source3/rpcclient/cmd_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4
   5    Copyright (C) Tim Potter              2000
   6    Copyright (C) Rafal Szczesniak        2002
   7    Copyright (C) Guenther Deschner       2008
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpcclient.h"
  25 #include "../libcli/auth/libcli_auth.h"
  26 #include "../librpc/gen_ndr/ndr_lsa.h"
  27 #include "../librpc/gen_ndr/cli_lsa.h"
  28 #include "rpc_client/cli_lsarpc.h"
  29 #include "rpc_client/init_lsa.h"
  30 #include "../libcli/security/security.h"
  31
  32 /* useful function to allow entering a name instead of a SID and
  33  * looking it up automatically */
  34 static NTSTATUS name_to_sid(struct rpc_pipe_client *cli,
  35                             TALLOC_CTX *mem_ctx,
  36                             struct dom_sid *sid, const char *name)
  37 {
  38         struct policy_handle pol;
  39         enum lsa_SidType *sid_types;
  40         NTSTATUS result;
  41         struct dom_sid *sids;
  42
  43         /* maybe its a raw SID */
  44         if (strncmp(name, "S-", 2) == 0 &&
  45             string_to_sid(sid, name)) {
  46                 return NT_STATUS_OK;
  47         }
  48
  49         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
  50                                      SEC_FLAG_MAXIMUM_ALLOWED,
  51                                      &pol);
  52         if (!NT_STATUS_IS_OK(result))
  53                 goto done;
  54
  55         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, NULL, 1, &sids, &sid_types);
  56         if (!NT_STATUS_IS_OK(result))
  57                 goto done;
  58
  59         rpccli_lsa_Close(cli, mem_ctx, &pol);
  60
  61         *sid = sids[0];
  62
  63 done:
  64         return result;
  65 }
  66
  67 static void display_query_info_1(struct lsa_AuditLogInfo *r)
  68 {
  69         d_printf("percent_full:\t%d\n", r->percent_full);
  70         d_printf("maximum_log_size:\t%d\n", r->maximum_log_size);
  71         d_printf("retention_time:\t%lld\n", (long long)r->retention_time);
  72         d_printf("shutdown_in_progress:\t%d\n", r->shutdown_in_progress);
  73         d_printf("time_to_shutdown:\t%lld\n", (long long)r->time_to_shutdown);
  74         d_printf("next_audit_record:\t%d\n", r->next_audit_record);
  75 }
  76
  77 static void display_query_info_2(struct lsa_AuditEventsInfo *r)
  78 {
  79         int i;
  80         d_printf("Auditing enabled:\t%d\n", r->auditing_mode);
  81         d_printf("Auditing categories:\t%d\n", r->count);
  82         d_printf("Auditsettings:\n");
  83         for (i=0; i<r->count; i++) {
  84                 const char *val = audit_policy_str(talloc_tos(), r->settings[i]);
  85                 const char *policy = audit_description_str(i);
  86                 d_printf("%s:\t%s\n", policy, val);
  87         }
  88 }
  89
  90 static void display_query_info_3(struct lsa_DomainInfo *r)
  91 {
  92         d_printf("Domain Name: %s\n", r->name.string);
  93         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
  94 }
  95
  96 static void display_query_info_5(struct lsa_DomainInfo *r)
  97 {
  98         d_printf("Domain Name: %s\n", r->name.string);
  99         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
 100 }
 101
 102 static void display_query_info_10(struct lsa_AuditFullSetInfo *r)
 103 {
 104         d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
 105 }
 106
 107 static void display_query_info_11(struct lsa_AuditFullQueryInfo *r)
 108 {
 109         d_printf("Shutdown on full: %d\n", r->shutdown_on_full);
 110         d_printf("Log is full: %d\n", r->log_is_full);
 111 }
 112
 113 static void display_query_info_12(struct lsa_DnsDomainInfo *r)
 114 {
 115         d_printf("Domain NetBios Name: %s\n", r->name.string);
 116         d_printf("Domain DNS Name: %s\n", r->dns_domain.string);
 117         d_printf("Domain Forest Name: %s\n", r->dns_forest.string);
 118         d_printf("Domain Sid: %s\n", sid_string_tos(r->sid));
 119         d_printf("Domain GUID: %s\n", GUID_string(talloc_tos(),
 120                                                       &r->domain_guid));
 121 }
 122
 123 static void display_lsa_query_info(union lsa_PolicyInformation *info,
 124                                    enum lsa_PolicyInfo level)
 125 {
 126         switch (level) {
 127                 case 1:
 128                         display_query_info_1(&info->audit_log);
 129                         break;
 130                 case 2:
 131                         display_query_info_2(&info->audit_events);
 132                         break;
 133                 case 3:
 134                         display_query_info_3(&info->domain);
 135                         break;
 136                 case 5:
 137                         display_query_info_5(&info->account_domain);
 138                         break;
 139                 case 10:
 140                         display_query_info_10(&info->auditfullset);
 141                         break;
 142                 case 11:
 143                         display_query_info_11(&info->auditfullquery);
 144                         break;
 145                 case 12:
 146                         display_query_info_12(&info->dns);
 147                         break;
 148                 default:
 149                         printf("can't display info level: %d\n", level);
 150                         break;
 151         }
 152 }
 153
 154 static NTSTATUS cmd_lsa_query_info_policy(struct rpc_pipe_client *cli,
 155                                           TALLOC_CTX *mem_ctx, int argc,
 156                                           const char **argv)
 157 {
 158         struct policy_handle pol;
 159         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 160         union lsa_PolicyInformation *info = NULL;
 161
 162         uint32 info_class = 3;
 163
 164         if (argc > 2) {
 165                 printf("Usage: %s [info_class]\n", argv[0]);
 166                 return NT_STATUS_OK;
 167         }
 168
 169         if (argc == 2)
 170                 info_class = atoi(argv[1]);
 171
 172         switch (info_class) {
 173         case 12:
 174                 result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 175                                                  SEC_FLAG_MAXIMUM_ALLOWED,
 176                                                  &pol);
 177
 178                 if (!NT_STATUS_IS_OK(result))
 179                         goto done;
 180
 181                 result = rpccli_lsa_QueryInfoPolicy2(cli, mem_ctx,
 182                                                      &pol,
 183                                                      info_class,
 184                                                      &info);
 185                 break;
 186         default:
 187                 result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 188                                                 SEC_FLAG_MAXIMUM_ALLOWED,
 189                                                 &pol);
 190
 191                 if (!NT_STATUS_IS_OK(result))
 192                         goto done;
 193
 194                 result = rpccli_lsa_QueryInfoPolicy(cli, mem_ctx,
 195                                                     &pol,
 196                                                     info_class,
 197                                                     &info);
 198         }
 199
 200         if (NT_STATUS_IS_OK(result)) {
 201                 display_lsa_query_info(info, info_class);
 202         }
 203
 204         rpccli_lsa_Close(cli, mem_ctx, &pol);
 205
 206  done:
 207         return result;
 208 }
 209
 210 /* Resolve a list of names to a list of sids */
 211
 212 static NTSTATUS cmd_lsa_lookup_names(struct rpc_pipe_client *cli,
 213                                      TALLOC_CTX *mem_ctx, int argc,
 214                                      const char **argv)
 215 {
 216         struct policy_handle pol;
 217         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 218         struct dom_sid *sids;
 219         enum lsa_SidType *types;
 220         int i;
 221
 222         if (argc == 1) {
 223                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 224                 return NT_STATUS_OK;
 225         }
 226
 227         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 228                                      SEC_FLAG_MAXIMUM_ALLOWED,
 229                                      &pol);
 230
 231         if (!NT_STATUS_IS_OK(result))
 232                 goto done;
 233
 234         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
 235                                       (const char**)(argv + 1), NULL, 1, &sids, &types);
 236
 237         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 238             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 239                 goto done;
 240
 241         result = NT_STATUS_OK;
 242
 243         /* Print results */
 244
 245         for (i = 0; i < (argc - 1); i++) {
 246                 fstring sid_str;
 247                 sid_to_fstring(sid_str, &sids[i]);
 248                 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
 249                        sid_type_lookup(types[i]), types[i]);
 250         }
 251
 252         rpccli_lsa_Close(cli, mem_ctx, &pol);
 253
 254  done:
 255         return result;
 256 }
 257
 258 /* Resolve a list of names to a list of sids */
 259
 260 static NTSTATUS cmd_lsa_lookup_names_level(struct rpc_pipe_client *cli,
 261                                            TALLOC_CTX *mem_ctx, int argc,
 262                                            const char **argv)
 263 {
 264         struct policy_handle pol;
 265         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 266         struct dom_sid *sids;
 267         enum lsa_SidType *types;
 268         int i, level;
 269
 270         if (argc < 3) {
 271                 printf("Usage: %s [level] [name1 [name2 [...]]]\n", argv[0]);
 272                 return NT_STATUS_OK;
 273         }
 274
 275         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 276                                      SEC_FLAG_MAXIMUM_ALLOWED,
 277                                      &pol);
 278
 279         if (!NT_STATUS_IS_OK(result))
