API tools faq
paste
Guest User

Untitled

a guest
Sep 13th, 2013
70
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 241.78 KB | None | 0 0
raw download clone embed print report
  1. [2013/09/13 10:39:44.151584, 3] param/loadparm.c:9572(lp_load_ex)
  2. lp_load_ex: refreshing parameters
  3. [2013/09/13 10:39:44.151651, 3] param/loadparm.c:5192(init_globals)
  4. Initialising global parameters
  5. [2013/09/13 10:39:44.151740, 3] ../lib/util/params.c:550(pm_process)
  6. params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
  7. [2013/09/13 10:39:44.151773, 3] param/loadparm.c:8310(do_section)
  8. Processing section "[global]"
  9. [2013/09/13 10:39:44.151825, 3] ../lib/util/params.c:550(pm_process)
  10. params.c:pm_process() - Processing configuration file "/etc/samba/alias.conf"
  11. [2013/09/13 10:39:44.151859, 1] param/loadparm.c:7992(lp_do_parameter)
  12. WARNING: The "enable privileges" option is deprecated
  13. [2013/09/13 10:39:44.152088, 1] ../lib/util/params.c:350(Parameter)
  14. params.c:Parameter() - Ignoring badly formed line in configuration file: all combinations of upper and lower case.
  15. [2013/09/13 10:39:44.152346, 3] ../lib/util/params.c:550(pm_process)
  16. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/venus.conf"
  17. [2013/09/13 10:39:44.152404, 3] ../lib/util/params.c:550(pm_process)
  18. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  19. [2013/09/13 10:39:44.152430, 3] param/loadparm.c:8310(do_section)
  20. Processing section "[global]"
  21. [2013/09/13 10:39:44.152477, 2] param/loadparm.c:8327(do_section)
  22. Processing section "[homes]"
  23. [2013/09/13 10:39:44.152546, 2] param/loadparm.c:8327(do_section)
  24. Processing section "[home]"
  25. [2013/09/13 10:39:44.152613, 2] param/loadparm.c:8327(do_section)
  26. Processing section "[Profiles]"
  27. [2013/09/13 10:39:44.152714, 2] param/loadparm.c:8327(do_section)
  28. Processing section "[Profile]"
  29. [2013/09/13 10:39:44.152784, 2] param/loadparm.c:8327(do_section)
  30. Processing section "[Profiles.V2]"
  31. [2013/09/13 10:39:44.152870, 2] param/loadparm.c:8327(do_section)
  32. Processing section "[Profile.v2]"
  33. [2013/09/13 10:39:44.152955, 2] param/loadparm.c:8327(do_section)
  34. Processing section "[mgmt]"
  35. [2013/09/13 10:39:44.153033, 2] param/loadparm.c:8327(do_section)
  36. Processing section "[accData]"
  37. [2013/09/13 10:39:44.153130, 2] param/loadparm.c:8327(do_section)
  38. Processing section "[printers]"
  39. [2013/09/13 10:39:44.153205, 2] param/loadparm.c:8327(do_section)
  40. Processing section "[print$]"
  41. [2013/09/13 10:39:44.153285, 2] param/loadparm.c:8327(do_section)
  42. Processing section "[installkit]"
  43. [2013/09/13 10:39:44.153352, 2] param/loadparm.c:8327(do_section)
  44. Processing section "[public]"
  45. [2013/09/13 10:39:44.153425, 2] param/loadparm.c:8327(do_section)
  46. Processing section "[accounts]"
  47. [2013/09/13 10:39:44.153508, 2] param/loadparm.c:8327(do_section)
  48. Processing section "[PaDFru_Midlands]"
  49. [2013/09/13 10:39:44.153564, 1] param/loadparm.c:7992(lp_do_parameter)
  50. WARNING: The "printer admin" option is deprecated
  51. [2013/09/13 10:39:44.153720, 2] param/loadparm.c:8327(do_section)
  52. Processing section "[PaDFru]"
  53. [2013/09/13 10:39:44.153776, 1] param/loadparm.c:7992(lp_do_parameter)
  54. WARNING: The "printer admin" option is deprecated
  55. [2013/09/13 10:39:44.153931, 2] param/loadparm.c:8327(do_section)
  56. Processing section "[PaDFru_Headed]"
  57. [2013/09/13 10:39:44.153987, 1] param/loadparm.c:7992(lp_do_parameter)
  58. WARNING: The "printer admin" option is deprecated
  59. [2013/09/13 10:39:44.154174, 3] ../lib/util/params.c:550(pm_process)
  60. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/gmdata.conf"
  61. [2013/09/13 10:39:44.154202, 2] param/loadparm.c:8327(do_section)
  62. Processing section "[gm]"
  63. [2013/09/13 10:39:44.154304, 2] param/loadparm.c:8327(do_section)
  64. Processing section "[tt]"
  65. [2013/09/13 10:39:44.154423, 3] ../lib/util/params.c:550(pm_process)
  66. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  67. [2013/09/13 10:39:44.154450, 3] param/loadparm.c:8310(do_section)
  68. Processing section "[global]"
  69. [2013/09/13 10:39:44.154497, 2] param/loadparm.c:8327(do_section)
  70. Processing section "[homes]"
  71. [2013/09/13 10:39:44.154543, 2] param/loadparm.c:8327(do_section)
  72. Processing section "[home]"
  73. [2013/09/13 10:39:44.154596, 2] param/loadparm.c:8327(do_section)
  74. Processing section "[Profiles]"
  75. [2013/09/13 10:39:44.154676, 2] param/loadparm.c:8327(do_section)
  76. Processing section "[Profile]"
  77. [2013/09/13 10:39:44.154725, 2] param/loadparm.c:8327(do_section)
  78. Processing section "[Profiles.V2]"
  79. [2013/09/13 10:39:44.154789, 2] param/loadparm.c:8327(do_section)
  80. Processing section "[Profile.v2]"
  81. [2013/09/13 10:39:44.154853, 2] param/loadparm.c:8327(do_section)
  82. Processing section "[mgmt]"
  83. [2013/09/13 10:39:44.154909, 2] param/loadparm.c:8327(do_section)
  84. Processing section "[accData]"
  85. [2013/09/13 10:39:44.154970, 2] param/loadparm.c:8327(do_section)
  86. Processing section "[printers]"
  87. [2013/09/13 10:39:44.155022, 2] param/loadparm.c:8327(do_section)
  88. Processing section "[print$]"
  89. [2013/09/13 10:39:44.155089, 2] param/loadparm.c:8327(do_section)
  90. Processing section "[installkit]"
  91. [2013/09/13 10:39:44.155136, 2] param/loadparm.c:8327(do_section)
  92. Processing section "[public]"
  93. [2013/09/13 10:39:44.155188, 2] param/loadparm.c:8327(do_section)
  94. Processing section "[accounts]"
  95. [2013/09/13 10:39:44.155250, 2] param/loadparm.c:8327(do_section)
  96. Processing section "[PaDFru_Midlands]"
  97. [2013/09/13 10:39:44.155285, 1] param/loadparm.c:7992(lp_do_parameter)
  98. WARNING: The "printer admin" option is deprecated
  99. [2013/09/13 10:39:44.155439, 2] param/loadparm.c:8327(do_section)
  100. Processing section "[PaDFru]"
  101. [2013/09/13 10:39:44.155473, 1] param/loadparm.c:7992(lp_do_parameter)
  102. WARNING: The "printer admin" option is deprecated
  103. [2013/09/13 10:39:44.155628, 2] param/loadparm.c:8327(do_section)
  104. Processing section "[PaDFru_Headed]"
  105. [2013/09/13 10:39:44.155663, 1] param/loadparm.c:7992(lp_do_parameter)
  106. WARNING: The "printer admin" option is deprecated
  107. [2013/09/13 10:39:44.155818, 2] param/loadparm.c:8327(do_section)
  108. Processing section "[netlogon]"
  109. [2013/09/13 10:39:44.155892, 1] param/loadparm.c:7992(lp_do_parameter)
  110. WARNING: The "share modes" option is deprecated
  111. [2013/09/13 10:39:44.155934, 2] param/loadparm.c:8327(do_section)
  112. Processing section "[netlogoff]"
  113. [2013/09/13 10:39:44.156015, 1] param/loadparm.c:7992(lp_do_parameter)
  114. WARNING: The "share modes" option is deprecated
