=2)
 690                 enum_context=atoi(argv[1]);
 691
 692         if (argc==3)
 693                 pref_max_length=atoi(argv[2]);
 694
 695         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 696                                      SEC_FLAG_MAXIMUM_ALLOWED,
 697                                      &pol);
 698
 699         if (!NT_STATUS_IS_OK(result))
 700                 goto done;
 701
 702         result = rpccli_lsa_EnumAccounts(cli, mem_ctx,
 703                                          &pol,
 704                                          &enum_context,
 705                                          &sid_array,
 706                                          pref_max_length);
 707
 708         if (!NT_STATUS_IS_OK(result))
 709                 goto done;
 710
 711         /* Print results */
 712         printf("found %d SIDs\n\n", sid_array.num_sids);
 713
 714         for (i = 0; i < sid_array.num_sids; i++) {
 715                 fstring sid_str;
 716
 717                 sid_to_fstring(sid_str, sid_array.sids[i].sid);
 718                 printf("%s\n", sid_str);
 719         }
 720
 721         rpccli_lsa_Close(cli, mem_ctx, &pol);
 722  done:
 723         return result;
 724 }
 725
 726 /* Create a new account */
 727
 728 static NTSTATUS cmd_lsa_create_account(struct rpc_pipe_client *cli,
 729                                            TALLOC_CTX *mem_ctx, int argc,
 730                                            const char **argv)
 731 {
 732         struct policy_handle dom_pol;
 733         struct policy_handle user_pol;
 734         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 735         uint32 des_access = 0x000f000f;
 736
 737         struct dom_sid sid;
 738
 739         if (argc != 2 ) {
 740                 printf("Usage: %s SID\n", argv[0]);
 741                 return NT_STATUS_OK;
 742         }
 743
 744         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 745         if (!NT_STATUS_IS_OK(result))
 746                 goto done;
 747
 748         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 749                                      SEC_FLAG_MAXIMUM_ALLOWED,
 750                                      &dom_pol);
 751
 752         if (!NT_STATUS_IS_OK(result))
 753                 goto done;
 754
 755         result = rpccli_lsa_CreateAccount(cli, mem_ctx,
 756                                           &dom_pol,
 757                                           &sid,
 758                                           des_access,
 759                                           &user_pol);
 760
 761         if (!NT_STATUS_IS_OK(result))
 762                 goto done;
 763
 764         printf("Account for SID %s successfully created\n\n", argv[1]);
 765         result = NT_STATUS_OK;
 766
 767         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 768  done:
 769         return result;
 770 }
 771
 772
 773 /* Enumerate the privileges of an SID */
 774
 775 static NTSTATUS cmd_lsa_enum_privsaccounts(struct rpc_pipe_client *cli,
 776                                            TALLOC_CTX *mem_ctx, int argc,
 777                                            const char **argv)
 778 {
 779         struct policy_handle dom_pol;
 780         struct policy_handle user_pol;
 781         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 782         uint32 access_desired = 0x000f000f;
 783         struct dom_sid sid;
 784         struct lsa_PrivilegeSet *privs = NULL;
 785         int i;
 786
 787         if (argc != 2 ) {
 788                 printf("Usage: %s SID\n", argv[0]);
 789                 return NT_STATUS_OK;
 790         }
 791
 792         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 793         if (!NT_STATUS_IS_OK(result))
 794                 goto done;
 795
 796         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 797                                      SEC_FLAG_MAXIMUM_ALLOWED,
 798                                      &dom_pol);
 799
 800         if (!NT_STATUS_IS_OK(result))
 801                 goto done;
 802
 803         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
 804                                         &dom_pol,
 805                                         &sid,
 806                                         access_desired,
 807                                         &user_pol);
 808
 809         if (!NT_STATUS_IS_OK(result))
 810                 goto done;
 811
 812         result = rpccli_lsa_EnumPrivsAccount(cli, mem_ctx,
 813                                              &user_pol,
 814                                              &privs);
 815
 816         if (!NT_STATUS_IS_OK(result))
 817                 goto done;
 818
 819         /* Print results */
 820         printf("found %d privileges for SID %s\n\n", privs->count, argv[1]);
 821         printf("high\tlow\tattribute\n");
 822
 823         for (i = 0; i < privs->count; i++) {
 824                 printf("%u\t%u\t%u\n",
 825                         privs->set[i].luid.high,
 826                         privs->set[i].luid.low,
 827                         privs->set[i].attribute);
 828         }
 829
 830         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 831  done:
 832         return result;
 833 }
 834
 835
 836 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
 837
 838 static NTSTATUS cmd_lsa_enum_acct_rights(struct rpc_pipe_client *cli,
 839                                          TALLOC_CTX *mem_ctx, int argc,
 840                                          const char **argv)
 841 {
 842         struct policy_handle dom_pol;
 843         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 844         struct dom_sid sid;
 845         struct lsa_RightSet rights;
 846
 847         int i;
 848
 849         if (argc != 2 ) {
 850                 printf("Usage: %s SID\n", argv[0]);
 851                 return NT_STATUS_OK;
 852         }
 853
 854         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 855         if (!NT_STATUS_IS_OK(result))
 856                 goto done;
 857
 858         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 859                                      SEC_FLAG_MAXIMUM_ALLOWED,
 860                                      &dom_pol);
 861
 862         if (!NT_STATUS_IS_OK(result))
 863                 goto done;
 864
 865         result = rpccli_lsa_EnumAccountRights(cli, mem_ctx,
 866                                               &dom_pol,
 867                                               &sid,
 868                                               &rights);
 869
 870         if (!NT_STATUS_IS_OK(result))
 871                 goto done;
 872
 873         printf("found %d privileges for SID %s\n", rights.count,