 280                 goto done;
 281
 282         level = atoi(argv[1]);
 283
 284         result = rpccli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 2,
 285                                       (const char**)(argv + 2), NULL, level, &sids, &types);
 286
 287         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 288             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 289                 goto done;
 290
 291         result = NT_STATUS_OK;
 292
 293         /* Print results */
 294
 295         for (i = 0; i < (argc - 2); i++) {
 296                 fstring sid_str;
 297                 sid_to_fstring(sid_str, &sids[i]);
 298                 printf("%s %s (%s: %d)\n", argv[i + 2], sid_str,
 299                        sid_type_lookup(types[i]), types[i]);
 300         }
 301
 302         rpccli_lsa_Close(cli, mem_ctx, &pol);
 303
 304  done:
 305         return result;
 306 }
 307
 308 static NTSTATUS cmd_lsa_lookup_names4(struct rpc_pipe_client *cli,
 309                                       TALLOC_CTX *mem_ctx, int argc,
 310                                       const char **argv)
 311 {
 312         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 313
 314         uint32_t num_names;
 315         struct lsa_String *names;
 316         struct lsa_RefDomainList *domains;
 317         struct lsa_TransSidArray3 sids;
 318         uint32_t count = 0;
 319         int i;
 320
 321         if (argc == 1) {
 322                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 323                 return NT_STATUS_OK;
 324         }
 325
 326         ZERO_STRUCT(sids);
 327
 328         num_names = argc-1;
 329         names = talloc_array(mem_ctx, struct lsa_String, num_names);
 330         NT_STATUS_HAVE_NO_MEMORY(names);
 331
 332         for (i=0; i < num_names; i++) {
 333                 init_lsa_String(&names[i], argv[i+1]);
 334         }
 335
 336         result = rpccli_lsa_LookupNames4(cli, mem_ctx,
 337                                          num_names,
 338                                          names,
 339                                          &domains,
 340                                          &sids,
 341                                          1,
 342                                          &count,
 343                                          0,
 344                                          0);
 345         if (!NT_STATUS_IS_OK(result)) {
 346                 return result;
 347         }
 348
 349         for (i = 0; i < sids.count; i++) {
 350                 fstring sid_str;
 351                 sid_to_fstring(sid_str, sids.sids[i].sid);
 352                 printf("%s %s (%s: %d)\n", argv[i+1], sid_str,
 353                        sid_type_lookup(sids.sids[i].sid_type),
 354                        sids.sids[i].sid_type);
 355         }
 356
 357         return result;
 358 }
 359
 360 /* Resolve a list of SIDs to a list of names */
 361
 362 static NTSTATUS cmd_lsa_lookup_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx,
 363                                     int argc, const char **argv)
 364 {
 365         struct policy_handle pol;
 366         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 367         struct dom_sid *sids;
 368         char **domains;
 369         char **names;
 370         enum lsa_SidType *types;
 371         int i;
 372
 373         if (argc == 1) {
 374                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 375                 return NT_STATUS_OK;
 376         }
 377
 378         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 379                                      SEC_FLAG_MAXIMUM_ALLOWED,
 380                                      &pol);
 381
 382         if (!NT_STATUS_IS_OK(result))
 383                 goto done;
 384
 385         /* Convert arguments to sids */
 386
 387         sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, argc - 1);
 388
 389         if (!sids) {
 390                 printf("could not allocate memory for %d sids\n", argc - 1);
 391                 goto done;
 392         }
 393
 394         for (i = 0; i < argc - 1; i++)
 395                 if (!string_to_sid(&sids[i], argv[i + 1])) {
 396                         result = NT_STATUS_INVALID_SID;
 397                         goto done;
 398                 }
 399
 400         /* Lookup the SIDs */
 401
 402         result = rpccli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
 403                                      &domains, &names, &types);
 404
 405         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 406             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 407                 goto done;
 408
 409         result = NT_STATUS_OK;
 410
 411         /* Print results */
 412
 413         for (i = 0; i < (argc - 1); i++) {
 414                 fstring sid_str;
 415
 416                 sid_to_fstring(sid_str, &sids[i]);
 417                 printf("%s %s\\%s (%d)\n", sid_str,
 418                        domains[i] ? domains[i] : "*unknown*",
 419                        names[i] ? names[i] : "*unknown*", types[i]);
 420         }
 421
 422         rpccli_lsa_Close(cli, mem_ctx, &pol);
 423
 424  done:
 425         return result;
 426 }
 427
 428 /* Resolve a list of SIDs to a list of names */
 429
 430 static NTSTATUS cmd_lsa_lookup_sids3(struct rpc_pipe_client *cli,
 431                                      TALLOC_CTX *mem_ctx,
 432                                      int argc, const char **argv)
 433 {
 434         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 435         int i;
 436         struct lsa_SidArray sids;
 437         struct lsa_RefDomainList *domains;
 438         struct lsa_TransNameArray2 names;
 439         uint32_t count = 0;
 440
 441         if (argc == 1) {
 442                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 443                 return NT_STATUS_OK;
 444         }
 445
 446         ZERO_STRUCT(names);
 447
 448         /* Convert arguments to sids */
 449
 450         sids.num_sids = argc-1;
 451         sids.sids = talloc_array(mem_ctx, struct lsa_SidPtr, sids.num_sids);
 452         if (!sids.sids) {
 453                 printf("could not allocate memory for %d sids\n", sids.num_sids);
 454                 goto done;
 455         }
 456
 457         for (i = 0; i < sids.num_sids; i++) {
 458                 sids.sids[i].sid = talloc(sids.sids, struct dom_sid);
 459                 if (sids.sids[i].sid == NULL) {
 460                         result = NT_STATUS_NO_MEMORY;
 461                         goto done;
 462                 }
 463                 if (!string_to_sid(sids.sids[i].sid, argv[i+1])) {
 464                         result = NT_STATUS_INVALID_SID;
 465                         goto done;
 466                 }
 467         }
 468
 469         /* Lookup the SIDs */
 470         result = rpccli_lsa_LookupSids3(cli, mem_ctx,
 471                                         &sids,
 472                                         &domains,
 473                                         &names,
 474                                         1,
 475                                         &count,
 476                                         0,
 477                                         0);
 478
 479         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 480             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 481                 goto done;
 482
 483         result = NT_STATUS_OK;
 484
 485         /* Print results */
 486
 487         for (i = 0; i < count; i++) {
 488                 fstring sid_str;
 489
 490                 sid_to_fstring(sid_str, sids.sids[i].sid);
 491                 printf("%s %s (%d)\n", sid_str,
 492                        names.names[i].name.string,
 493                        names.names[i].sid_type);
 494         }
 495
 496  done:
 497         return result;
 498 }
 499
 500
 501 /* Enumerate list of trusted domains */
 502
 503 static NTSTATUS cmd_lsa_enum_trust_dom(struct rpc_pipe_client *cli,
 504                                        TALLOC_CTX *mem_ctx, int argc,
 505                                        const char **argv)
 506 {
 507         struct policy_handle pol;
 508         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 509         struct lsa_DomainList domain_list;
 510
 511         /* defaults, but may be changed using params */
 512         uint32 enum_ctx = 0;
 513         int i;
 514         uint32_t max_size = (uint32_t)-1;
 515
 516         if (argc > 2) {
 517                 printf("Usage: %s [enum context (0)]\n", argv[0]);
 518                 return NT_STATUS_OK;
 519         }
 520
 521         if (argc == 2 && argv[1]) {
 522                 enum_ctx = atoi(argv[2]);
 523         }
 524
 525         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 526                                      LSA_POLICY_VIEW_LOCAL_INFORMATION,
 527                                      &pol);
 528
 529         if (!NT_STATUS_IS_OK(result))
 530                 goto done;
 531
 532         result = STATUS_MORE_ENTRIES;
 533
 534         while (NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES)) {
 535
 536                 /* Lookup list of trusted domains */
 537
 538                 result = rpccli_lsa_EnumTrustDom(cli, mem_ctx,
 539                                                  &pol,
 540                                                  &enum_ctx,
 541                                                  &domain_list,
 542                                                  max_size);
 543                 if (!NT_STATUS_IS_OK(result) &&
 544                     !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
 545                     !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
 546                         goto done;
 547
 548                 /* Print results: list of names and sids returned in this
 549                  * response. */
 550                 for (i = 0; i < domain_list.count; i++) {
 551                         fstring sid_str;
 552
 553                         sid_to_fstring(sid_str, domain_list.domains[i].sid);
 554                         printf("%s %s\n",
 555                                 domain_list.domains[i].name.string ?