  115. [2013/09/13 10:39:44.156058, 2] param/loadparm.c:8327(do_section)
  116. Processing section "[printers]"
  117. [2013/09/13 10:39:44.156115, 2] param/loadparm.c:8327(do_section)
  118. Processing section "[print$]"
  119. [2013/09/13 10:39:44.156202, 3] param/loadparm.c:6630(lp_add_ipc)
  120. adding IPC service
  121. [2013/09/13 10:39:44.156296, 2] lib/interface.c:479(interpret_interface)
  122. interpret_interface: Adding interface 192.168.sn.21/24
  123. [2013/09/13 10:39:44.156329, 2] lib/interface.c:341(add_interface)
  124. added interface 192.168.sn.21/ ip=192.168.sn.21 bcast=192.168.sn.255 netmask=255.255.255.0
  125. [2013/09/13 10:39:44.156387, 3] auth/auth.c:219(check_ntlm_password)
  126. check_ntlm_password: Checking password for unmapped user [DOMAIN]\[geek]@[CRW7C] with the new password interface
  127. [2013/09/13 10:39:44.156415, 3] auth/auth.c:222(check_ntlm_password)
  128. check_ntlm_password: mapped user is: [DOMAIN]\[geek]@[CRW7C]
  129. [2013/09/13 10:39:44.156528, 2] lib/smbldap.c:1018(smbldap_open_connection)
  130. smbldap_open_connection: connection opened
  131. [2013/09/13 10:39:44.157179, 3] lib/smbldap.c:1948(smbldap_check_root_dse)
  132. smbldap_check_root_dse: Expected one rootDSE, got 0
  133. [2013/09/13 10:39:44.157216, 3] lib/smbldap.c:1240(smbldap_connect_system)
  134. ldap_connect_system: successful connection to the LDAP server
  135. [2013/09/13 10:39:44.157547, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  136. init_sam_from_ldap: Entry found for user: geek
  137. [2013/09/13 10:39:44.159286, 3] auth/auth.c:268(check_ntlm_password)
  138. check_ntlm_password: sam authentication for user [geek] succeeded
  139. [2013/09/13 10:39:44.159330, 2] auth/auth.c:309(check_ntlm_password)
  140. check_ntlm_password: authentication for user [geek] -> [geek] -> [geek] succeeded
  141. [2013/09/13 10:39:44.160178, 3] groupdb/mapping.c:772(pdb_create_builtin_alias)
  142. pdb_create_builtin_alias: Could not get a gid out of winbind
  143. [2013/09/13 10:39:44.160226, 2] auth/token_util.c:479(finalize_local_nt_token)
  144. WARNING: Failed to create BUILTIN\Users group! Can Winbind allocate gids?
  145. [2013/09/13 10:39:44.161358, 3] ../libcli/auth/ntlmssp_sign.c:535(ntlmssp_sign_init)
  146. NTLMSSP Sign/Seal - Initialising with flags:
  147. [2013/09/13 10:39:44.161392, 3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags)
  148. Got NTLMSSP neg_flags=0xe2088215
  149. [2013/09/13 10:39:44.161433, 3] smbd/password.c:298(register_existing_vuid)
  150. register_existing_vuid: User name: geek Real name: Current Geek
  151. [2013/09/13 10:39:44.161459, 3] smbd/password.c:308(register_existing_vuid)
  152. register_existing_vuid: UNIX uid 1012 is UNIX user geek, and will be vuid 100
  153. [2013/09/13 10:39:44.206307, 3] smbd/password.c:238(register_homes_share)
  154. Adding homes service for user 'geek' using home directory: '/home/geek'
  155. [2013/09/13 10:39:44.206443, 3] param/loadparm.c:6582(lp_add_home)
  156. adding home's share [geek] for user 'geek' at '/home/%u'
  157. [2013/09/13 10:39:44.207737, 3] smbd/process.c:1662(process_smb)
  158. Transaction 3 of length 80 (0 toread)
  159. [2013/09/13 10:39:44.207806, 3] smbd/process.c:1467(switch_message)
  160. switch message SMBtconX (pid 26545) conn 0x0
  161. [2013/09/13 10:39:44.207950, 3] lib/access.c:338(allow_access)
  162. Allowed connection from 192.168.sn.89 (192.168.sn.89)
  163. [2013/09/13 10:39:44.208041, 3] smbd/service.c:872(make_connection_snum)
  164. Connect path is '/tmp' for service [IPC$]
  165. [2013/09/13 10:39:44.208131, 3] smbd/vfs.c:102(vfs_init_default)
  166. Initialising default vfs hooks
  167. [2013/09/13 10:39:44.208214, 3] smbd/vfs.c:128(vfs_init_custom)
  168. Initialising custom vfs hooks from [/[Default VFS]/]
  169. [2013/09/13 10:39:44.208426, 3] smbd/service.c:1114(make_connection_snum)
  170. crw7c (192.168.sn.89) connect to service IPC$ initially as user geek (uid=1012, gid=512) (pid 26545)
  171. [2013/09/13 10:39:44.208497, 3] smbd/reply.c:871(reply_tcon_and_X)
  172. tconX service=IPC$
  173. [2013/09/13 10:39:44.242843, 3] smbd/process.c:1662(process_smb)
  174. Transaction 4 of length 104 (0 toread)
  175. [2013/09/13 10:39:44.242920, 3] smbd/process.c:1467(switch_message)
  176. switch message SMBntcreateX (pid 26545) conn 0x88bd290
  177. [2013/09/13 10:39:44.254196, 3] smbd/process.c:1662(process_smb)
  178. Transaction 5 of length 76 (0 toread)
  179. [2013/09/13 10:39:44.254235, 3] smbd/process.c:1467(switch_message)
  180. switch message SMBtrans2 (pid 26545) conn 0x88bd290
  181. [2013/09/13 10:39:44.255222, 3] smbd/process.c:1662(process_smb)
  182. Transaction 6 of length 184 (0 toread)
  183. [2013/09/13 10:39:44.255261, 3] smbd/process.c:1467(switch_message)
  184. switch message SMBwriteX (pid 26545) conn 0x88bd290
  185. [2013/09/13 10:39:44.255307, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  186. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  187. [2013/09/13 10:39:44.262675, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  188. check_bind_req for \lsarpc
  189. [2013/09/13 10:39:44.262706, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  190. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  191. [2013/09/13 10:39:44.262828, 3] smbd/pipes.c:361(pipe_write_andx_done)
  192. writeX-IPC nwritten=116
  193. [2013/09/13 10:39:44.263613, 3] smbd/process.c:1662(process_smb)
  194. Transaction 7 of length 63 (0 toread)
  195. [2013/09/13 10:39:44.263677, 3] smbd/process.c:1467(switch_message)
  196. switch message SMBreadX (pid 26545) conn 0x88bd290
  197. [2013/09/13 10:39:44.263716, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  198. free_pipe_context: destroying talloc pool of size 23
  199. [2013/09/13 10:39:44.263749, 3] smbd/pipes.c:485(pipe_read_andx_done)
  200. readX-IPC min=1024 max=1024 nread=68
  201. [2013/09/13 10:39:44.264679, 3] smbd/process.c:1662(process_smb)
  202. Transaction 8 of length 168 (0 toread)
  203. [2013/09/13 10:39:44.264737, 3] smbd/process.c:1467(switch_message)
  204. switch message SMBtrans (pid 26545) conn 0x88bd290
  205. [2013/09/13 10:39:44.264765, 3] smbd/ipc.c:560(handle_trans)
  206. trans <\PIPE\> data=80 params=0 setup=2
  207. [2013/09/13 10:39:44.264791, 3] smbd/ipc.c:511(named_pipe)
  208. named pipe command on <> name
  209. [2013/09/13 10:39:44.264814, 3] smbd/ipc.c:475(api_fd_reply)
  210. Got API command 0x26 on pipe "lsarpc" (pnum 4ad1)
  211. [2013/09/13 10:39:44.264845, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  212. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  213. [2013/09/13 10:39:44.264908, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  214. free_pipe_context: destroying talloc pool of size 1075
  215. [2013/09/13 10:39:44.265694, 3] smbd/process.c:1662(process_smb)