 874                sid_string_tos(&sid));
 875
 876         for (i = 0; i < rights.count; i++) {
 877                 printf("\t%s\n", rights.names[i].string);
 878         }
 879
 880         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 881  done:
 882         return result;
 883 }
 884
 885
 886 /* add some privileges to a SID via LsaAddAccountRights */
 887
 888 static NTSTATUS cmd_lsa_add_acct_rights(struct rpc_pipe_client *cli,
 889                                         TALLOC_CTX *mem_ctx, int argc,
 890                                         const char **argv)
 891 {
 892         struct policy_handle dom_pol;
 893         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 894         struct lsa_RightSet rights;
 895         struct dom_sid sid;
 896         int i;
 897
 898         if (argc < 3 ) {
 899                 printf("Usage: %s SID [rights...]\n", argv[0]);
 900                 return NT_STATUS_OK;
 901         }
 902
 903         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 904         if (!NT_STATUS_IS_OK(result))
 905                 goto done;
 906
 907         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 908                                      SEC_FLAG_MAXIMUM_ALLOWED,
 909                                      &dom_pol);
 910
 911         if (!NT_STATUS_IS_OK(result))
 912                 goto done;
 913
 914         rights.count = argc-2;
 915         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 916                                     rights.count);
 917         if (!rights.names) {
 918                 return NT_STATUS_NO_MEMORY;
 919         }
 920
 921         for (i=0; i<argc-2; i++) {
 922                 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
 923         }
 924
 925         result = rpccli_lsa_AddAccountRights(cli, mem_ctx,
 926                                              &dom_pol,
 927                                              &sid,
 928                                              &rights);
 929
 930         if (!NT_STATUS_IS_OK(result))
 931                 goto done;
 932
 933         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 934  done:
 935         return result;
 936 }
 937
 938
 939 /* remove some privileges to a SID via LsaRemoveAccountRights */
 940
 941 static NTSTATUS cmd_lsa_remove_acct_rights(struct rpc_pipe_client *cli,
 942                                         TALLOC_CTX *mem_ctx, int argc,
 943                                         const char **argv)
 944 {
 945         struct policy_handle dom_pol;
 946         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 947         struct lsa_RightSet rights;
 948         struct dom_sid sid;
 949         int i;
 950
 951         if (argc < 3 ) {
 952                 printf("Usage: %s SID [rights...]\n", argv[0]);
 953                 return NT_STATUS_OK;
 954         }
 955
 956         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 957         if (!NT_STATUS_IS_OK(result))
 958                 goto done;
 959
 960         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 961                                      SEC_FLAG_MAXIMUM_ALLOWED,
 962                                      &dom_pol);
 963
 964         if (!NT_STATUS_IS_OK(result))
 965                 goto done;
 966
 967         rights.count = argc-2;
 968         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 969                                     rights.count);
 970         if (!rights.names) {
 971                 return NT_STATUS_NO_MEMORY;
 972         }
 973
 974         for (i=0; i<argc-2; i++) {
 975                 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
 976         }
 977
 978         result = rpccli_lsa_RemoveAccountRights(cli, mem_ctx,
 979                                                 &dom_pol,
 980                                                 &sid,
 981                                                 false,
 982                                                 &rights);
 983
 984         if (!NT_STATUS_IS_OK(result))
 985                 goto done;
 986
 987         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 988
 989  done:
 990         return result;
 991 }
 992
 993
 994 /* Get a privilege value given its name */
 995
 996 static NTSTATUS cmd_lsa_lookup_priv_value(struct rpc_pipe_client *cli,
 997                                         TALLOC_CTX *mem_ctx, int argc,
 998                                         const char **argv)
 999 {
1000         struct policy_handle pol;
1001         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1002         struct lsa_LUID luid;
1003         struct lsa_String name;
1004
1005         if (argc != 2 ) {
1006                 printf("Usage: %s name\n", argv[0]);
1007                 return NT_STATUS_OK;
1008         }
1009
1010         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1011                                      SEC_FLAG_MAXIMUM_ALLOWED,
1012                                      &pol);
1013
1014         if (!NT_STATUS_IS_OK(result))
1015                 goto done;
1016
1017         init_lsa_String(&name, argv[1]);
1018
1019         result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1020                                             &pol,
1021                                             &name,
1022                                             &luid);
1023
1024         if (!NT_STATUS_IS_OK(result))
1025                 goto done;
1026
1027         /* Print results */
1028
1029         printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
1030
1031         rpccli_lsa_Close(cli, mem_ctx, &pol);
1032  done:
1033         return result;
1034 }
1035
1036 /* Query LSA security object */
1037
1038 static NTSTATUS cmd_lsa_query_secobj(struct rpc_pipe_client *cli,
1039                                      TALLOC_CTX *mem_ctx, int argc,
1040                                      const char **argv)
1041 {
1042         struct policy_handle pol;
1043         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1044         struct sec_desc_buf *sdb;
1045         uint32 sec_info = SECINFO_DACL;
1046
1047         if (argc < 1 || argc > 2) {
1048                 printf("Usage: %s [sec_info]\n", argv[0]);
1049                 return NT_STATUS_OK;
1050         }
1051
1052         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1053                                       SEC_FLAG_MAXIMUM_ALLOWED,
1054                                       &pol);
1055
1056         if (argc == 2)
1057                 sscanf(argv[1], "%x", &sec_info);
1058
1059         if (!NT_STATUS_IS_OK(result))
1060                 goto done;
1061
1062         result = rpccli_lsa_QuerySecurity(cli, mem_ctx,