 556                                 domain_list.domains[i].name.string : "*unknown*",
 557                                 sid_str);
 558                 }
 559         }
 560
 561         rpccli_lsa_Close(cli, mem_ctx, &pol);
 562  done:
 563         return result;
 564 }
 565
 566 /* Enumerates privileges */
 567
 568 static NTSTATUS cmd_lsa_enum_privilege(struct rpc_pipe_client *cli,
 569                                        TALLOC_CTX *mem_ctx, int argc,
 570                                        const char **argv)
 571 {
 572         struct policy_handle pol;
 573         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 574         struct lsa_PrivArray priv_array;
 575
 576         uint32 enum_context=0;
 577         uint32 pref_max_length=0x1000;
 578         int i;
 579
 580         if (argc > 3) {
 581                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 582                 return NT_STATUS_OK;
 583         }
 584
 585         if (argc>=2)
 586                 enum_context=atoi(argv[1]);
 587
 588         if (argc==3)
 589                 pref_max_length=atoi(argv[2]);
 590
 591         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 592                                      SEC_FLAG_MAXIMUM_ALLOWED,
 593                                      &pol);
 594
 595         if (!NT_STATUS_IS_OK(result))
 596                 goto done;
 597
 598         result = rpccli_lsa_EnumPrivs(cli, mem_ctx,
 599                                       &pol,
 600                                       &enum_context,
 601                                       &priv_array,
 602                                       pref_max_length);
 603         if (!NT_STATUS_IS_OK(result))
 604                 goto done;
 605
 606         /* Print results */
 607         printf("found %d privileges\n\n", priv_array.count);
 608
 609         for (i = 0; i < priv_array.count; i++) {
 610                 printf("%s \t\t%d:%d (0x%x:0x%x)\n",
 611                        priv_array.privs[i].name.string ? priv_array.privs[i].name.string : "*unknown*",
 612                        priv_array.privs[i].luid.high,
 613                        priv_array.privs[i].luid.low,
 614                        priv_array.privs[i].luid.high,
 615                        priv_array.privs[i].luid.low);
 616         }
 617
 618         rpccli_lsa_Close(cli, mem_ctx, &pol);
 619  done:
 620         return result;
 621 }
 622
 623 /* Get privilege name */
 624
 625 static NTSTATUS cmd_lsa_get_dispname(struct rpc_pipe_client *cli,
 626                                      TALLOC_CTX *mem_ctx, int argc,
 627                                      const char **argv)
 628 {
 629         struct policy_handle pol;
 630         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 631
 632         uint16 lang_id=0;
 633         uint16 lang_id_sys=0;
 634         uint16 lang_id_desc;
 635         struct lsa_String lsa_name;
 636         struct lsa_StringLarge *description = NULL;
 637
 638         if (argc != 2) {
 639                 printf("Usage: %s privilege name\n", argv[0]);
 640                 return NT_STATUS_OK;
 641         }
 642
 643         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 644                                      SEC_FLAG_MAXIMUM_ALLOWED,
 645                                      &pol);
 646
 647         if (!NT_STATUS_IS_OK(result))
 648                 goto done;
 649
 650         init_lsa_String(&lsa_name, argv[1]);
 651
 652         result = rpccli_lsa_LookupPrivDisplayName(cli, mem_ctx,
 653                                                   &pol,
 654                                                   &lsa_name,
 655                                                   lang_id,
 656                                                   lang_id_sys,
 657                                                   &description,
 658                                                   &lang_id_desc);
 659
 660         if (!NT_STATUS_IS_OK(result))
 661                 goto done;
 662
 663         /* Print results */
 664         printf("%s -> %s (language: 0x%x)\n", argv[1], description->string, lang_id_desc);
 665
 666         rpccli_lsa_Close(cli, mem_ctx, &pol);
 667  done:
 668         return result;
 669 }
 670
 671 /* Enumerate the LSA SIDS */
 672
 673 static NTSTATUS cmd_lsa_enum_sids(struct rpc_pipe_client *cli,
 674                                   TALLOC_CTX *mem_ctx, int argc,
 675                                   const char **argv)
 676 {
 677         struct policy_handle pol;
 678         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 679
 680         uint32 enum_context=0;
 681         uint32 pref_max_length=0x1000;
 682         struct lsa_SidArray sid_array;
 683         int i;
 684
 685         if (argc > 3) {
 686                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 687                 return NT_STATUS_OK;
 688         }
 689
 690         if (argc>=2)
 691                 enum_context=atoi(argv[1]);
 692
 693         if (argc==3)
 694                 pref_max_length=atoi(argv[2]);
 695
 696         result = rpccli_lsa_open_policy(cli, mem_ctx, True,
 697                                      SEC_FLAG_MAXIMUM_ALLOWED,
 698                                      &pol);
 699
 700         if (!NT_STATUS_IS_OK(result))
 701                 goto done;
 702
 703         result = rpccli_lsa_EnumAccounts(cli, mem_ctx,
 704                                          &pol,
 705                                          &enum_context,
 706                                          &sid_array,
 707                                          pref_max_length);
 708
 709         if (!NT_STATUS_IS_OK(result))
 710                 goto done;
 711
 712         /* Print results */
 713         printf("found %d SIDs\n\n", sid_array.num_sids);
 714
 715         for (i = 0; i < sid_array.num_sids; i++) {
 716                 fstring sid_str;
 717
 718                 sid_to_fstring(sid_str, sid_array.sids[i].sid);
 719                 printf("%s\n", sid_str);
 720         }
 721
 722         rpccli_lsa_Close(cli, mem_ctx, &pol);
 723  done:
 724         return result;
 725 }
 726
 727 /* Create a new account */
 728
 729 static NTSTATUS cmd_lsa_create_account(struct rpc_pipe_client *cli,
 730                                            TALLOC_CTX *mem_ctx, int argc,
 731                                            const char **argv)
 732 {
 733         struct policy_handle dom_pol;
 734         struct policy_handle user_pol;
 735         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 736         uint32 des_access = 0x000f000f;
 737
 738         struct dom_sid sid;
 739
 740         if (argc != 2 ) {
 741                 printf("Usage: %s SID\n", argv[0]);
 742                 return NT_STATUS_OK;
 743         }
 744
 745         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 746         if (!NT_STATUS_IS_OK(result))
 747                 goto done;
 748
 749         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 750                                      SEC_FLAG_MAXIMUM_ALLOWED,
 751                                      &dom_pol);
 752
 753         if (!NT_STATUS_IS_OK(result))
 754                 goto done;
 755
 756         result = rpccli_lsa_CreateAccount(cli, mem_ctx,
 757                                           &dom_pol,
 758                                           &sid,
 759                                           des_access,
 760                                           &user_pol);
 761
 762         if (!NT_STATUS_IS_OK(result))
 763                 goto done;
 764
 765         printf("Account for SID %s successfully created\n\n", argv[1]);
 766         result = NT_STATUS_OK;
 767
 768         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 769  done:
 770         return result;
 771 }
 772
 773
 774 /* Enumerate the privileges of an SID */
 775
 776 static NTSTATUS cmd_lsa_enum_privsaccounts(struct rpc_pipe_client *cli,
 777                                            TALLOC_CTX *mem_ctx, int argc,
 778                                            const char **argv)
 779 {
 780         struct policy_handle dom_pol;
 781         struct policy_handle user_pol;
 782         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 783         uint32 access_desired = 0x000f000f;
 784         struct dom_sid sid;
 785         struct lsa_PrivilegeSet *privs = NULL;
 786         int i;
 787
 788         if (argc != 2 ) {
 789                 printf("Usage: %s SID\n", argv[0]);
 790                 return NT_STATUS_OK;
 791         }
 792
 793         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 794         if (!NT_STATUS_IS_OK(result))
 795                 goto done;
 796
 797         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 798                                      SEC_FLAG_MAXIMUM_ALLOWED,
 799                                      &dom_pol);
 800
 801         if (!NT_STATUS_IS_OK(result))
 802                 goto done;
 803
 804         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
 805                                         &dom_pol,
 806                                         &sid,
 807                                         access_desired,
 808                                         &user_pol);
 809
 810         if (!NT_STATUS_IS_OK(result))
 811                 goto done;
 812
 813         result = rpccli_lsa_EnumPrivsAccount(cli, mem_ctx,
 814                                              &user_pol,
 815                                              &privs);
 816
 817         if (!NT_STATUS_IS_OK(result))
 818                 goto done;
 819
 820         /* Print results */
 821         printf("found %d privileges for SID %s\n\n", privs->count, argv[1]);