  216. Transaction 9 of length 134 (0 toread)
  217. [2013/09/13 10:39:44.265774, 3] smbd/process.c:1467(switch_message)
  218. switch message SMBtrans (pid 26545) conn 0x88bd290
  219. [2013/09/13 10:39:44.265803, 3] smbd/ipc.c:560(handle_trans)
  220. trans <\PIPE\> data=46 params=0 setup=2
  221. [2013/09/13 10:39:44.265828, 3] smbd/ipc.c:511(named_pipe)
  222. named pipe command on <> name
  223. [2013/09/13 10:39:44.265850, 3] smbd/ipc.c:475(api_fd_reply)
  224. Got API command 0x26 on pipe "lsarpc" (pnum 4ad1)
  225. [2013/09/13 10:39:44.265879, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  226. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  227. [2013/09/13 10:39:44.277296, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  228. free_pipe_context: destroying talloc pool of size 27
  229. [2013/09/13 10:39:44.278698, 3] smbd/process.c:1662(process_smb)
  230. Transaction 10 of length 134 (0 toread)
  231. [2013/09/13 10:39:44.278761, 3] smbd/process.c:1467(switch_message)
  232. switch message SMBtrans (pid 26545) conn 0x88bd290
  233. [2013/09/13 10:39:44.278803, 3] smbd/ipc.c:560(handle_trans)
  234. trans <\PIPE\> data=46 params=0 setup=2
  235. [2013/09/13 10:39:44.278828, 3] smbd/ipc.c:511(named_pipe)
  236. named pipe command on <> name
  237. [2013/09/13 10:39:44.278850, 3] smbd/ipc.c:475(api_fd_reply)
  238. Got API command 0x26 on pipe "lsarpc" (pnum 4ad1)
  239. [2013/09/13 10:39:44.278879, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  240. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  241. [2013/09/13 10:39:44.278925, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  242. free_pipe_context: destroying talloc pool of size 135
  243. [2013/09/13 10:39:44.279644, 3] smbd/process.c:1662(process_smb)
  244. Transaction 11 of length 132 (0 toread)
  245. [2013/09/13 10:39:44.279749, 3] smbd/process.c:1467(switch_message)
  246. switch message SMBtrans (pid 26545) conn 0x88bd290
  247. [2013/09/13 10:39:44.279777, 3] smbd/ipc.c:560(handle_trans)
  248. trans <\PIPE\> data=44 params=0 setup=2
  249. [2013/09/13 10:39:44.279817, 3] smbd/ipc.c:511(named_pipe)
  250. named pipe command on <> name
  251. [2013/09/13 10:39:44.279841, 3] smbd/ipc.c:475(api_fd_reply)
  252. Got API command 0x26 on pipe "lsarpc" (pnum 4ad1)
  253. [2013/09/13 10:39:44.279870, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  254. api_rpcTNP: rpc command: LSA_CLOSE
  255. [2013/09/13 10:39:44.279896, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  256. Closed policy
  257. [2013/09/13 10:39:44.279951, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  258. free_pipe_context: destroying talloc pool of size 23
  259. [2013/09/13 10:39:44.280676, 3] smbd/process.c:1662(process_smb)
  260. Transaction 12 of length 45 (0 toread)
  261. [2013/09/13 10:39:44.280753, 3] smbd/process.c:1467(switch_message)
  262. switch message SMBclose (pid 26545) conn 0x88bd290
  263. [2013/09/13 10:39:44.280779, 3] smbd/reply.c:4848(reply_close)
  264. close fd=-1 fnum=19153 (numopen=1)
  265. [2013/09/13 10:39:44.641958, 3] smbd/process.c:1662(process_smb)
  266. Transaction 13 of length 104 (0 toread)
  267. [2013/09/13 10:39:44.642050, 3] smbd/process.c:1467(switch_message)
  268. switch message SMBntcreateX (pid 26545) conn 0x88bd290
  269. [2013/09/13 10:39:44.642781, 3] smbd/process.c:1662(process_smb)
  270. Transaction 14 of length 76 (0 toread)
  271. [2013/09/13 10:39:44.642855, 3] smbd/process.c:1467(switch_message)
  272. switch message SMBtrans2 (pid 26545) conn 0x88bd290
  273. [2013/09/13 10:39:44.643605, 3] smbd/process.c:1662(process_smb)
  274. Transaction 15 of length 184 (0 toread)
  275. [2013/09/13 10:39:44.643684, 3] smbd/process.c:1467(switch_message)
  276. switch message SMBwriteX (pid 26545) conn 0x88bd290
  277. [2013/09/13 10:39:44.643749, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  278. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  279. [2013/09/13 10:39:44.643817, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  280. check_bind_req for \lsarpc
  281. [2013/09/13 10:39:44.643867, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  282. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  283. [2013/09/13 10:39:44.643964, 3] smbd/pipes.c:361(pipe_write_andx_done)
  284. writeX-IPC nwritten=116
  285. [2013/09/13 10:39:44.644635, 3] smbd/process.c:1662(process_smb)
  286. Transaction 16 of length 63 (0 toread)
  287. [2013/09/13 10:39:44.644697, 3] smbd/process.c:1467(switch_message)
  288. switch message SMBreadX (pid 26545) conn 0x88bd290
  289. [2013/09/13 10:39:44.644751, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  290. free_pipe_context: destroying talloc pool of size 23
  291. [2013/09/13 10:39:44.644826, 3] smbd/pipes.c:485(pipe_read_andx_done)
  292. readX-IPC min=1024 max=1024 nread=68
  293. [2013/09/13 10:39:44.645512, 3] smbd/process.c:1662(process_smb)
  294. Transaction 17 of length 168 (0 toread)
  295. [2013/09/13 10:39:44.645573, 3] smbd/process.c:1467(switch_message)
  296. switch message SMBtrans (pid 26545) conn 0x88bd290
  297. [2013/09/13 10:39:44.645642, 3] smbd/ipc.c:560(handle_trans)
  298. trans <\PIPE\> data=80 params=0 setup=2
  299. [2013/09/13 10:39:44.645693, 3] smbd/ipc.c:511(named_pipe)
  300. named pipe command on <> name
  301. [2013/09/13 10:39:44.645750, 3] smbd/ipc.c:475(api_fd_reply)
  302. Got API command 0x26 on pipe "lsarpc" (pnum 4ad2)
  303. [2013/09/13 10:39:44.645810, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  304. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  305. [2013/09/13 10:39:44.645912, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  306. free_pipe_context: destroying talloc pool of size 1075
  307. [2013/09/13 10:39:44.646570, 3] smbd/process.c:1662(process_smb)
  308. Transaction 18 of length 134 (0 toread)
  309. [2013/09/13 10:39:44.646649, 3] smbd/process.c:1467(switch_message)
  310. switch message SMBtrans (pid 26545) conn 0x88bd290
  311. [2013/09/13 10:39:44.646704, 3] smbd/ipc.c:560(handle_trans)
  312. trans <\PIPE\> data=46 params=0 setup=2
  313. [2013/09/13 10:39:44.646770, 3] smbd/ipc.c:511(named_pipe)
  314. named pipe command on <> name
  315. [2013/09/13 10:39:44.646816, 3] smbd/ipc.c:475(api_fd_reply)
  316. Got API command 0x26 on pipe "lsarpc" (pnum 4ad2)
  317. [2013/09/13 10:39:44.646887, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  318. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  319. [2013/09/13 10:39:44.646960, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  320. free_pipe_context: destroying talloc pool of size 27
  321. [2013/09/13 10:39:44.647872, 3] smbd/process.c:1662(process_smb)
  322. Transaction 19 of length 134 (0 toread)
  323. [2013/09/13 10:39:44.647934, 3] smbd/process.c:1467(switch_message)
  324. switch message SMBtrans (pid 26545) conn 0x88bd290