1063                                           &pol,
1064                                           sec_info,
1065                                           &sdb);
1066         if (!NT_STATUS_IS_OK(result))
1067                 goto done;
1068
1069         /* Print results */
1070
1071         display_sec_desc(sdb->sd);
1072
1073         rpccli_lsa_Close(cli, mem_ctx, &pol);
1074  done:
1075         return result;
1076 }
1077
1078 static void display_trust_dom_info_4(struct lsa_TrustDomainInfoPassword *p,
1079                                      uint8_t session_key[16])
1080 {
1081         char *pwd, *pwd_old;
1082
1083         DATA_BLOB data     = data_blob_const(p->password->data, p->password->length);
1084         DATA_BLOB data_old = data_blob_const(p->old_password->data, p->old_password->length);
1085         DATA_BLOB session_key_blob = data_blob_const(session_key, sizeof(session_key));
1086
1087         pwd     = sess_decrypt_string(talloc_tos(), &data, &session_key_blob);
1088         pwd_old = sess_decrypt_string(talloc_tos(), &data_old, &session_key_blob);
1089
1090         d_printf("Password:\t%s\n", pwd);
1091         d_printf("Old Password:\t%s\n", pwd_old);
1092
1093         talloc_free(pwd);
1094         talloc_free(pwd_old);
1095 }
1096
1097 static void display_trust_dom_info(TALLOC_CTX *mem_ctx,
1098                                    union lsa_TrustedDomainInfo *info,
1099                                    enum lsa_TrustDomInfoEnum info_class,
1100                                    uint8_t nt_hash[16])
1101 {
1102         switch (info_class) {
1103                 case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
1104                         display_trust_dom_info_4(&info->password, nt_hash);
1105                         break;
1106                 default: {
1107                         const char *str = NULL;
1108                         str = NDR_PRINT_UNION_STRING(mem_ctx,
1109                                                      lsa_TrustedDomainInfo,
1110                                                      info_class, info);
1111                         if (str) {
1112                                 d_printf("%s\n", str);
1113                         }
1114                         break;
1115                 }
1116         }
1117 }
1118
1119 static NTSTATUS cmd_lsa_query_trustdominfobysid(struct rpc_pipe_client *cli,
1120                                                 TALLOC_CTX *mem_ctx, int argc,
1121                                                 const char **argv)
1122 {
1123         struct policy_handle pol;
1124         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1125         struct dom_sid dom_sid;
1126         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1127         union lsa_TrustedDomainInfo *info = NULL;
1128         enum lsa_TrustDomInfoEnum info_class = 1;
1129         uint8_t nt_hash[16];
1130
1131         if (argc > 3 || argc < 2) {
1132                 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1133                 return NT_STATUS_OK;
1134         }
1135
1136         if (!string_to_sid(&dom_sid, argv[1]))
1137                 return NT_STATUS_NO_MEMORY;
1138
1139         if (argc == 3)
1140                 info_class = atoi(argv[2]);
1141
1142         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1143
1144         if (!NT_STATUS_IS_OK(result))
1145                 goto done;
1146
1147         result = rpccli_lsa_QueryTrustedDomainInfoBySid(cli, mem_ctx,
1148                                                         &pol,
1149                                                         &dom_sid,
1150                                                         info_class,
1151                                                         &info);
1152         if (!NT_STATUS_IS_OK(result))
1153                 goto done;
1154
1155         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1156                 d_fprintf(stderr, "Could not get pwd hash\n");
1157                 goto done;
1158         }
1159
1160         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1161
1162  done:
1163         rpccli_lsa_Close(cli, mem_ctx, &pol);
1164
1165         return result;
1166 }
1167
1168 static NTSTATUS cmd_lsa_query_trustdominfobyname(struct rpc_pipe_client *cli,
1169                                                  TALLOC_CTX *mem_ctx, int argc,
1170                                                  const char **argv)
1171 {
1172         struct policy_handle pol;
1173         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1174         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1175         union lsa_TrustedDomainInfo *info = NULL;
1176         enum lsa_TrustDomInfoEnum info_class = 1;
1177         struct lsa_String trusted_domain;
1178         uint8_t nt_hash[16];
1179
1180         if (argc > 3 || argc < 2) {
1181                 printf("Usage: %s [name] [info_class]\n", argv[0]);
1182                 return NT_STATUS_OK;
1183         }
1184
1185         if (argc == 3)
1186                 info_class = atoi(argv[2]);
1187
1188         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1189
1190         if (!NT_STATUS_IS_OK(result))
1191                 goto done;
1192
1193         init_lsa_String(&trusted_domain, argv[1]);
1194
1195         result = rpccli_lsa_QueryTrustedDomainInfoByName(cli, mem_ctx,
1196                                                          &pol,
1197                                                          &trusted_domain,
1198                                                          info_class,
1199                                                          &info);
1200         if (!NT_STATUS_IS_OK(result))
1201                 goto done;
1202
1203         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1204                 d_fprintf(stderr, "Could not get pwd hash\n");
1205                 goto done;
1206         }
1207
1208         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1209
1210  done:
1211         rpccli_lsa_Close(cli, mem_ctx, &pol);
1212
1213         return result;
1214 }
1215
1216 static NTSTATUS cmd_lsa_query_trustdominfo(struct rpc_pipe_client *cli,
1217                                            TALLOC_CTX *mem_ctx, int argc,
1218                                            const char **argv)
1219 {
1220         struct policy_handle pol, trustdom_pol;
1221         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1222         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1223         union lsa_TrustedDomainInfo *info = NULL;
1224         struct dom_sid dom_sid;
1225         enum lsa_TrustDomInfoEnum info_class = 1;