 822         printf("high\tlow\tattribute\n");
 823
 824         for (i = 0; i < privs->count; i++) {
 825                 printf("%u\t%u\t%u\n",
 826                         privs->set[i].luid.high,
 827                         privs->set[i].luid.low,
 828                         privs->set[i].attribute);
 829         }
 830
 831         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 832  done:
 833         return result;
 834 }
 835
 836
 837 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
 838
 839 static NTSTATUS cmd_lsa_enum_acct_rights(struct rpc_pipe_client *cli,
 840                                          TALLOC_CTX *mem_ctx, int argc,
 841                                          const char **argv)
 842 {
 843         struct policy_handle dom_pol;
 844         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 845         struct dom_sid sid;
 846         struct lsa_RightSet rights;
 847
 848         int i;
 849
 850         if (argc != 2 ) {
 851                 printf("Usage: %s SID\n", argv[0]);
 852                 return NT_STATUS_OK;
 853         }
 854
 855         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 856         if (!NT_STATUS_IS_OK(result))
 857                 goto done;
 858
 859         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 860                                      SEC_FLAG_MAXIMUM_ALLOWED,
 861                                      &dom_pol);
 862
 863         if (!NT_STATUS_IS_OK(result))
 864                 goto done;
 865
 866         result = rpccli_lsa_EnumAccountRights(cli, mem_ctx,
 867                                               &dom_pol,
 868                                               &sid,
 869                                               &rights);
 870
 871         if (!NT_STATUS_IS_OK(result))
 872                 goto done;
 873
 874         printf("found %d privileges for SID %s\n", rights.count,
 875                sid_string_tos(&sid));
 876
 877         for (i = 0; i < rights.count; i++) {
 878                 printf("\t%s\n", rights.names[i].string);
 879         }
 880
 881         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 882  done:
 883         return result;
 884 }
 885
 886
 887 /* add some privileges to a SID via LsaAddAccountRights */
 888
 889 static NTSTATUS cmd_lsa_add_acct_rights(struct rpc_pipe_client *cli,
 890                                         TALLOC_CTX *mem_ctx, int argc,
 891                                         const char **argv)
 892 {
 893         struct policy_handle dom_pol;
 894         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 895         struct lsa_RightSet rights;
 896         struct dom_sid sid;
 897         int i;
 898
 899         if (argc < 3 ) {
 900                 printf("Usage: %s SID [rights...]\n", argv[0]);
 901                 return NT_STATUS_OK;
 902         }
 903
 904         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 905         if (!NT_STATUS_IS_OK(result))
 906                 goto done;
 907
 908         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 909                                      SEC_FLAG_MAXIMUM_ALLOWED,
 910                                      &dom_pol);
 911
 912         if (!NT_STATUS_IS_OK(result))
 913                 goto done;
 914
 915         rights.count = argc-2;
 916         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 917                                     rights.count);
 918         if (!rights.names) {
 919                 return NT_STATUS_NO_MEMORY;
 920         }
 921
 922         for (i=0; i<argc-2; i++) {
 923                 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
 924         }
 925
 926         result = rpccli_lsa_AddAccountRights(cli, mem_ctx,
 927                                              &dom_pol,
 928                                              &sid,
 929                                              &rights);
 930
 931         if (!NT_STATUS_IS_OK(result))
 932                 goto done;
 933
 934         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 935  done:
 936         return result;
 937 }
 938
 939
 940 /* remove some privileges to a SID via LsaRemoveAccountRights */
 941
 942 static NTSTATUS cmd_lsa_remove_acct_rights(struct rpc_pipe_client *cli,
 943                                         TALLOC_CTX *mem_ctx, int argc,
 944                                         const char **argv)
 945 {
 946         struct policy_handle dom_pol;
 947         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 948         struct lsa_RightSet rights;
 949         struct dom_sid sid;
 950         int i;
 951
 952         if (argc < 3 ) {
 953                 printf("Usage: %s SID [rights...]\n", argv[0]);
 954                 return NT_STATUS_OK;
 955         }
 956
 957         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 958         if (!NT_STATUS_IS_OK(result))
 959                 goto done;
 960
 961         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
 962                                      SEC_FLAG_MAXIMUM_ALLOWED,
 963                                      &dom_pol);
 964
 965         if (!NT_STATUS_IS_OK(result))
 966                 goto done;
 967
 968         rights.count = argc-2;
 969         rights.names = TALLOC_ARRAY(mem_ctx, struct lsa_StringLarge,
 970                                     rights.count);
 971         if (!rights.names) {
 972                 return NT_STATUS_NO_MEMORY;
 973         }
 974
 975         for (i=0; i<argc-2; i++) {
 976                 init_lsa_StringLarge(&rights.names[i], argv[i+2]);
 977         }
 978
 979         result = rpccli_lsa_RemoveAccountRights(cli, mem_ctx,
 980                                                 &dom_pol,
 981                                                 &sid,
 982                                                 false,
 983                                                 &rights);
 984
 985         if (!NT_STATUS_IS_OK(result))
 986                 goto done;
 987
 988         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
 989
 990  done:
 991         return result;
 992 }
 993
 994
 995 /* Get a privilege value given its name */
 996
 997 static NTSTATUS cmd_lsa_lookup_priv_value(struct rpc_pipe_client *cli,
 998                                         TALLOC_CTX *mem_ctx, int argc,
 999                                         const char **argv)
1000 {
1001         struct policy_handle pol;
1002         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1003         struct lsa_LUID luid;
1004         struct lsa_String name;
1005
1006         if (argc != 2 ) {
1007                 printf("Usage: %s name\n", argv[0]);
1008                 return NT_STATUS_OK;
1009         }
1010
1011         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1012                                      SEC_FLAG_MAXIMUM_ALLOWED,
1013                                      &pol);
1014
1015         if (!NT_STATUS_IS_OK(result))
1016                 goto done;
1017
1018         init_lsa_String(&name, argv[1]);
1019
1020         result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1021                                             &pol,
1022                                             &name,
1023                                             &luid);
1024
1025         if (!NT_STATUS_IS_OK(result))
1026                 goto done;
1027
1028         /* Print results */
1029
1030         printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
1031
1032         rpccli_lsa_Close(cli, mem_ctx, &pol);
1033  done:
1034         return result;
1035 }
1036
1037 /* Query LSA security object */
1038
1039 static NTSTATUS cmd_lsa_query_secobj(struct rpc_pipe_client *cli,
1040                                      TALLOC_CTX *mem_ctx, int argc,
1041                                      const char **argv)
1042 {
1043         struct policy_handle pol;
1044         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1045         struct sec_desc_buf *sdb;
1046         uint32 sec_info = SECINFO_DACL;
1047
1048         if (argc < 1 || argc > 2) {
1049                 printf("Usage: %s [sec_info]\n", argv[0]);
1050                 return NT_STATUS_OK;
1051         }
1052
1053         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1054                                       SEC_FLAG_MAXIMUM_ALLOWED,
1055                                       &pol);
1056
1057         if (argc == 2)
1058                 sscanf(argv[1], "%x", &sec_info);
1059
1060         if (!NT_STATUS_IS_OK(result))
1061                 goto done;
1062
1063         result = rpccli_lsa_QuerySecurity(cli, mem_ctx,
1064                                           &pol,
1065                                           sec_info,
1066                                           &sdb);
1067         if (!NT_STATUS_IS_OK(result))
1068                 goto done;
1069
1070         /* Print results */
1071
1072         display_sec_desc(sdb->sd);
1073
1074         rpccli_lsa_Close(cli, mem_ctx, &pol);
1075  done:
1076         return result;
1077 }
1078
1079 static void display_trust_dom_info_4(struct lsa_TrustDomainInfoPassword *p,
1080                                      uint8_t session_key[16])
1081 {
1082         char *pwd, *pwd_old;
1083
1084         DATA_BLOB data     = data_blob_const(p->password->data, p->password->length);
1085         DATA_BLOB data_old = data_blob_const(p->old_password->data, p->old_password->length);
1086         DATA_BLOB session_key_blob = data_blob_const(session_key, sizeof(session_key));
1087
1088         pwd     = sess_decrypt_string(talloc_tos(), &data, &session_key_blob);
1089         pwd_old = sess_decrypt_string(talloc_tos(), &data_old, &session_key_blob);
1090
1091         d_printf("Password:\t%s\n", pwd);