  325. [2013/09/13 10:39:44.648005, 3] smbd/ipc.c:560(handle_trans)
  326. trans <\PIPE\> data=46 params=0 setup=2
  327. [2013/09/13 10:39:44.648056, 3] smbd/ipc.c:511(named_pipe)
  328. named pipe command on <> name
  329. [2013/09/13 10:39:44.648101, 3] smbd/ipc.c:475(api_fd_reply)
  330. Got API command 0x26 on pipe "lsarpc" (pnum 4ad2)
  331. [2013/09/13 10:39:44.648181, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  332. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  333. [2013/09/13 10:39:44.648272, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  334. free_pipe_context: destroying talloc pool of size 135
  335. [2013/09/13 10:39:44.649039, 3] smbd/process.c:1662(process_smb)
  336. Transaction 20 of length 132 (0 toread)
  337. [2013/09/13 10:39:44.649112, 3] smbd/process.c:1467(switch_message)
  338. switch message SMBtrans (pid 26545) conn 0x88bd290
  339. [2013/09/13 10:39:44.649170, 3] smbd/ipc.c:560(handle_trans)
  340. trans <\PIPE\> data=44 params=0 setup=2
  341. [2013/09/13 10:39:44.649220, 3] smbd/ipc.c:511(named_pipe)
  342. named pipe command on <> name
  343. [2013/09/13 10:39:44.649266, 3] smbd/ipc.c:475(api_fd_reply)
  344. Got API command 0x26 on pipe "lsarpc" (pnum 4ad2)
  345. [2013/09/13 10:39:44.649346, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  346. api_rpcTNP: rpc command: LSA_CLOSE
  347. [2013/09/13 10:39:44.649399, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  348. Closed policy
  349. [2013/09/13 10:39:44.649483, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  350. free_pipe_context: destroying talloc pool of size 23
  351. [2013/09/13 10:39:44.650169, 3] smbd/process.c:1662(process_smb)
  352. Transaction 21 of length 45 (0 toread)
  353. [2013/09/13 10:39:44.650239, 3] smbd/process.c:1467(switch_message)
  354. switch message SMBclose (pid 26545) conn 0x88bd290
  355. [2013/09/13 10:39:44.650289, 3] smbd/reply.c:4848(reply_close)
  356. close fd=-1 fnum=19154 (numopen=1)
  357. [2013/09/13 10:39:44.664697, 3] smbd/process.c:1662(process_smb)
  358. Transaction 22 of length 100 (0 toread)
  359. [2013/09/13 10:39:44.664781, 3] smbd/process.c:1467(switch_message)
  360. switch message SMBntcreateX (pid 26545) conn 0x88bd290
  361. [2013/09/13 10:39:44.665509, 3] smbd/process.c:1662(process_smb)
  362. Transaction 23 of length 76 (0 toread)
  363. [2013/09/13 10:39:44.665579, 3] smbd/process.c:1467(switch_message)
  364. switch message SMBtrans2 (pid 26545) conn 0x88bd290
  365. [2013/09/13 10:39:44.666340, 3] smbd/process.c:1662(process_smb)
  366. Transaction 24 of length 184 (0 toread)
  367. [2013/09/13 10:39:44.666413, 3] smbd/process.c:1467(switch_message)
  368. switch message SMBwriteX (pid 26545) conn 0x88bd290
  369. [2013/09/13 10:39:44.666486, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  370. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  371. [2013/09/13 10:39:44.666537, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  372. check_bind_req for \samr
  373. [2013/09/13 10:39:44.666586, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  374. check_bind_req: \PIPE\samr -> \PIPE\samr
  375. [2013/09/13 10:39:44.666656, 3] smbd/pipes.c:361(pipe_write_andx_done)
  376. writeX-IPC nwritten=116
  377. [2013/09/13 10:39:44.667321, 3] smbd/process.c:1662(process_smb)
  378. Transaction 25 of length 63 (0 toread)
  379. [2013/09/13 10:39:44.667397, 3] smbd/process.c:1467(switch_message)
  380. switch message SMBreadX (pid 26545) conn 0x88bd290
  381. [2013/09/13 10:39:44.667453, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  382. free_pipe_context: destroying talloc pool of size 21
  383. [2013/09/13 10:39:44.667523, 3] smbd/pipes.c:485(pipe_read_andx_done)
  384. readX-IPC min=1024 max=1024 nread=68
  385. [2013/09/13 10:39:44.668163, 3] smbd/process.c:1662(process_smb)
  386. Transaction 26 of length 160 (0 toread)
  387. [2013/09/13 10:39:44.668241, 3] smbd/process.c:1467(switch_message)
  388. switch message SMBtrans (pid 26545) conn 0x88bd290
  389. [2013/09/13 10:39:44.668296, 3] smbd/ipc.c:560(handle_trans)
  390. trans <\PIPE\> data=72 params=0 setup=2
  391. [2013/09/13 10:39:44.668363, 3] smbd/ipc.c:511(named_pipe)
  392. named pipe command on <> name
  393. [2013/09/13 10:39:44.668410, 3] smbd/ipc.c:475(api_fd_reply)
  394. Got API command 0x26 on pipe "samr" (pnum 4ad3)
  395. [2013/09/13 10:39:44.668480, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  396. api_rpcTNP: rpc command: SAMR_CONNECT5
  397. [2013/09/13 10:39:44.668594, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  398. free_pipe_context: destroying talloc pool of size 1005
  399. [2013/09/13 10:39:44.669306, 3] smbd/process.c:1662(process_smb)
  400. Transaction 27 of length 140 (0 toread)
  401. [2013/09/13 10:39:44.669384, 3] smbd/process.c:1467(switch_message)
  402. switch message SMBtrans (pid 26545) conn 0x88bd290
  403. [2013/09/13 10:39:44.669449, 3] smbd/ipc.c:560(handle_trans)
  404. trans <\PIPE\> data=52 params=0 setup=2
  405. [2013/09/13 10:39:44.669502, 3] smbd/ipc.c:511(named_pipe)
  406. named pipe command on <> name
  407. [2013/09/13 10:39:44.669547, 3] smbd/ipc.c:475(api_fd_reply)
  408. Got API command 0x26 on pipe "samr" (pnum 4ad3)
  409. [2013/09/13 10:39:44.669618, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  410. api_rpcTNP: rpc command: SAMR_ENUMDOMAINS
  411. [2013/09/13 10:39:44.677630, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  412. free_pipe_context: destroying talloc pool of size 53
  413. [2013/09/13 10:39:44.678342, 3] smbd/process.c:1662(process_smb)
  414. Transaction 28 of length 158 (0 toread)
  415. [2013/09/13 10:39:44.678449, 3] smbd/process.c:1467(switch_message)
  416. switch message SMBtrans (pid 26545) conn 0x88bd290
  417. [2013/09/13 10:39:44.678504, 3] smbd/ipc.c:560(handle_trans)
  418. trans <\PIPE\> data=70 params=0 setup=2
  419. [2013/09/13 10:39:44.678563, 3] smbd/ipc.c:511(named_pipe)
  420. named pipe command on <> name
  421. [2013/09/13 10:39:44.678609, 3] smbd/ipc.c:475(api_fd_reply)
  422. Got API command 0x26 on pipe "samr" (pnum 4ad3)
  423. [2013/09/13 10:39:44.678668, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  424. api_rpcTNP: rpc command: SAMR_LOOKUPDOMAIN
  425. [2013/09/13 10:39:44.678740, 2] rpc_server/samr/srv_samr_nt.c:4071(_samr_LookupDomain)
  426. Returning domain sid for domain DOMAIN -> S-1-5-21-OURSID-3360254768
  427. [2013/09/13 10:39:44.678833, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  428. free_pipe_context: destroying talloc pool of size 89
  429. [2013/09/13 10:39:44.679762, 3] smbd/process.c:1662(process_smb)
  430. Transaction 29 of length 164 (0 toread)
  431. [2013/09/13 10:39:44.679854, 3] smbd/process.c:1467(switch_message)
  432. switch message SMBtrans (pid 26545) conn 0x88bd290
  433. [2013/09/13 10:39:44.679928, 3] smbd/ipc.c:560(handle_trans)
  434. trans <\PIPE\> data=76 params=0 setup=2