1226         uint8_t nt_hash[16];
1227
1228         if (argc > 3 || argc < 2) {
1229                 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1230                 return NT_STATUS_OK;
1231         }
1232
1233         if (!string_to_sid(&dom_sid, argv[1]))
1234                 return NT_STATUS_NO_MEMORY;
1235
1236
1237         if (argc == 3)
1238                 info_class = atoi(argv[2]);
1239
1240         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1241
1242         if (!NT_STATUS_IS_OK(result))
1243                 goto done;
1244
1245         result = rpccli_lsa_OpenTrustedDomain(cli, mem_ctx,
1246                                               &pol,
1247                                               &dom_sid,
1248                                               access_mask,
1249                                               &trustdom_pol);
1250
1251         if (!NT_STATUS_IS_OK(result))
1252                 goto done;
1253
1254         result = rpccli_lsa_QueryTrustedDomainInfo(cli, mem_ctx,
1255                                                    &trustdom_pol,
1256                                                    info_class,
1257                                                    &info);
1258
1259         if (!NT_STATUS_IS_OK(result))
1260                 goto done;
1261
1262         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1263                 d_fprintf(stderr, "Could not get pwd hash\n");
1264                 goto done;
1265         }
1266
1267         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1268
1269  done:
1270         rpccli_lsa_Close(cli, mem_ctx, &pol);
1271
1272         return result;
1273 }
1274
1275 static NTSTATUS cmd_lsa_get_username(struct rpc_pipe_client *cli,
1276                                      TALLOC_CTX *mem_ctx, int argc,
1277                                      const char **argv)
1278 {
1279         struct policy_handle pol;
1280         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1281         const char *servername = cli->desthost;
1282         struct lsa_String *account_name = NULL;
1283         struct lsa_String *authority_name = NULL;
1284
1285         if (argc > 2) {
1286                 printf("Usage: %s servername\n", argv[0]);
1287                 return NT_STATUS_OK;
1288         }
1289
1290         result = rpccli_lsa_open_policy(cli, mem_ctx, true,
1291                                         SEC_FLAG_MAXIMUM_ALLOWED,
1292                                         &pol);
1293
1294         if (!NT_STATUS_IS_OK(result)) {
1295                 goto done;
1296         }
1297
1298         result = rpccli_lsa_GetUserName(cli, mem_ctx,
1299                                         servername,
1300                                         &account_name,
1301                                         &authority_name);
1302         if (!NT_STATUS_IS_OK(result)) {
1303                 goto done;
1304         }
1305
1306         /* Print results */
1307
1308         printf("Account Name: %s, Authority Name: %s\n",
1309                 account_name->string, authority_name ? authority_name->string :
1310                 "");
1311
1312         rpccli_lsa_Close(cli, mem_ctx, &pol);
1313  done:
1314         return result;
1315 }
1316
1317 static NTSTATUS cmd_lsa_add_priv(struct rpc_pipe_client *cli,
1318                                  TALLOC_CTX *mem_ctx, int argc,
1319                                  const char **argv)
1320 {
1321         struct policy_handle dom_pol, user_pol;
1322         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1323         struct lsa_PrivilegeSet privs;
1324         struct lsa_LUIDAttribute *set = NULL;
1325         struct dom_sid sid;
1326         int i;
1327
1328         ZERO_STRUCT(privs);
1329
1330         if (argc < 3 ) {
1331                 printf("Usage: %s SID [rights...]\n", argv[0]);
1332                 return NT_STATUS_OK;
1333         }
1334
1335         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1336         if (!NT_STATUS_IS_OK(result)) {
1337                 goto done;
1338         }
1339
1340         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1341                                          SEC_FLAG_MAXIMUM_ALLOWED,
1342                                          &dom_pol);
1343
1344         if (!NT_STATUS_IS_OK(result)) {
1345                 goto done;
1346         }
1347
1348         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
1349                                         &dom_pol,
1350                                         &sid,
1351                                         SEC_FLAG_MAXIMUM_ALLOWED,
1352                                         &user_pol);
1353
1354         if (!NT_STATUS_IS_OK(result)) {
1355                 goto done;
1356         }
1357
1358         for (i=2; i<argc; i++) {
1359
1360                 struct lsa_String priv_name;
1361                 struct lsa_LUID luid;
1362
1363                 init_lsa_String(&priv_name, argv[i]);
1364
1365                 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1366                                                     &dom_pol,
1367                                                     &priv_name,
1368                                                     &luid);
1369                 if (!NT_STATUS_IS_OK(result)) {
1370                         continue;
1371                 }
1372
1373                 privs.count++;
1374                 set = TALLOC_REALLOC_ARRAY(mem_ctx, set,
1375                                            struct lsa_LUIDAttribute,
1376                                            privs.count);
1377                 if (!set) {
1378                         return NT_STATUS_NO_MEMORY;
1379                 }
1380
1381                 set[privs.count-1].luid = luid;
1382                 set[privs.count-1].attribute = 0;
1383         }
1384
1385         privs.set = set;
1386
1387         result = rpccli_lsa_AddPrivilegesToAccount(cli, mem_ctx,
1388                                                    &user_pol,
1389                                                    &privs);
1390
1391         if (!NT_STATUS_IS_OK(result)) {
1392                 goto done;
1393         }
1394
1395         rpccli_lsa_Close(cli, mem_ctx, &user_pol);
1396         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
1397  done:
1398         return result;
1399 }
1400
1401 static NTSTATUS cmd_lsa_del_priv(struct rpc_pipe_client *cli,
1402                                  TALLOC_CTX *mem_ctx, int argc,
1403                                  const char **argv)
1404 {
1405         struct policy_handle dom_pol, user_pol;
1406         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1407         struct lsa_PrivilegeSet privs;