1092         d_printf("Old Password:\t%s\n", pwd_old);
1093
1094         talloc_free(pwd);
1095         talloc_free(pwd_old);
1096 }
1097
1098 static void display_trust_dom_info(TALLOC_CTX *mem_ctx,
1099                                    union lsa_TrustedDomainInfo *info,
1100                                    enum lsa_TrustDomInfoEnum info_class,
1101                                    uint8_t nt_hash[16])
1102 {
1103         switch (info_class) {
1104                 case LSA_TRUSTED_DOMAIN_INFO_PASSWORD:
1105                         display_trust_dom_info_4(&info->password, nt_hash);
1106                         break;
1107                 default: {
1108                         const char *str = NULL;
1109                         str = NDR_PRINT_UNION_STRING(mem_ctx,
1110                                                      lsa_TrustedDomainInfo,
1111                                                      info_class, info);
1112                         if (str) {
1113                                 d_printf("%s\n", str);
1114                         }
1115                         break;
1116                 }
1117         }
1118 }
1119
1120 static NTSTATUS cmd_lsa_query_trustdominfobysid(struct rpc_pipe_client *cli,
1121                                                 TALLOC_CTX *mem_ctx, int argc,
1122                                                 const char **argv)
1123 {
1124         struct policy_handle pol;
1125         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1126         struct dom_sid dom_sid;
1127         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1128         union lsa_TrustedDomainInfo *info = NULL;
1129         enum lsa_TrustDomInfoEnum info_class = 1;
1130         uint8_t nt_hash[16];
1131
1132         if (argc > 3 || argc < 2) {
1133                 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1134                 return NT_STATUS_OK;
1135         }
1136
1137         if (!string_to_sid(&dom_sid, argv[1]))
1138                 return NT_STATUS_NO_MEMORY;
1139
1140         if (argc == 3)
1141                 info_class = atoi(argv[2]);
1142
1143         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1144
1145         if (!NT_STATUS_IS_OK(result))
1146                 goto done;
1147
1148         result = rpccli_lsa_QueryTrustedDomainInfoBySid(cli, mem_ctx,
1149                                                         &pol,
1150                                                         &dom_sid,
1151                                                         info_class,
1152                                                         &info);
1153         if (!NT_STATUS_IS_OK(result))
1154                 goto done;
1155
1156         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1157                 d_fprintf(stderr, "Could not get pwd hash\n");
1158                 goto done;
1159         }
1160
1161         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1162
1163  done:
1164         rpccli_lsa_Close(cli, mem_ctx, &pol);
1165
1166         return result;
1167 }
1168
1169 static NTSTATUS cmd_lsa_query_trustdominfobyname(struct rpc_pipe_client *cli,
1170                                                  TALLOC_CTX *mem_ctx, int argc,
1171                                                  const char **argv)
1172 {
1173         struct policy_handle pol;
1174         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1175         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1176         union lsa_TrustedDomainInfo *info = NULL;
1177         enum lsa_TrustDomInfoEnum info_class = 1;
1178         struct lsa_String trusted_domain;
1179         uint8_t nt_hash[16];
1180
1181         if (argc > 3 || argc < 2) {
1182                 printf("Usage: %s [name] [info_class]\n", argv[0]);
1183                 return NT_STATUS_OK;
1184         }
1185
1186         if (argc == 3)
1187                 info_class = atoi(argv[2]);
1188
1189         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1190
1191         if (!NT_STATUS_IS_OK(result))
1192                 goto done;
1193
1194         init_lsa_String(&trusted_domain, argv[1]);
1195
1196         result = rpccli_lsa_QueryTrustedDomainInfoByName(cli, mem_ctx,
1197                                                          &pol,
1198                                                          &trusted_domain,
1199                                                          info_class,
1200                                                          &info);
1201         if (!NT_STATUS_IS_OK(result))
1202                 goto done;
1203
1204         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1205                 d_fprintf(stderr, "Could not get pwd hash\n");
1206                 goto done;
1207         }
1208
1209         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1210
1211  done:
1212         rpccli_lsa_Close(cli, mem_ctx, &pol);
1213
1214         return result;
1215 }
1216
1217 static NTSTATUS cmd_lsa_query_trustdominfo(struct rpc_pipe_client *cli,
1218                                            TALLOC_CTX *mem_ctx, int argc,
1219                                            const char **argv)
1220 {
1221         struct policy_handle pol, trustdom_pol;
1222         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1223         uint32 access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
1224         union lsa_TrustedDomainInfo *info = NULL;
1225         struct dom_sid dom_sid;
1226         enum lsa_TrustDomInfoEnum info_class = 1;
1227         uint8_t nt_hash[16];
1228
1229         if (argc > 3 || argc < 2) {
1230                 printf("Usage: %s [sid] [info_class]\n", argv[0]);
1231                 return NT_STATUS_OK;
1232         }
1233
1234         if (!string_to_sid(&dom_sid, argv[1]))
1235                 return NT_STATUS_NO_MEMORY;
1236
1237
1238         if (argc == 3)
1239                 info_class = atoi(argv[2]);
1240
1241         result = rpccli_lsa_open_policy2(cli, mem_ctx, True, access_mask, &pol);
1242
1243         if (!NT_STATUS_IS_OK(result))
1244                 goto done;
1245
1246         result = rpccli_lsa_OpenTrustedDomain(cli, mem_ctx,
1247                                               &pol,
1248                                               &dom_sid,
1249                                               access_mask,
1250                                               &trustdom_pol);
1251
1252         if (!NT_STATUS_IS_OK(result))
1253                 goto done;
1254
1255         result = rpccli_lsa_QueryTrustedDomainInfo(cli, mem_ctx,
1256                                                    &trustdom_pol,
1257                                                    info_class,
1258                                                    &info);
1259
1260         if (!NT_STATUS_IS_OK(result))
1261                 goto done;
1262
1263         if (!rpccli_get_pwd_hash(cli, nt_hash)) {
1264                 d_fprintf(stderr, "Could not get pwd hash\n");
1265                 goto done;
1266         }
1267
1268         display_trust_dom_info(mem_ctx, info, info_class, nt_hash);
1269
1270  done:
1271         rpccli_lsa_Close(cli, mem_ctx, &pol);
1272
1273         return result;
1274 }
1275
1276 static NTSTATUS cmd_lsa_get_username(struct rpc_pipe_client *cli,
1277                                      TALLOC_CTX *mem_ctx, int argc,
1278                                      const char **argv)
1279 {
1280         struct policy_handle pol;
1281         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1282         const char *servername = cli->desthost;
1283         struct lsa_String *account_name = NULL;
1284         struct lsa_String *authority_name = NULL;
1285
1286         if (argc > 2) {
1287                 printf("Usage: %s servername\n", argv[0]);
1288                 return NT_STATUS_OK;
1289         }
1290
1291         result = rpccli_lsa_open_policy(cli, mem_ctx, true,
1292                                         SEC_FLAG_MAXIMUM_ALLOWED,
1293                                         &pol);
1294
1295         if (!NT_STATUS_IS_OK(result)) {
1296                 goto done;
1297         }
1298
1299         result = rpccli_lsa_GetUserName(cli, mem_ctx,
1300                                         servername,
1301                                         &account_name,
1302                                         &authority_name);
1303         if (!NT_STATUS_IS_OK(result)) {
1304                 goto done;
1305         }
1306
1307         /* Print results */
1308
1309         printf("Account Name: %s, Authority Name: %s\n",
1310                 account_name->string, authority_name ? authority_name->string :
1311                 "");
1312
1313         rpccli_lsa_Close(cli, mem_ctx, &pol);
1314  done:
1315         return result;
1316 }
1317
1318 static NTSTATUS cmd_lsa_add_priv(struct rpc_pipe_client *cli,
1319                                  TALLOC_CTX *mem_ctx, int argc,
1320                                  const char **argv)
1321 {
1322         struct policy_handle dom_pol, user_pol;
1323         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1324         struct lsa_PrivilegeSet privs;
1325         struct lsa_LUIDAttribute *set = NULL;
1326         struct dom_sid sid;
1327         int i;
1328
1329         ZERO_STRUCT(privs);
1330
1331         if (argc < 3 ) {
1332                 printf("Usage: %s SID [rights...]\n", argv[0]);
1333                 return NT_STATUS_OK;
1334         }
1335
1336         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1337         if (!NT_STATUS_IS_OK(result)) {
1338                 goto done;
1339         }
1340
1341         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1342                                          SEC_FLAG_MAXIMUM_ALLOWED,
1343                                          &dom_pol);