  435. [2013/09/13 10:39:44.679989, 3] smbd/ipc.c:511(named_pipe)
  436. named pipe command on <> name
  437. [2013/09/13 10:39:44.680048, 3] smbd/ipc.c:475(api_fd_reply)
  438. Got API command 0x26 on pipe "samr" (pnum 4ad3)
  439. [2013/09/13 10:39:44.680109, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  440. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  441. [2013/09/13 10:39:44.680222, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  442. free_pipe_context: destroying talloc pool of size 1005
  443. [2013/09/13 10:39:44.681086, 3] smbd/process.c:1662(process_smb)
  444. Transaction 30 of length 172 (0 toread)
  445. [2013/09/13 10:39:44.681165, 3] smbd/process.c:1467(switch_message)
  446. switch message SMBtrans (pid 26545) conn 0x88bd290
  447. [2013/09/13 10:39:44.681241, 3] smbd/ipc.c:560(handle_trans)
  448. trans <\PIPE\> data=84 params=0 setup=2
  449. [2013/09/13 10:39:44.681312, 3] smbd/ipc.c:511(named_pipe)
  450. named pipe command on <> name
  451. [2013/09/13 10:39:44.681370, 3] smbd/ipc.c:475(api_fd_reply)
  452. Got API command 0x26 on pipe "samr" (pnum 4ad3)
  453. [2013/09/13 10:39:44.681444, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  454. api_rpcTNP: rpc command: SAMR_CREATEUSER2
  455. [2013/09/13 10:39:44.689203, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  456. init_sam_from_ldap: Entry found for user: crw7c$
  457. [2013/09/13 10:39:44.691000, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  458. free_pipe_context: destroying talloc pool of size 21
  459. [2013/09/13 10:39:44.691722, 3] smbd/process.c:1662(process_smb)
  460. Transaction 31 of length 132 (0 toread)
  461. [2013/09/13 10:39:44.691783, 3] smbd/process.c:1467(switch_message)
  462. switch message SMBtrans (pid 26545) conn 0x88bd290
  463. [2013/09/13 10:39:44.691839, 3] smbd/ipc.c:560(handle_trans)
  464. trans <\PIPE\> data=44 params=0 setup=2
  465. [2013/09/13 10:39:44.691891, 3] smbd/ipc.c:511(named_pipe)
  466. named pipe command on <> name
  467. [2013/09/13 10:39:44.691938, 3] smbd/ipc.c:475(api_fd_reply)
  468. Got API command 0x26 on pipe "samr" (pnum 4ad3)
  469. [2013/09/13 10:39:44.691999, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  470. api_rpcTNP: rpc command: SAMR_CLOSE
  471. [2013/09/13 10:39:44.692058, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  472. Closed policy
  473. [2013/09/13 10:39:44.692129, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  474. free_pipe_context: destroying talloc pool of size 21
  475. [2013/09/13 10:39:44.692829, 3] smbd/process.c:1662(process_smb)
  476. Transaction 32 of length 132 (0 toread)
  477. [2013/09/13 10:39:44.692886, 3] smbd/process.c:1467(switch_message)
  478. switch message SMBtrans (pid 26545) conn 0x88bd290
  479. [2013/09/13 10:39:44.692941, 3] smbd/ipc.c:560(handle_trans)
  480. trans <\PIPE\> data=44 params=0 setup=2
  481. [2013/09/13 10:39:44.692992, 3] smbd/ipc.c:511(named_pipe)
  482. named pipe command on <> name
  483. [2013/09/13 10:39:44.693038, 3] smbd/ipc.c:475(api_fd_reply)
  484. Got API command 0x26 on pipe "samr" (pnum 4ad3)
  485. [2013/09/13 10:39:44.693097, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  486. api_rpcTNP: rpc command: SAMR_CLOSE
  487. [2013/09/13 10:39:44.693160, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  488. Closed policy
  489. [2013/09/13 10:39:44.693231, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  490. free_pipe_context: destroying talloc pool of size 21
  491. [2013/09/13 10:39:44.693936, 3] smbd/process.c:1662(process_smb)
  492. Transaction 33 of length 45 (0 toread)
  493. [2013/09/13 10:39:44.693992, 3] smbd/process.c:1467(switch_message)
  494. switch message SMBclose (pid 26545) conn 0x88bd290
  495. [2013/09/13 10:39:44.694042, 3] smbd/reply.c:4848(reply_close)
  496. close fd=-1 fnum=19155 (numopen=1)
  497. [2013/09/13 10:39:44.695547, 3] smbd/process.c:1662(process_smb)
  498. Transaction 34 of length 100 (0 toread)
  499. [2013/09/13 10:39:44.695611, 3] smbd/process.c:1467(switch_message)
  500. switch message SMBntcreateX (pid 26545) conn 0x88bd290
  501. [2013/09/13 10:39:44.696409, 3] smbd/process.c:1662(process_smb)
  502. Transaction 35 of length 76 (0 toread)
  503. [2013/09/13 10:39:44.696486, 3] smbd/process.c:1467(switch_message)
  504. switch message SMBtrans2 (pid 26545) conn 0x88bd290
  505. [2013/09/13 10:39:44.697307, 3] smbd/process.c:1662(process_smb)
  506. Transaction 36 of length 184 (0 toread)
  507. [2013/09/13 10:39:44.697367, 3] smbd/process.c:1467(switch_message)
  508. switch message SMBwriteX (pid 26545) conn 0x88bd290
  509. [2013/09/13 10:39:44.697432, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  510. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  511. [2013/09/13 10:39:44.697485, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  512. check_bind_req for \samr
  513. [2013/09/13 10:39:44.697535, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  514. check_bind_req: \PIPE\samr -> \PIPE\samr
  515. [2013/09/13 10:39:44.697609, 3] smbd/pipes.c:361(pipe_write_andx_done)
  516. writeX-IPC nwritten=116
  517. [2013/09/13 10:39:44.698311, 3] smbd/process.c:1662(process_smb)
  518. Transaction 37 of length 63 (0 toread)
  519. [2013/09/13 10:39:44.698369, 3] smbd/process.c:1467(switch_message)
  520. switch message SMBreadX (pid 26545) conn 0x88bd290
  521. [2013/09/13 10:39:44.698424, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  522. free_pipe_context: destroying talloc pool of size 21
  523. [2013/09/13 10:39:44.698485, 3] smbd/pipes.c:485(pipe_read_andx_done)
  524. readX-IPC min=1024 max=1024 nread=68
  525. [2013/09/13 10:39:44.699173, 3] smbd/process.c:1662(process_smb)
  526. Transaction 38 of length 160 (0 toread)
  527. [2013/09/13 10:39:44.699231, 3] smbd/process.c:1467(switch_message)
  528. switch message SMBtrans (pid 26545) conn 0x88bd290
  529. [2013/09/13 10:39:44.699286, 3] smbd/ipc.c:560(handle_trans)
  530. trans <\PIPE\> data=72 params=0 setup=2
  531. [2013/09/13 10:39:44.699339, 3] smbd/ipc.c:511(named_pipe)
  532. named pipe command on <> name
  533. [2013/09/13 10:39:44.699387, 3] smbd/ipc.c:475(api_fd_reply)
  534. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  535. [2013/09/13 10:39:44.699449, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  536. api_rpcTNP: rpc command: SAMR_CONNECT5
  537. [2013/09/13 10:39:44.699535, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  538. free_pipe_context: destroying talloc pool of size 1005
  539. [2013/09/13 10:39:44.700282, 3] smbd/process.c:1662(process_smb)
  540. Transaction 39 of length 164 (0 toread)
  541. [2013/09/13 10:39:44.700340, 3] smbd/process.c:1467(switch_message)
  542. switch message SMBtrans (pid 26545) conn 0x88bd290
  543. [2013/09/13 10:39:44.700396, 3] smbd/ipc.c:560(handle_trans)
  544. trans <\PIPE\> data=76 params=0 setup=2