1408         struct lsa_LUIDAttribute *set = NULL;
1409         struct dom_sid sid;
1410         int i;
1411
1412         ZERO_STRUCT(privs);
1413
1414         if (argc < 3 ) {
1415                 printf("Usage: %s SID [rights...]\n", argv[0]);
1416                 return NT_STATUS_OK;
1417         }
1418
1419         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1420         if (!NT_STATUS_IS_OK(result)) {
1421                 goto done;
1422         }
1423
1424         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1425                                          SEC_FLAG_MAXIMUM_ALLOWED,
1426                                          &dom_pol);
1427
1428         if (!NT_STATUS_IS_OK(result)) {
1429                 goto done;
1430         }
1431
1432         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
1433                                         &dom_pol,
1434                                         &sid,
1435                                         SEC_FLAG_MAXIMUM_ALLOWED,
1436                                         &user_pol);
1437
1438         if (!NT_STATUS_IS_OK(result)) {
1439                 goto done;
1440         }
1441
1442         for (i=2; i<argc; i++) {
1443
1444                 struct lsa_String priv_name;
1445                 struct lsa_LUID luid;
1446
1447                 init_lsa_String(&priv_name, argv[i]);
1448
1449                 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1450                                                     &dom_pol,
1451                                                     &priv_name,
1452                                                     &luid);
1453                 if (!NT_STATUS_IS_OK(result)) {
1454                         continue;
1455                 }
1456
1457                 privs.count++;
1458                 set = TALLOC_REALLOC_ARRAY(mem_ctx, set,
1459                                            struct lsa_LUIDAttribute,
1460                                            privs.count);
1461                 if (!set) {
1462                         return NT_STATUS_NO_MEMORY;
1463                 }
1464
1465                 set[privs.count-1].luid = luid;
1466                 set[privs.count-1].attribute = 0;
1467         }
1468
1469         privs.set = set;
1470
1471
1472         result = rpccli_lsa_RemovePrivilegesFromAccount(cli, mem_ctx,
1473                                                         &user_pol,
1474                                                         false,
1475                                                         &privs);
1476
1477         if (!NT_STATUS_IS_OK(result)) {
1478                 goto done;
1479         }
1480
1481         rpccli_lsa_Close(cli, mem_ctx, &user_pol);
1482         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
1483  done:
1484         return result;
1485 }
1486
1487 static NTSTATUS cmd_lsa_create_secret(struct rpc_pipe_client *cli,
1488                                       TALLOC_CTX *mem_ctx, int argc,
1489                                       const char **argv)
1490 {
1491         NTSTATUS status;
1492         struct policy_handle handle, sec_handle;
1493         struct lsa_String name;
1494
1495         if (argc < 2) {
1496                 printf("Usage: %s name\n", argv[0]);
1497                 return NT_STATUS_OK;
1498         }
1499
1500         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1501                                          true,
1502                                          SEC_FLAG_MAXIMUM_ALLOWED,
1503                                          &handle);
1504         if (!NT_STATUS_IS_OK(status)) {
1505                 return status;
1506         }
1507
1508         init_lsa_String(&name, argv[1]);
1509
1510         status = rpccli_lsa_CreateSecret(cli, mem_ctx,
1511                                          &handle,
1512                                          name,
1513                                          SEC_FLAG_MAXIMUM_ALLOWED,
1514                                          &sec_handle);
1515         if (!NT_STATUS_IS_OK(status)) {
1516                 goto done;
1517         }
1518
1519  done:
1520         if (is_valid_policy_hnd(&sec_handle)) {
1521                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1522         }
1523         if (is_valid_policy_hnd(&handle)) {
1524                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1525         }
1526
1527         return status;
1528 }
1529
1530 static NTSTATUS cmd_lsa_delete_secret(struct rpc_pipe_client *cli,
1531                                       TALLOC_CTX *mem_ctx, int argc,
1532                                       const char **argv)
1533 {
1534         NTSTATUS status;
1535         struct policy_handle handle, sec_handle;
1536         struct lsa_String name;
1537
1538         if (argc < 2) {
1539                 printf("Usage: %s name\n", argv[0]);
1540                 return NT_STATUS_OK;
1541         }
1542
1543         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1544                                          true,
1545                                          SEC_FLAG_MAXIMUM_ALLOWED,
1546                                          &handle);
1547         if (!NT_STATUS_IS_OK(status)) {
1548                 return status;
1549         }
1550
1551         init_lsa_String(&name, argv[1]);
1552
1553         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1554                                        &handle,
1555                                        name,
1556                                        SEC_FLAG_MAXIMUM_ALLOWED,
1557                                        &sec_handle);
1558         if (!NT_STATUS_IS_OK(status)) {
1559                 goto done;
1560         }
1561
1562         status = rpccli_lsa_DeleteObject(cli, mem_ctx,
1563                                          &sec_handle);
1564         if (!NT_STATUS_IS_OK(status)) {
1565                 goto done;
1566         }
1567
1568  done:
1569         if (is_valid_policy_hnd(&sec_handle)) {
1570                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1571         }
1572         if (is_valid_policy_hnd(&handle)) {
1573                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1574         }
1575
1576         return status;
1577 }
1578
1579 static NTSTATUS cmd_lsa_query_secret(struct rpc_pipe_client *cli,
1580                                      TALLOC_CTX *mem_ctx, int argc,
1581                                      const char **argv)
1582 {
1583         NTSTATUS status;
1584         struct policy_handle handle, sec_handle;
1585         struct lsa_String name;
1586         struct lsa_DATA_BUF_PTR new_val;
1587         NTTIME new_mtime = 0;