1344
1345         if (!NT_STATUS_IS_OK(result)) {
1346                 goto done;
1347         }
1348
1349         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
1350                                         &dom_pol,
1351                                         &sid,
1352                                         SEC_FLAG_MAXIMUM_ALLOWED,
1353                                         &user_pol);
1354
1355         if (!NT_STATUS_IS_OK(result)) {
1356                 goto done;
1357         }
1358
1359         for (i=2; i<argc; i++) {
1360
1361                 struct lsa_String priv_name;
1362                 struct lsa_LUID luid;
1363
1364                 init_lsa_String(&priv_name, argv[i]);
1365
1366                 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1367                                                     &dom_pol,
1368                                                     &priv_name,
1369                                                     &luid);
1370                 if (!NT_STATUS_IS_OK(result)) {
1371                         continue;
1372                 }
1373
1374                 privs.count++;
1375                 set = TALLOC_REALLOC_ARRAY(mem_ctx, set,
1376                                            struct lsa_LUIDAttribute,
1377                                            privs.count);
1378                 if (!set) {
1379                         return NT_STATUS_NO_MEMORY;
1380                 }
1381
1382                 set[privs.count-1].luid = luid;
1383                 set[privs.count-1].attribute = 0;
1384         }
1385
1386         privs.set = set;
1387
1388         result = rpccli_lsa_AddPrivilegesToAccount(cli, mem_ctx,
1389                                                    &user_pol,
1390                                                    &privs);
1391
1392         if (!NT_STATUS_IS_OK(result)) {
1393                 goto done;
1394         }
1395
1396         rpccli_lsa_Close(cli, mem_ctx, &user_pol);
1397         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
1398  done:
1399         return result;
1400 }
1401
1402 static NTSTATUS cmd_lsa_del_priv(struct rpc_pipe_client *cli,
1403                                  TALLOC_CTX *mem_ctx, int argc,
1404                                  const char **argv)
1405 {
1406         struct policy_handle dom_pol, user_pol;
1407         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1408         struct lsa_PrivilegeSet privs;
1409         struct lsa_LUIDAttribute *set = NULL;
1410         struct dom_sid sid;
1411         int i;
1412
1413         ZERO_STRUCT(privs);
1414
1415         if (argc < 3 ) {
1416                 printf("Usage: %s SID [rights...]\n", argv[0]);
1417                 return NT_STATUS_OK;
1418         }
1419
1420         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
1421         if (!NT_STATUS_IS_OK(result)) {
1422                 goto done;
1423         }
1424
1425         result = rpccli_lsa_open_policy2(cli, mem_ctx, True,
1426                                          SEC_FLAG_MAXIMUM_ALLOWED,
1427                                          &dom_pol);
1428
1429         if (!NT_STATUS_IS_OK(result)) {
1430                 goto done;
1431         }
1432
1433         result = rpccli_lsa_OpenAccount(cli, mem_ctx,
1434                                         &dom_pol,
1435                                         &sid,
1436                                         SEC_FLAG_MAXIMUM_ALLOWED,
1437                                         &user_pol);
1438
1439         if (!NT_STATUS_IS_OK(result)) {
1440                 goto done;
1441         }
1442
1443         for (i=2; i<argc; i++) {
1444
1445                 struct lsa_String priv_name;
1446                 struct lsa_LUID luid;
1447
1448                 init_lsa_String(&priv_name, argv[i]);
1449
1450                 result = rpccli_lsa_LookupPrivValue(cli, mem_ctx,
1451                                                     &dom_pol,
1452                                                     &priv_name,
1453                                                     &luid);
1454                 if (!NT_STATUS_IS_OK(result)) {
1455                         continue;
1456                 }
1457
1458                 privs.count++;
1459                 set = TALLOC_REALLOC_ARRAY(mem_ctx, set,
1460                                            struct lsa_LUIDAttribute,
1461                                            privs.count);
1462                 if (!set) {
1463                         return NT_STATUS_NO_MEMORY;
1464                 }
1465
1466                 set[privs.count-1].luid = luid;
1467                 set[privs.count-1].attribute = 0;
1468         }
1469
1470         privs.set = set;
1471
1472
1473         result = rpccli_lsa_RemovePrivilegesFromAccount(cli, mem_ctx,
1474                                                         &user_pol,
1475                                                         false,
1476                                                         &privs);
1477
1478         if (!NT_STATUS_IS_OK(result)) {
1479                 goto done;
1480         }
1481
1482         rpccli_lsa_Close(cli, mem_ctx, &user_pol);
1483         rpccli_lsa_Close(cli, mem_ctx, &dom_pol);
1484  done:
1485         return result;
1486 }
1487
1488 static NTSTATUS cmd_lsa_create_secret(struct rpc_pipe_client *cli,
1489                                       TALLOC_CTX *mem_ctx, int argc,
1490                                       const char **argv)
1491 {
1492         NTSTATUS status;
1493         struct policy_handle handle, sec_handle;
1494         struct lsa_String name;
1495
1496         if (argc < 2) {
1497                 printf("Usage: %s name\n", argv[0]);
1498                 return NT_STATUS_OK;
1499         }
1500
1501         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1502                                          true,
1503                                          SEC_FLAG_MAXIMUM_ALLOWED,
1504                                          &handle);
1505         if (!NT_STATUS_IS_OK(status)) {
1506                 return status;
1507         }
1508
1509         init_lsa_String(&name, argv[1]);
1510
1511         status = rpccli_lsa_CreateSecret(cli, mem_ctx,
1512                                          &handle,
1513                                          name,
1514                                          SEC_FLAG_MAXIMUM_ALLOWED,
1515                                          &sec_handle);
1516         if (!NT_STATUS_IS_OK(status)) {
1517                 goto done;
1518         }
1519
1520  done:
1521         if (is_valid_policy_hnd(&sec_handle)) {
1522                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1523         }
1524         if (is_valid_policy_hnd(&handle)) {
1525                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1526         }
1527
1528         return status;
1529 }
1530
1531 static NTSTATUS cmd_lsa_delete_secret(struct rpc_pipe_client *cli,
1532                                       TALLOC_CTX *mem_ctx, int argc,
1533                                       const char **argv)
1534 {
1535         NTSTATUS status;
1536         struct policy_handle handle, sec_handle;
1537         struct lsa_String name;
1538
1539         if (argc < 2) {
1540                 printf("Usage: %s name\n", argv[0]);
1541                 return NT_STATUS_OK;
1542         }
1543
1544         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1545                                          true,
1546                                          SEC_FLAG_MAXIMUM_ALLOWED,
1547                                          &handle);
1548         if (!NT_STATUS_IS_OK(status)) {
1549                 return status;
1550         }
1551
1552         init_lsa_String(&name, argv[1]);
1553
1554         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1555                                        &handle,
1556                                        name,
1557                                        SEC_FLAG_MAXIMUM_ALLOWED,
1558                                        &sec_handle);
1559         if (!NT_STATUS_IS_OK(status)) {
1560                 goto done;
1561         }
1562
1563         status = rpccli_lsa_DeleteObject(cli, mem_ctx,
1564                                          &sec_handle);
1565         if (!NT_STATUS_IS_OK(status)) {
1566                 goto done;
1567         }
1568
1569  done:
1570         if (is_valid_policy_hnd(&sec_handle)) {
1571                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1572         }
1573         if (is_valid_policy_hnd(&handle)) {
1574                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1575         }
1576
1577         return status;
1578 }
1579
1580 static NTSTATUS cmd_lsa_query_secret(struct rpc_pipe_client *cli,
1581                                      TALLOC_CTX *mem_ctx, int argc,
1582                                      const char **argv)
1583 {
1584         NTSTATUS status;
1585         struct policy_handle handle, sec_handle;
1586         struct lsa_String name;
1587         struct lsa_DATA_BUF_PTR new_val;
1588         NTTIME new_mtime = 0;
1589         struct lsa_DATA_BUF_PTR old_val;
1590         NTTIME old_mtime = 0;
1591         DATA_BLOB session_key;
1592         DATA_BLOB new_blob = data_blob_null;
1593         DATA_BLOB old_blob = data_blob_null;
1594         char *new_secret, *old_secret;
1595
1596         if (argc < 2) {
1597                 printf("Usage: %s name\n", argv[0]);
1598                 return NT_STATUS_OK;
1599         }
1600
1601         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1602                                          true,
1603                                          SEC_FLAG_MAXIMUM_ALLOWED,