  545. [2013/09/13 10:39:44.700449, 3] smbd/ipc.c:511(named_pipe)
  546. named pipe command on <> name
  547. [2013/09/13 10:39:44.700496, 3] smbd/ipc.c:475(api_fd_reply)
  548. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  549. [2013/09/13 10:39:44.700557, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  550. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  551. [2013/09/13 10:39:44.700640, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  552. free_pipe_context: destroying talloc pool of size 1005
  553. [2013/09/13 10:39:44.701635, 3] smbd/process.c:1662(process_smb)
  554. Transaction 40 of length 180 (0 toread)
  555. [2013/09/13 10:39:44.701717, 3] smbd/process.c:1467(switch_message)
  556. switch message SMBtrans (pid 26545) conn 0x88bd290
  557. [2013/09/13 10:39:44.701779, 3] smbd/ipc.c:560(handle_trans)
  558. trans <\PIPE\> data=92 params=0 setup=2
  559. [2013/09/13 10:39:44.701834, 3] smbd/ipc.c:511(named_pipe)
  560. named pipe command on <> name
  561. [2013/09/13 10:39:44.701883, 3] smbd/ipc.c:475(api_fd_reply)
  562. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  563. [2013/09/13 10:39:44.701945, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  564. api_rpcTNP: rpc command: SAMR_LOOKUPNAMES
  565. [2013/09/13 10:39:44.702658, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  566. init_sam_from_ldap: Entry found for user: crw7c$
  567. [2013/09/13 10:39:44.704214, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  568. free_pipe_context: destroying talloc pool of size 33
  569. [2013/09/13 10:39:44.704987, 3] smbd/process.c:1662(process_smb)
  570. Transaction 41 of length 140 (0 toread)
  571. [2013/09/13 10:39:44.705076, 3] smbd/process.c:1467(switch_message)
  572. switch message SMBtrans (pid 26545) conn 0x88bd290
  573. [2013/09/13 10:39:44.705167, 3] smbd/ipc.c:560(handle_trans)
  574. trans <\PIPE\> data=52 params=0 setup=2
  575. [2013/09/13 10:39:44.705233, 3] smbd/ipc.c:511(named_pipe)
  576. named pipe command on <> name
  577. [2013/09/13 10:39:44.705296, 3] smbd/ipc.c:475(api_fd_reply)
  578. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  579. [2013/09/13 10:39:44.705367, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  580. api_rpcTNP: rpc command: SAMR_OPENUSER
  581. [2013/09/13 10:39:44.705653, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  582. free_pipe_context: destroying talloc pool of size 1237
  583. [2013/09/13 10:39:44.706383, 3] smbd/process.c:1662(process_smb)
  584. Transaction 42 of length 134 (0 toread)
  585. [2013/09/13 10:39:44.706447, 3] smbd/process.c:1467(switch_message)
  586. switch message SMBtrans (pid 26545) conn 0x88bd290
  587. [2013/09/13 10:39:44.706519, 3] smbd/ipc.c:560(handle_trans)
  588. trans <\PIPE\> data=46 params=0 setup=2
  589. [2013/09/13 10:39:44.706574, 3] smbd/ipc.c:511(named_pipe)
  590. named pipe command on <> name
  591. [2013/09/13 10:39:44.706633, 3] smbd/ipc.c:475(api_fd_reply)
  592. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  593. [2013/09/13 10:39:44.706695, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  594. api_rpcTNP: rpc command: SAMR_QUERYUSERINFO
  595. [2013/09/13 10:39:44.706910, 3] rpc_server/samr/srv_samr_nt.c:3011(_samr_QueryUserInfo)
  596. User:[crw7c$]
  597. [2013/09/13 10:39:44.707022, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  598. free_pipe_context: destroying talloc pool of size 749
  599. [2013/09/13 10:39:44.707740, 3] smbd/process.c:1662(process_smb)
  600. Transaction 43 of length 132 (0 toread)
  601. [2013/09/13 10:39:44.707805, 3] smbd/process.c:1467(switch_message)
  602. switch message SMBtrans (pid 26545) conn 0x88bd290
  603. [2013/09/13 10:39:44.707878, 3] smbd/ipc.c:560(handle_trans)
  604. trans <\PIPE\> data=44 params=0 setup=2
  605. [2013/09/13 10:39:44.707931, 3] smbd/ipc.c:511(named_pipe)
  606. named pipe command on <> name
  607. [2013/09/13 10:39:44.707990, 3] smbd/ipc.c:475(api_fd_reply)
  608. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  609. [2013/09/13 10:39:44.708051, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  610. api_rpcTNP: rpc command: SAMR_GETUSERPWINFO
  611. [2013/09/13 10:39:44.708844, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  612. free_pipe_context: destroying talloc pool of size 21
  613. [2013/09/13 10:39:44.710235, 3] smbd/process.c:1662(process_smb)
  614. Transaction 44 of length 669 (0 toread)
  615. [2013/09/13 10:39:44.710318, 3] smbd/process.c:1467(switch_message)
  616. switch message SMBtrans (pid 26545) conn 0x88bd290
  617. [2013/09/13 10:39:44.710377, 3] smbd/ipc.c:560(handle_trans)
  618. trans <\PIPE\> data=581 params=0 setup=2
  619. [2013/09/13 10:39:44.710447, 3] smbd/ipc.c:511(named_pipe)
  620. named pipe command on <> name
  621. [2013/09/13 10:39:44.710496, 3] smbd/ipc.c:475(api_fd_reply)
  622. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  623. [2013/09/13 10:39:44.710570, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  624. api_rpcTNP: rpc command: SAMR_SETUSERINFO2
  625. [2013/09/13 10:39:44.714032, 2] passdb/pdb_ldap.c:1180(init_ldap_from_sam)
  626. init_ldap_from_sam: Setting entry for user: crw7c$
  627. [2013/09/13 10:39:44.793751, 2] passdb/pdb_ldap.c:2042(ldapsam_update_sam_account)
  628. ldapsam_update_sam_account: successfully modified uid = crw7c$ in the LDAP database
  629. [2013/09/13 10:39:44.793887, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  630. free_pipe_context: destroying talloc pool of size 21
  631. [2013/09/13 10:39:44.795016, 3] smbd/process.c:1662(process_smb)
  632. Transaction 45 of length 132 (0 toread)
  633. [2013/09/13 10:39:44.795094, 3] smbd/process.c:1467(switch_message)
  634. switch message SMBtrans (pid 26545) conn 0x88bd290
  635. [2013/09/13 10:39:44.795160, 3] smbd/ipc.c:560(handle_trans)
  636. trans <\PIPE\> data=44 params=0 setup=2
  637. [2013/09/13 10:39:44.795216, 3] smbd/ipc.c:511(named_pipe)
  638. named pipe command on <> name
  639. [2013/09/13 10:39:44.795265, 3] smbd/ipc.c:475(api_fd_reply)
  640. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  641. [2013/09/13 10:39:44.795329, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  642. api_rpcTNP: rpc command: SAMR_CLOSE
  643. [2013/09/13 10:39:44.795384, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  644. Closed policy
  645. [2013/09/13 10:39:44.795473, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  646. free_pipe_context: destroying talloc pool of size 21
  647. [2013/09/13 10:39:44.796198, 3] smbd/process.c:1662(process_smb)
  648. Transaction 46 of length 132 (0 toread)
  649. [2013/09/13 10:39:44.796258, 3] smbd/process.c:1467(switch_message)
  650. switch message SMBtrans (pid 26545) conn 0x88bd290
  651. [2013/09/13 10:39:44.796313, 3] smbd/ipc.c:560(handle_trans)
  652. trans <\PIPE\> data=44 params=0 setup=2
  653. [2013/09/13 10:39:44.796366, 3] smbd/ipc.c:511(named_pipe)