1588         struct lsa_DATA_BUF_PTR old_val;
1589         NTTIME old_mtime = 0;
1590         DATA_BLOB session_key;
1591         DATA_BLOB new_blob = data_blob_null;
1592         DATA_BLOB old_blob = data_blob_null;
1593         char *new_secret, *old_secret;
1594
1595         if (argc < 2) {
1596                 printf("Usage: %s name\n", argv[0]);
1597                 return NT_STATUS_OK;
1598         }
1599
1600         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1601                                          true,
1602                                          SEC_FLAG_MAXIMUM_ALLOWED,
1603                                          &handle);
1604         if (!NT_STATUS_IS_OK(status)) {
1605                 return status;
1606         }
1607
1608         init_lsa_String(&name, argv[1]);
1609
1610         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1611                                        &handle,
1612                                        name,
1613                                        SEC_FLAG_MAXIMUM_ALLOWED,
1614                                        &sec_handle);
1615         if (!NT_STATUS_IS_OK(status)) {
1616                 goto done;
1617         }
1618
1619         ZERO_STRUCT(new_val);
1620         ZERO_STRUCT(old_val);
1621
1622         status = rpccli_lsa_QuerySecret(cli, mem_ctx,
1623                                         &sec_handle,
1624                                         &new_val,
1625                                         &new_mtime,
1626                                         &old_val,
1627                                         &old_mtime);
1628         if (!NT_STATUS_IS_OK(status)) {
1629                 goto done;
1630         }
1631
1632         status = cli_get_session_key(mem_ctx, cli, &session_key);
1633         if (!NT_STATUS_IS_OK(status)) {
1634                 goto done;
1635         }
1636
1637         if (new_val.buf) {
1638                 new_blob = data_blob_const(new_val.buf->data, new_val.buf->length);
1639         }
1640         if (old_val.buf) {
1641                 old_blob = data_blob_const(old_val.buf->data, old_val.buf->length);
1642         }
1643
1644         new_secret = sess_decrypt_string(mem_ctx, &new_blob, &session_key);
1645         old_secret = sess_decrypt_string(mem_ctx, &old_blob, &session_key);
1646         if (new_secret) {
1647                 d_printf("new secret: %s\n", new_secret);
1648         }
1649         if (old_secret) {
1650                 d_printf("old secret: %s\n", old_secret);
1651         }
1652
1653  done:
1654         if (is_valid_policy_hnd(&sec_handle)) {
1655                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1656         }
1657         if (is_valid_policy_hnd(&handle)) {
1658                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1659         }
1660
1661         return status;
1662 }
1663
1664 static NTSTATUS cmd_lsa_set_secret(struct rpc_pipe_client *cli,
1665                                    TALLOC_CTX *mem_ctx, int argc,
1666                                    const char **argv)
1667 {
1668         NTSTATUS status;
1669         struct policy_handle handle, sec_handle;
1670         struct lsa_String name;
1671         struct lsa_DATA_BUF new_val;
1672         struct lsa_DATA_BUF old_val;
1673         DATA_BLOB enc_key;
1674         DATA_BLOB session_key;
1675
1676         if (argc < 3) {
1677                 printf("Usage: %s name secret\n", argv[0]);
1678                 return NT_STATUS_OK;
1679         }
1680
1681         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1682                                          true,
1683                                          SEC_FLAG_MAXIMUM_ALLOWED,
1684                                          &handle);
1685         if (!NT_STATUS_IS_OK(status)) {
1686                 return status;
1687         }
1688
1689         init_lsa_String(&name, argv[1]);
1690
1691         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1692                                        &handle,
1693                                        name,
1694                                        SEC_FLAG_MAXIMUM_ALLOWED,
1695                                        &sec_handle);
1696         if (!NT_STATUS_IS_OK(status)) {
1697                 goto done;
1698         }
1699
1700         ZERO_STRUCT(new_val);
1701         ZERO_STRUCT(old_val);
1702
1703         status = cli_get_session_key(mem_ctx, cli, &session_key);
1704         if (!NT_STATUS_IS_OK(status)) {
1705                 goto done;
1706         }
1707
1708         enc_key = sess_encrypt_string(argv[2], &session_key);
1709
1710         new_val.length = enc_key.length;
1711         new_val.size = enc_key.length;
1712         new_val.data = enc_key.data;
1713
1714         status = rpccli_lsa_SetSecret(cli, mem_ctx,
1715                                       &sec_handle,
1716                                       &new_val,
1717                                       NULL);
1718         if (!NT_STATUS_IS_OK(status)) {
1719                 goto done;
1720         }
1721
1722  done:
1723         if (is_valid_policy_hnd(&sec_handle)) {
1724                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1725         }
1726         if (is_valid_policy_hnd(&handle)) {
1727                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1728         }
1729
1730         return status;
1731 }
1732
1733 static NTSTATUS cmd_lsa_retrieve_private_data(struct rpc_pipe_client *cli,
1734                                               TALLOC_CTX *mem_ctx, int argc,
1735                                               const char **argv)
1736 {
1737         NTSTATUS status;
1738         struct policy_handle handle;
1739         struct lsa_String name;
1740         struct lsa_DATA_BUF *val;
1741         DATA_BLOB session_key;
1742         DATA_BLOB blob = data_blob_null;
1743         char *secret;
1744
1745         if (argc < 2) {
1746                 printf("Usage: %s name\n", argv[0]);
1747                 return NT_STATUS_OK;
1748         }
1749
1750         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1751                                          true,
1752                                          SEC_FLAG_MAXIMUM_ALLOWED,
1753                                          &handle);
1754         if (!NT_STATUS_IS_OK(status)) {
1755                 return status;
1756         }
1757
1758         init_lsa_String(&name, argv[1]);
1759
1760         ZERO_STRUCT(val);
1761
1762         status = rpccli_lsa_RetrievePrivateData(cli, mem_ctx,
1763                                                 &handle,
1764                                                 &name,
1765                                                 &val);