1604                                          &handle);
1605         if (!NT_STATUS_IS_OK(status)) {
1606                 return status;
1607         }
1608
1609         init_lsa_String(&name, argv[1]);
1610
1611         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1612                                        &handle,
1613                                        name,
1614                                        SEC_FLAG_MAXIMUM_ALLOWED,
1615                                        &sec_handle);
1616         if (!NT_STATUS_IS_OK(status)) {
1617                 goto done;
1618         }
1619
1620         ZERO_STRUCT(new_val);
1621         ZERO_STRUCT(old_val);
1622
1623         status = rpccli_lsa_QuerySecret(cli, mem_ctx,
1624                                         &sec_handle,
1625                                         &new_val,
1626                                         &new_mtime,
1627                                         &old_val,
1628                                         &old_mtime);
1629         if (!NT_STATUS_IS_OK(status)) {
1630                 goto done;
1631         }
1632
1633         status = cli_get_session_key(mem_ctx, cli, &session_key);
1634         if (!NT_STATUS_IS_OK(status)) {
1635                 goto done;
1636         }
1637
1638         if (new_val.buf) {
1639                 new_blob = data_blob_const(new_val.buf->data, new_val.buf->length);
1640         }
1641         if (old_val.buf) {
1642                 old_blob = data_blob_const(old_val.buf->data, old_val.buf->length);
1643         }
1644
1645         new_secret = sess_decrypt_string(mem_ctx, &new_blob, &session_key);
1646         old_secret = sess_decrypt_string(mem_ctx, &old_blob, &session_key);
1647         if (new_secret) {
1648                 d_printf("new secret: %s\n", new_secret);
1649         }
1650         if (old_secret) {
1651                 d_printf("old secret: %s\n", old_secret);
1652         }
1653
1654  done:
1655         if (is_valid_policy_hnd(&sec_handle)) {
1656                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1657         }
1658         if (is_valid_policy_hnd(&handle)) {
1659                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1660         }
1661
1662         return status;
1663 }
1664
1665 static NTSTATUS cmd_lsa_set_secret(struct rpc_pipe_client *cli,
1666                                    TALLOC_CTX *mem_ctx, int argc,
1667                                    const char **argv)
1668 {
1669         NTSTATUS status;
1670         struct policy_handle handle, sec_handle;
1671         struct lsa_String name;
1672         struct lsa_DATA_BUF new_val;
1673         struct lsa_DATA_BUF old_val;
1674         DATA_BLOB enc_key;
1675         DATA_BLOB session_key;
1676
1677         if (argc < 3) {
1678                 printf("Usage: %s name secret\n", argv[0]);
1679                 return NT_STATUS_OK;
1680         }
1681
1682         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1683                                          true,
1684                                          SEC_FLAG_MAXIMUM_ALLOWED,
1685                                          &handle);
1686         if (!NT_STATUS_IS_OK(status)) {
1687                 return status;
1688         }
1689
1690         init_lsa_String(&name, argv[1]);
1691
1692         status = rpccli_lsa_OpenSecret(cli, mem_ctx,
1693                                        &handle,
1694                                        name,
1695                                        SEC_FLAG_MAXIMUM_ALLOWED,
1696                                        &sec_handle);
1697         if (!NT_STATUS_IS_OK(status)) {
1698                 goto done;
1699         }
1700
1701         ZERO_STRUCT(new_val);
1702         ZERO_STRUCT(old_val);
1703
1704         status = cli_get_session_key(mem_ctx, cli, &session_key);
1705         if (!NT_STATUS_IS_OK(status)) {
1706                 goto done;
1707         }
1708
1709         enc_key = sess_encrypt_string(argv[2], &session_key);
1710
1711         new_val.length = enc_key.length;
1712         new_val.size = enc_key.length;
1713         new_val.data = enc_key.data;
1714
1715         status = rpccli_lsa_SetSecret(cli, mem_ctx,
1716                                       &sec_handle,
1717                                       &new_val,
1718                                       NULL);
1719         if (!NT_STATUS_IS_OK(status)) {
1720                 goto done;
1721         }
1722
1723  done:
1724         if (is_valid_policy_hnd(&sec_handle)) {
1725                 rpccli_lsa_Close(cli, mem_ctx, &sec_handle);
1726         }
1727         if (is_valid_policy_hnd(&handle)) {
1728                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1729         }
1730
1731         return status;
1732 }
1733
1734 static NTSTATUS cmd_lsa_retrieve_private_data(struct rpc_pipe_client *cli,
1735                                               TALLOC_CTX *mem_ctx, int argc,
1736                                               const char **argv)
1737 {
1738         NTSTATUS status;
1739         struct policy_handle handle;
1740         struct lsa_String name;
1741         struct lsa_DATA_BUF *val;
1742         DATA_BLOB session_key;
1743         DATA_BLOB blob = data_blob_null;
1744         char *secret;
1745
1746         if (argc < 2) {
1747                 printf("Usage: %s name\n", argv[0]);
1748                 return NT_STATUS_OK;
1749         }
1750
1751         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1752                                          true,
1753                                          SEC_FLAG_MAXIMUM_ALLOWED,
1754                                          &handle);
1755         if (!NT_STATUS_IS_OK(status)) {
1756                 return status;
1757         }
1758
1759         init_lsa_String(&name, argv[1]);
1760
1761         ZERO_STRUCT(val);
1762
1763         status = rpccli_lsa_RetrievePrivateData(cli, mem_ctx,
1764                                                 &handle,
1765                                                 &name,
1766                                                 &val);
1767         if (!NT_STATUS_IS_OK(status)) {
1768                 goto done;
1769         }
1770
1771         status = cli_get_session_key(mem_ctx, cli, &session_key);
1772         if (!NT_STATUS_IS_OK(status)) {
1773                 goto done;
1774         }
1775
1776         if (val) {
1777                 blob = data_blob_const(val->data, val->length);
1778         }
1779
1780         secret = sess_decrypt_string(mem_ctx, &blob, &session_key);
1781         if (secret) {
1782                 d_printf("secret: %s\n", secret);
1783         }
1784
1785  done:
1786         if (is_valid_policy_hnd(&handle)) {
1787                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1788         }
1789
1790         return status;
1791 }
1792
1793 static NTSTATUS cmd_lsa_store_private_data(struct rpc_pipe_client *cli,
1794                                            TALLOC_CTX *mem_ctx, int argc,
1795                                            const char **argv)
1796 {
1797         NTSTATUS status;
1798         struct policy_handle handle;
1799         struct lsa_String name;
1800         struct lsa_DATA_BUF val;
1801         DATA_BLOB session_key;
1802         DATA_BLOB enc_key;
1803
1804         if (argc < 3) {
1805                 printf("Usage: %s name secret\n", argv[0]);
1806                 return NT_STATUS_OK;
1807         }
1808
1809         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1810                                          true,
1811                                          SEC_FLAG_MAXIMUM_ALLOWED,
1812                                          &handle);
1813         if (!NT_STATUS_IS_OK(status)) {
1814                 return status;
1815         }
1816
1817         init_lsa_String(&name, argv[1]);
1818
1819         ZERO_STRUCT(val);
1820
1821         status = cli_get_session_key(mem_ctx, cli, &session_key);
1822         if (!NT_STATUS_IS_OK(status)) {
1823                 goto done;
1824         }
1825
1826         enc_key = sess_encrypt_string(argv[2], &session_key);
1827
1828         val.length = enc_key.length;
1829         val.size = enc_key.length;
1830         val.data = enc_key.data;
1831
1832         status = rpccli_lsa_StorePrivateData(cli, mem_ctx,
1833                                              &handle,
1834                                              &name,
1835                                              &val);
1836         if (!NT_STATUS_IS_OK(status)) {
1837                 goto done;
1838         }
1839
1840  done:
1841         if (is_valid_policy_hnd(&handle)) {
1842                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1843         }
1844
1845         return status;
1846 }
1847
1848 static NTSTATUS cmd_lsa_create_trusted_domain(struct rpc_pipe_client *cli,
1849                                               TALLOC_CTX *mem_ctx, int argc,
1850                                               const char **argv)
1851 {
1852         NTSTATUS status;
1853         struct policy_handle handle, trustdom_handle;
1854         struct dom_sid sid;
1855         struct lsa_DomainInfo info;
1856
1857         if (argc < 3) {
1858                 printf("Usage: %s name sid\n", argv[0]);
1859                 return NT_STATUS_OK;
1860         }
1861
1862         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1863                                          true,
1864                                          SEC_FLAG_MAXIMUM_ALLOWED,
1865                                          &handle);
1866         if (!NT_STATUS_IS_OK(status)) {
1867                 return status;
1868         }
1869
1870         init_lsa_StringLarge(&info.name, argv[1]);
1871         info.sid = &sid;