  654. named pipe command on <> name
  655. [2013/09/13 10:39:44.796414, 3] smbd/ipc.c:475(api_fd_reply)
  656. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  657. [2013/09/13 10:39:44.796473, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  658. api_rpcTNP: rpc command: SAMR_CLOSE
  659. [2013/09/13 10:39:44.796526, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  660. Closed policy
  661. [2013/09/13 10:39:44.796596, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  662. free_pipe_context: destroying talloc pool of size 21
  663. [2013/09/13 10:39:44.797311, 3] smbd/process.c:1662(process_smb)
  664. Transaction 47 of length 132 (0 toread)
  665. [2013/09/13 10:39:44.797369, 3] smbd/process.c:1467(switch_message)
  666. switch message SMBtrans (pid 26545) conn 0x88bd290
  667. [2013/09/13 10:39:44.797425, 3] smbd/ipc.c:560(handle_trans)
  668. trans <\PIPE\> data=44 params=0 setup=2
  669. [2013/09/13 10:39:44.797477, 3] smbd/ipc.c:511(named_pipe)
  670. named pipe command on <> name
  671. [2013/09/13 10:39:44.797524, 3] smbd/ipc.c:475(api_fd_reply)
  672. Got API command 0x26 on pipe "samr" (pnum 4ad4)
  673. [2013/09/13 10:39:44.797584, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  674. api_rpcTNP: rpc command: SAMR_CLOSE
  675. [2013/09/13 10:39:44.797636, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  676. Closed policy
  677. [2013/09/13 10:39:44.797706, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  678. free_pipe_context: destroying talloc pool of size 21
  679. [2013/09/13 10:39:44.798454, 3] smbd/process.c:1662(process_smb)
  680. Transaction 48 of length 45 (0 toread)
  681. [2013/09/13 10:39:44.798513, 3] smbd/process.c:1467(switch_message)
  682. switch message SMBclose (pid 26545) conn 0x88bd290
  683. [2013/09/13 10:39:44.798564, 3] smbd/reply.c:4848(reply_close)
  684. close fd=-1 fnum=19156 (numopen=1)
  685. [2013/09/13 10:39:44.817963, 3] smbd/process.c:1662(process_smb)
  686. Transaction 49 of length 108 (0 toread)
  687. [2013/09/13 10:39:44.818026, 3] smbd/process.c:1467(switch_message)
  688. switch message SMBntcreateX (pid 26545) conn 0x88bd290
  689. [2013/09/13 10:39:44.818913, 3] smbd/process.c:1662(process_smb)
  690. Transaction 50 of length 76 (0 toread)
  691. [2013/09/13 10:39:44.818976, 3] smbd/process.c:1467(switch_message)
  692. switch message SMBtrans2 (pid 26545) conn 0x88bd290
  693. [2013/09/13 10:39:44.820269, 3] smbd/process.c:1662(process_smb)
  694. Transaction 51 of length 184 (0 toread)
  695. [2013/09/13 10:39:44.820327, 3] smbd/process.c:1467(switch_message)
  696. switch message SMBwriteX (pid 26545) conn 0x88bd290
  697. [2013/09/13 10:39:44.820357, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  698. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  699. [2013/09/13 10:39:44.820381, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  700. check_bind_req for \netlogon
  701. [2013/09/13 10:39:44.820404, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  702. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  703. [2013/09/13 10:39:44.820438, 3] smbd/pipes.c:361(pipe_write_andx_done)
  704. writeX-IPC nwritten=116
  705. [2013/09/13 10:39:44.821315, 3] smbd/process.c:1662(process_smb)
  706. Transaction 52 of length 63 (0 toread)
  707. [2013/09/13 10:39:44.821379, 3] smbd/process.c:1467(switch_message)
  708. switch message SMBreadX (pid 26545) conn 0x88bd290
  709. [2013/09/13 10:39:44.821408, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  710. free_pipe_context: destroying talloc pool of size 25
  711. [2013/09/13 10:39:44.821437, 3] smbd/pipes.c:485(pipe_read_andx_done)
  712. readX-IPC min=1024 max=1024 nread=72
  713. [2013/09/13 10:39:44.822244, 3] smbd/process.c:1662(process_smb)
  714. Transaction 53 of length 148 (0 toread)
  715. [2013/09/13 10:39:44.822303, 3] smbd/process.c:1467(switch_message)
  716. switch message SMBtrans (pid 26545) conn 0x88bd290
  717. [2013/09/13 10:39:44.822335, 3] smbd/ipc.c:560(handle_trans)
  718. trans <\PIPE\> data=60 params=0 setup=2
  719. [2013/09/13 10:39:44.822360, 3] smbd/ipc.c:511(named_pipe)
  720. named pipe command on <> name
  721. [2013/09/13 10:39:44.822382, 3] smbd/ipc.c:475(api_fd_reply)
  722. Got API command 0x26 on pipe "NETLOGON" (pnum 4ad5)
  723. [2013/09/13 10:39:44.822411, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  724. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  725. [2013/09/13 10:39:44.834230, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  726. free_pipe_context: destroying talloc pool of size 29
  727. [2013/09/13 10:39:44.835353, 3] smbd/process.c:1662(process_smb)
  728. Transaction 54 of length 45 (0 toread)
  729. [2013/09/13 10:39:44.835403, 3] smbd/process.c:1467(switch_message)
  730. switch message SMBclose (pid 26545) conn 0x88bd290
  731. [2013/09/13 10:39:44.835430, 3] smbd/reply.c:4848(reply_close)
  732. close fd=-1 fnum=19157 (numopen=1)
  733. [2013/09/13 10:39:44.836885, 3] smbd/process.c:1662(process_smb)
  734. Transaction 55 of length 108 (0 toread)
  735. [2013/09/13 10:39:44.836945, 3] smbd/process.c:1467(switch_message)
  736. switch message SMBntcreateX (pid 26545) conn 0x88bd290
  737. [2013/09/13 10:39:44.837742, 3] smbd/process.c:1662(process_smb)
  738. Transaction 56 of length 76 (0 toread)
  739. [2013/09/13 10:39:44.837802, 3] smbd/process.c:1467(switch_message)
  740. switch message SMBtrans2 (pid 26545) conn 0x88bd290
  741. [2013/09/13 10:39:44.838670, 3] smbd/process.c:1662(process_smb)
  742. Transaction 57 of length 184 (0 toread)
  743. [2013/09/13 10:39:44.838729, 3] smbd/process.c:1467(switch_message)
  744. switch message SMBwriteX (pid 26545) conn 0x88bd290
  745. [2013/09/13 10:39:44.838779, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  746. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  747. [2013/09/13 10:39:44.838803, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  748. check_bind_req for \netlogon
  749. [2013/09/13 10:39:44.838826, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  750. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  751. [2013/09/13 10:39:44.838860, 3] smbd/pipes.c:361(pipe_write_andx_done)
  752. writeX-IPC nwritten=116
  753. [2013/09/13 10:39:44.839591, 3] smbd/process.c:1662(process_smb)
  754. Transaction 58 of length 63 (0 toread)
  755. [2013/09/13 10:39:44.839650, 3] smbd/process.c:1467(switch_message)
  756. switch message SMBreadX (pid 26545) conn 0x88bd290
  757. [2013/09/13 10:39:44.839675, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  758. free_pipe_context: destroying talloc pool of size 25
  759. [2013/09/13 10:39:44.839703, 3] smbd/pipes.c:485(pipe_read_andx_done)
  760. readX-IPC min=1024 max=1024 nread=72
  761. [2013/09/13 10:39:44.840457, 3] smbd/process.c:1662(process_smb)
  762. Transaction 59 of length 148 (0 toread)