1766         if (!NT_STATUS_IS_OK(status)) {
1767                 goto done;
1768         }
1769
1770         status = cli_get_session_key(mem_ctx, cli, &session_key);
1771         if (!NT_STATUS_IS_OK(status)) {
1772                 goto done;
1773         }
1774
1775         if (val) {
1776                 blob = data_blob_const(val->data, val->length);
1777         }
1778
1779         secret = sess_decrypt_string(mem_ctx, &blob, &session_key);
1780         if (secret) {
1781                 d_printf("secret: %s\n", secret);
1782         }
1783
1784  done:
1785         if (is_valid_policy_hnd(&handle)) {
1786                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1787         }
1788
1789         return status;
1790 }
1791
1792 static NTSTATUS cmd_lsa_store_private_data(struct rpc_pipe_client *cli,
1793                                            TALLOC_CTX *mem_ctx, int argc,
1794                                            const char **argv)
1795 {
1796         NTSTATUS status;
1797         struct policy_handle handle;
1798         struct lsa_String name;
1799         struct lsa_DATA_BUF val;
1800         DATA_BLOB session_key;
1801         DATA_BLOB enc_key;
1802
1803         if (argc < 3) {
1804                 printf("Usage: %s name secret\n", argv[0]);
1805                 return NT_STATUS_OK;
1806         }
1807
1808         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1809                                          true,
1810                                          SEC_FLAG_MAXIMUM_ALLOWED,
1811                                          &handle);
1812         if (!NT_STATUS_IS_OK(status)) {
1813                 return status;
1814         }
1815
1816         init_lsa_String(&name, argv[1]);
1817
1818         ZERO_STRUCT(val);
1819
1820         status = cli_get_session_key(mem_ctx, cli, &session_key);
1821         if (!NT_STATUS_IS_OK(status)) {
1822                 goto done;
1823         }
1824
1825         enc_key = sess_encrypt_string(argv[2], &session_key);
1826
1827         val.length = enc_key.length;
1828         val.size = enc_key.length;
1829         val.data = enc_key.data;
1830
1831         status = rpccli_lsa_StorePrivateData(cli, mem_ctx,
1832                                              &handle,
1833                                              &name,
1834                                              &val);
1835         if (!NT_STATUS_IS_OK(status)) {
1836                 goto done;
1837         }
1838
1839  done:
1840         if (is_valid_policy_hnd(&handle)) {
1841                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1842         }
1843
1844         return status;
1845 }
1846
1847 static NTSTATUS cmd_lsa_create_trusted_domain(struct rpc_pipe_client *cli,
1848                                               TALLOC_CTX *mem_ctx, int argc,
1849                                               const char **argv)
1850 {
1851         NTSTATUS status;
1852         struct policy_handle handle, trustdom_handle;
1853         struct dom_sid sid;
1854         struct lsa_DomainInfo info;
1855
1856         if (argc < 3) {
1857                 printf("Usage: %s name sid\n", argv[0]);
1858                 return NT_STATUS_OK;
1859         }
1860
1861         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1862                                          true,
1863                                          SEC_FLAG_MAXIMUM_ALLOWED,
1864                                          &handle);
1865         if (!NT_STATUS_IS_OK(status)) {
1866                 return status;
1867         }
1868
1869         init_lsa_StringLarge(&info.name, argv[1]);
1870         info.sid = &sid;
1871         string_to_sid(&sid, argv[2]);
1872
1873         status = rpccli_lsa_CreateTrustedDomain(cli, mem_ctx,
1874                                                 &handle,
1875                                                 &info,
1876                                                 SEC_FLAG_MAXIMUM_ALLOWED,
1877                                                 &trustdom_handle);
1878         if (!NT_STATUS_IS_OK(status)) {
1879                 goto done;
1880         }
1881
1882  done:
1883         if (is_valid_policy_hnd(&trustdom_handle)) {
1884                 rpccli_lsa_Close(cli, mem_ctx, &trustdom_handle);
1885         }
1886
1887         if (is_valid_policy_hnd(&handle)) {
1888                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1889         }
1890
1891         return status;
1892 }
1893
1894 static NTSTATUS cmd_lsa_delete_trusted_domain(struct rpc_pipe_client *cli,
1895                                               TALLOC_CTX *mem_ctx, int argc,
1896                                               const char **argv)
1897 {
1898         NTSTATUS status;
1899         struct policy_handle handle, trustdom_handle;
1900         struct lsa_String name;
1901         struct dom_sid *sid = NULL;
1902
1903         if (argc < 2) {
1904                 printf("Usage: %s name\n", argv[0]);
1905                 return NT_STATUS_OK;
1906         }
1907
1908         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1909                                          true,
1910                                          SEC_FLAG_MAXIMUM_ALLOWED,
1911                                          &handle);
1912         if (!NT_STATUS_IS_OK(status)) {
1913                 return status;
1914         }
1915
1916         init_lsa_String(&name, argv[1]);
1917
1918         status = rpccli_lsa_OpenTrustedDomainByName(cli, mem_ctx,
1919                                                     &handle,
1920                                                     name,
1921                                                     SEC_FLAG_MAXIMUM_ALLOWED,
1922                                                     &trustdom_handle);
1923         if (NT_STATUS_IS_OK(status)) {
1924                 goto delete_object;
1925         }
1926
1927         {
1928                 uint32_t resume_handle = 0;
1929                 struct lsa_DomainList domains;
1930                 int i;
1931
1932                 status = rpccli_lsa_EnumTrustDom(cli, mem_ctx,
1933                                                  &handle,
1934                                                  &resume_handle,
1935                                                  &domains,
1936                                                  0xffff);
1937                 if (!NT_STATUS_IS_OK(status)) {
1938                         goto done;
1939                 }
1940
1941                 for (i=0; i < domains.count; i++) {
1942                         if (strequal(domains.domains[i].name.string, argv[1])) {
1943                                 sid = domains.domains[i].sid;