1872         string_to_sid(&sid, argv[2]);
1873
1874         status = rpccli_lsa_CreateTrustedDomain(cli, mem_ctx,
1875                                                 &handle,
1876                                                 &info,
1877                                                 SEC_FLAG_MAXIMUM_ALLOWED,
1878                                                 &trustdom_handle);
1879         if (!NT_STATUS_IS_OK(status)) {
1880                 goto done;
1881         }
1882
1883  done:
1884         if (is_valid_policy_hnd(&trustdom_handle)) {
1885                 rpccli_lsa_Close(cli, mem_ctx, &trustdom_handle);
1886         }
1887
1888         if (is_valid_policy_hnd(&handle)) {
1889                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1890         }
1891
1892         return status;
1893 }
1894
1895 static NTSTATUS cmd_lsa_delete_trusted_domain(struct rpc_pipe_client *cli,
1896                                               TALLOC_CTX *mem_ctx, int argc,
1897                                               const char **argv)
1898 {
1899         NTSTATUS status;
1900         struct policy_handle handle, trustdom_handle;
1901         struct lsa_String name;
1902         struct dom_sid *sid = NULL;
1903
1904         if (argc < 2) {
1905                 printf("Usage: %s name\n", argv[0]);
1906                 return NT_STATUS_OK;
1907         }
1908
1909         status = rpccli_lsa_open_policy2(cli, mem_ctx,
1910                                          true,
1911                                          SEC_FLAG_MAXIMUM_ALLOWED,
1912                                          &handle);
1913         if (!NT_STATUS_IS_OK(status)) {
1914                 return status;
1915         }
1916
1917         init_lsa_String(&name, argv[1]);
1918
1919         status = rpccli_lsa_OpenTrustedDomainByName(cli, mem_ctx,
1920                                                     &handle,
1921                                                     name,
1922                                                     SEC_FLAG_MAXIMUM_ALLOWED,
1923                                                     &trustdom_handle);
1924         if (NT_STATUS_IS_OK(status)) {
1925                 goto delete_object;
1926         }
1927
1928         {
1929                 uint32_t resume_handle = 0;
1930                 struct lsa_DomainList domains;
1931                 int i;
1932
1933                 status = rpccli_lsa_EnumTrustDom(cli, mem_ctx,
1934                                                  &handle,
1935                                                  &resume_handle,
1936                                                  &domains,
1937                                                  0xffff);
1938                 if (!NT_STATUS_IS_OK(status)) {
1939                         goto done;
1940                 }
1941
1942                 for (i=0; i < domains.count; i++) {
1943                         if (strequal(domains.domains[i].name.string, argv[1])) {
1944                                 sid = domains.domains[i].sid;
1945                                 break;
1946                         }
1947                 }
1948
1949                 if (!sid) {
1950                         return NT_STATUS_INVALID_SID;
1951                 }
1952         }
1953
1954         status = rpccli_lsa_OpenTrustedDomain(cli, mem_ctx,
1955                                               &handle,
1956                                               sid,
1957                                               SEC_FLAG_MAXIMUM_ALLOWED,
1958                                               &trustdom_handle);
1959         if (!NT_STATUS_IS_OK(status)) {
1960                 goto done;
1961         }
1962
1963  delete_object:
1964         status = rpccli_lsa_DeleteObject(cli, mem_ctx,
1965                                          &trustdom_handle);
1966         if (!NT_STATUS_IS_OK(status)) {
1967                 goto done;
1968         }
1969
1970  done:
1971         if (is_valid_policy_hnd(&trustdom_handle)) {
1972                 rpccli_lsa_Close(cli, mem_ctx, &trustdom_handle);
1973         }
1974
1975         if (is_valid_policy_hnd(&handle)) {
1976                 rpccli_lsa_Close(cli, mem_ctx, &handle);
1977         }
1978
1979         return status;
1980 }
1981
1982
1983 /* List of commands exported by this module */
1984
1985 struct cmd_set lsarpc_commands[] = {
1986
1987         { "LSARPC" },
1988
1989         { "lsaquery",            RPC_RTYPE_NTSTATUS, cmd_lsa_query_info_policy,  NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query info policy",                    "" },
1990         { "lookupsids",          RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids,        NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert SIDs to names",                "" },
1991         { "lookupsids3",         RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids3,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert SIDs to names",                "" },
1992         { "lookupnames",         RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1993         { "lookupnames4",        RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names4,      NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1994         { "lookupnames_level",   RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names_level, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Convert names to SIDs",                "" },
1995         { "enumtrust",           RPC_RTYPE_NTSTATUS, cmd_lsa_enum_trust_dom,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate trusted domains",            "Usage: [preferred max number] [enum context (0)]" },
1996         { "enumprivs",           RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privilege,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate privileges",                 "" },
1997         { "getdispname",         RPC_RTYPE_NTSTATUS, cmd_lsa_get_dispname,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get the privilege name",               "" },
1998         { "lsaenumsid",          RPC_RTYPE_NTSTATUS, cmd_lsa_enum_sids,          NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the LSA SIDS",               "" },
1999         { "lsacreateaccount",    RPC_RTYPE_NTSTATUS, cmd_lsa_create_account,     NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create a new lsa account",   "" },
2000         { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privsaccounts, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the privileges of an SID",   "" },
2001         { "lsaenumacctrights",   RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_rights,   NULL, &ndr_table_lsarpc.syntax_id, NULL, "Enumerate the rights of an SID",   "" },
2002         { "lsaaddpriv",          RPC_RTYPE_NTSTATUS, cmd_lsa_add_priv,           NULL, &ndr_table_lsarpc.syntax_id, NULL, "Assign a privilege to a SID", "" },
2003         { "lsadelpriv",          RPC_RTYPE_NTSTATUS, cmd_lsa_del_priv,           NULL, &ndr_table_lsarpc.syntax_id, NULL, "Revoke a privilege from a SID", "" },
2004         { "lsaaddacctrights",    RPC_RTYPE_NTSTATUS, cmd_lsa_add_acct_rights,    NULL, &ndr_table_lsarpc.syntax_id, NULL, "Add rights to an account",   "" },
2005         { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_remove_acct_rights, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Remove rights from an account",   "" },
2006         { "lsalookupprivvalue",  RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_priv_value,  NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get a privilege value given its name", "" },
2007         { "lsaquerysecobj",      RPC_RTYPE_NTSTATUS, cmd_lsa_query_secobj,       NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA security object", "" },
2008         { "lsaquerytrustdominfo",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfo, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a SID)", "" },
2009         { "lsaquerytrustdominfobyname",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobyname, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a name), only works for Windows > 2k", "" },
2010         { "lsaquerytrustdominfobysid",RPC_RTYPE_NTSTATUS, cmd_lsa_query_trustdominfobysid, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query LSA trusted domains info (given a SID)", "" },
2011         { "getusername",          RPC_RTYPE_NTSTATUS, cmd_lsa_get_username, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Get username", "" },
2012         { "createsecret",         RPC_RTYPE_NTSTATUS, cmd_lsa_create_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create Secret", "" },
2013         { "deletesecret",         RPC_RTYPE_NTSTATUS, cmd_lsa_delete_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Delete Secret", "" },
2014         { "querysecret",          RPC_RTYPE_NTSTATUS, cmd_lsa_query_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Query Secret", "" },
2015         { "setsecret",            RPC_RTYPE_NTSTATUS, cmd_lsa_set_secret, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Set Secret", "" },
2016         { "retrieveprivatedata",  RPC_RTYPE_NTSTATUS, cmd_lsa_retrieve_private_data, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Retrieve Private Data", "" },
2017         { "storeprivatedata",     RPC_RTYPE_NTSTATUS, cmd_lsa_store_private_data, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Store Private Data", "" },
2018         { "createtrustdom",       RPC_RTYPE_NTSTATUS, cmd_lsa_create_trusted_domain, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Create Trusted Domain", "" },
2019         { "deletetrustdom",       RPC_RTYPE_NTSTATUS, cmd_lsa_delete_trusted_domain, NULL, &ndr_table_lsarpc.syntax_id, NULL, "Delete Trusted Domain", "" },
2020
2021         { NULL }
2022 };
2023