1944                                 break;
1945                         }
1946                 }
1947
1948                 if (!sid) {
1949                         return NT_STATUS_INVALID_SID;
1950                 }
1951         }
1952
1953         status = rpccli_lsa_OpenTrustedDomain(cli, mem_ctx,
1954                                               &handle,
1955                                               sid,
1956                                               SEC_FLAG_MAXIMUM_ALLOWED,
1957                                               &trustdom_handle);
1958         if (!NT_STATUS_IS_OK(status)) {
1959                 goto done;
1960         }
1961
1962  delete_object:
1963         status = rpccli_lsa_DeleteObject(cli, mem_ctx,
1964                                          &trustdom_handle);
1965         if (!NT_STATUS_IS_OK(status)) {
1966                 goto done;
1967         }
1968
1969  done:
1970         if (is_valid_policy_hnd(&trustdom_handle)) {
1971                 rpccli_lsa_Close(cli, mem_ctx, &trustdom_handle);
1972         }
1973
1974         if (is_valid_policy_hnd(&handle)) {
1975                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1976         }
1977
1978         return status;
1979 }
1980
1981
1982 /* List of commands exported by this module */
1983
1984 struct cmd_set lsarpc_commands[] = {
1985
1986         { "LSARPC" },
1987
1988         { "lsaquery",            RPC_RTYPE_NTSTATUS, cmd_lsa_query_info_policy,  NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query info policy",                    "" },
1989         { "lookupsids",          RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids,        NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert SIDs to names",                "" },
1990         { "lookupsids3",         RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids3,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert SIDs to names",                "" },
1991         { "lookupnames",         RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1992         { "lookupnames4",        RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names4,      NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1993         { "lookupnames_level",   RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names_level, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1994         { "enumtrust",           RPC_RTYPE_NTSTATUS, cmd_lsa_enum_trust_dom,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate trusted domains",            "Usage: [preferred max number] [enum context (0)]" },
1995         { "enumprivs",           RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privilege,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate privileges",                 "" },
1996         { "getdispname",         RPC_RTYPE_NTSTATUS, cmd_lsa_get_dispname,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get the privilege name",               "" },
1997         { "lsaenumsid",          RPC_RTYPE_NTSTATUS, cmd_lsa_enum_sids,          NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the LSA SIDS",               "" },
1998         { "lsacreateaccount",    RPC_RTYPE_NTSTATUS, cmd_lsa_create_account,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create a new lsa account",   "" },
1999         { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privsaccounts, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the privileges of an SID",   "" },
2000         { "lsaenumacctrights",   RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_rights,   NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the rights of an SID",   "" },
2001         { "lsaaddpriv",          RPC_RTYPE_NTSTATUS, cmd_lsa_add_priv,           NULL, &ndr_table_lsarpc.syntax_id, NULL, "Assign a privilege to a SID", "" },
2002         { "lsadelpriv",          RPC_RTYPE_NTSTATUS, cmd_lsa_del_priv,           NULL, &ndr_table_lsarpc.syntax_id, NULL, "Revoke a privilege from a SID", "" },
2003         { "lsaaddacctrights",    RPC_RTYPE_NTSTATUS, cmd_lsa_add_acct_rights,    NULL, &ndr_table_lsarpc.syntax_id, NULL, "Add rights to an account",   "" },
2004         { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_remove_acct_rights, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Remove rights from an account",   "" },
2005         { "lsalookupprivvalue",  RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_priv_value,  NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get a privilege value given its name", "" },
2006         { "lsaquerysecobj",      RPC_RTYPE_NTSTATUS, cmd_lsa_query_secobj,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA security object", "" },
2007         { "lsaquerytrustdominfo",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfo, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a SID)", "" },
2008         { "lsaquerytrustdominfobyname",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobyname, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a name), only works for Windows > 2k", "" },
2009         { "lsaquerytrustdominfobysid",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobysid, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a SID)", "" },
2010         { "getusername",          RPC_RTYPE_NTSTATUS, cmd_lsa_get_username, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get username", "" },
2011         { "createsecret",         RPC_RTYPE_NTSTATUS, cmd_lsa_create_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create Secret", "" },
2012         { "deletesecret",         RPC_RTYPE_NTSTATUS, cmd_lsa_delete_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Delete Secret", "" },
2013         { "querysecret",          RPC_RTYPE_NTSTATUS, cmd_lsa_query_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query Secret", "" },
2014         { "setsecret",            RPC_RTYPE_NTSTATUS, cmd_lsa_set_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Set Secret", "" },
2015         { "retrieveprivatedata",  RPC_RTYPE_NTSTATUS, cmd_lsa_retrieve_private_data, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Retrieve Private Data", "" },
2016         { "storeprivatedata",     RPC_RTYPE_NTSTATUS, cmd_lsa_store_private_data, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Store Private Data", "" },
2017         { "createtrustdom",       RPC_RTYPE_NTSTATUS, cmd_lsa_create_trusted_domain, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create Trusted Domain", "" },
2018         { "deletetrustdom",       RPC_RTYPE_NTSTATUS, cmd_lsa_delete_trusted_domain, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Delete Trusted Domain", "" },
2019
2020         { NULL }
2021 };
2022