  763. [2013/09/13 10:39:44.840512, 3] smbd/process.c:1467(switch_message)
  764. switch message SMBtrans (pid 26545) conn 0x88bd290
  765. [2013/09/13 10:39:44.840537, 3] smbd/ipc.c:560(handle_trans)
  766. trans <\PIPE\> data=60 params=0 setup=2
  767. [2013/09/13 10:39:44.840562, 3] smbd/ipc.c:511(named_pipe)
  768. named pipe command on <> name
  769. [2013/09/13 10:39:44.840584, 3] smbd/ipc.c:475(api_fd_reply)
  770. Got API command 0x26 on pipe "NETLOGON" (pnum 4ad6)
  771. [2013/09/13 10:39:44.840612, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  772. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  773. [2013/09/13 10:39:44.840647, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  774. free_pipe_context: destroying talloc pool of size 29
  775. [2013/09/13 10:39:44.841437, 3] smbd/process.c:1662(process_smb)
  776. Transaction 60 of length 45 (0 toread)
  777. [2013/09/13 10:39:44.841515, 3] smbd/process.c:1467(switch_message)
  778. switch message SMBclose (pid 26545) conn 0x88bd290
  779. [2013/09/13 10:39:44.841550, 3] smbd/reply.c:4848(reply_close)
  780. close fd=-1 fnum=19158 (numopen=1)
  781. [2013/09/13 10:39:44.842893, 3] smbd/process.c:1662(process_smb)
  782. Transaction 61 of length 108 (0 toread)
  783. [2013/09/13 10:39:44.842954, 3] smbd/process.c:1467(switch_message)
  784. switch message SMBntcreateX (pid 26545) conn 0x88bd290
  785. [2013/09/13 10:39:44.843820, 3] smbd/process.c:1662(process_smb)
  786. Transaction 62 of length 76 (0 toread)
  787. [2013/09/13 10:39:44.843895, 3] smbd/process.c:1467(switch_message)
  788. switch message SMBtrans2 (pid 26545) conn 0x88bd290
  789. [2013/09/13 10:39:44.844817, 3] smbd/process.c:1662(process_smb)
  790. Transaction 63 of length 184 (0 toread)
  791. [2013/09/13 10:39:44.844876, 3] smbd/process.c:1467(switch_message)
  792. switch message SMBwriteX (pid 26545) conn 0x88bd290
  793. [2013/09/13 10:39:44.844933, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  794. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  795. [2013/09/13 10:39:44.844957, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  796. check_bind_req for \netlogon
  797. [2013/09/13 10:39:44.844980, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  798. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  799. [2013/09/13 10:39:44.845014, 3] smbd/pipes.c:361(pipe_write_andx_done)
  800. writeX-IPC nwritten=116
  801. [2013/09/13 10:39:44.846196, 3] smbd/process.c:1662(process_smb)
  802. Transaction 64 of length 63 (0 toread)
  803. [2013/09/13 10:39:44.846242, 3] smbd/process.c:1467(switch_message)
  804. switch message SMBreadX (pid 26545) conn 0x88bd290
  805. [2013/09/13 10:39:44.846268, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  806. free_pipe_context: destroying talloc pool of size 25
  807. [2013/09/13 10:39:44.846296, 3] smbd/pipes.c:485(pipe_read_andx_done)
  808. readX-IPC min=1024 max=1024 nread=72
  809. [2013/09/13 10:39:44.847261, 3] smbd/process.c:1662(process_smb)
  810. Transaction 65 of length 144 (0 toread)
  811. [2013/09/13 10:39:44.847300, 3] smbd/process.c:1467(switch_message)
  812. switch message SMBtrans (pid 26545) conn 0x88bd290
  813. [2013/09/13 10:39:44.847332, 3] smbd/ipc.c:560(handle_trans)
  814. trans <\PIPE\> data=56 params=0 setup=2
  815. [2013/09/13 10:39:44.847356, 3] smbd/ipc.c:511(named_pipe)
  816. named pipe command on <> name
  817. [2013/09/13 10:39:44.847379, 3] smbd/ipc.c:475(api_fd_reply)
  818. Got API command 0x26 on pipe "NETLOGON" (pnum 4ad7)
  819. [2013/09/13 10:39:44.847407, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  820. api_rpcTNP: rpc command: NETR_NETRENUMERATETRUSTEDDOMAINS
  821. [2013/09/13 10:39:44.865459, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  822. Closed policy
  823. [2013/09/13 10:39:44.865516, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  824. free_pipe_context: destroying talloc pool of size 1498
  825. [2013/09/13 10:39:44.866534, 3] smbd/process.c:1662(process_smb)
  826. Transaction 66 of length 45 (0 toread)
  827. [2013/09/13 10:39:44.866629, 3] smbd/process.c:1467(switch_message)
  828. switch message SMBclose (pid 26545) conn 0x88bd290
  829. [2013/09/13 10:39:44.866656, 3] smbd/reply.c:4848(reply_close)
  830. close fd=-1 fnum=19159 (numopen=1)
  831. [2013/09/13 10:39:58.501203, 3] smbd/process.c:1662(process_smb)
  832. Transaction 67 of length 39 (0 toread)
  833. [2013/09/13 10:39:58.501295, 3] smbd/process.c:1467(switch_message)
  834. switch message SMBtdis (pid 26545) conn 0x88bd290
  835. [2013/09/13 10:39:58.501368, 3] smbd/service.c:1378(close_cnum)
  836. crw7c (192.168.sn.89) closed connection to service IPC$
  837. [2013/09/13 10:39:58.501428, 3] smbd/connection.c:35(yield_connection)
  838. Yielding connection to IPC$
  839. [2013/09/13 10:39:58.502134, 3] smbd/process.c:1662(process_smb)
  840. Transaction 68 of length 43 (0 toread)
  841. [2013/09/13 10:39:58.502210, 3] smbd/process.c:1467(switch_message)
  842. switch message SMBulogoffX (pid 26545) conn 0x0
  843. [2013/09/13 10:39:58.502304, 3] smbd/reply.c:2096(reply_ulogoffX)
  844. ulogoffX vuid=100
  845. [2013/09/13 10:39:58.502977, 1] smbd/process.c:457(receive_smb_talloc)
  846. receive_smb_raw_talloc failed for client 192.168.sn.89 read error = NT_STATUS_CONNECTION_RESET.
  847. [2013/09/13 10:39:58.503126, 3] smbd/server_exit.c:181(exit_server_common)
  848. Server exit (failed to receive smb request)
  849. [2013/09/13 10:40:06.245092, 3] param/loadparm.c:9572(lp_load_ex)
  850. lp_load_ex: refreshing parameters
  851. [2013/09/13 10:40:06.245192, 3] param/loadparm.c:5192(init_globals)
  852. Initialising global parameters
  853. [2013/09/13 10:40:06.245356, 3] ../lib/util/params.c:550(pm_process)
  854. params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
  855. [2013/09/13 10:40:06.245424, 3] param/loadparm.c:8310(do_section)
  856. Processing section "[global]"
  857. [2013/09/13 10:40:06.245527, 3] ../lib/util/params.c:550(pm_process)
  858. params.c:pm_process() - Processing configuration file "/etc/samba/alias.conf"
  859. [2013/09/13 10:40:06.245627, 1] param/loadparm.c:7992(lp_do_parameter)
  860. WARNING: The "enable privileges" option is deprecated
  861. [2013/09/13 10:40:06.246094, 1] ../lib/util/params.c:350(Parameter)
  862. params.c:Parameter() - Ignoring badly formed line in configuration file: all combinations of upper and lower case.
  863. [2013/09/13 10:40:06.246621, 3] ../lib/util/params.c:550(pm_process)
  864. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/venus.conf"
  865. [2013/09/13 10:40:06.246739, 3] ../lib/util/params.c:550(pm_process)
  866. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  867. [2013/09/13 10:40:06.246797, 3] param/loadparm.c:8310(do_section)
  868. Processing section "[global]"
  869. [2013/09/13 10:40:06.246903, 2] param/loadparm.c:8327(do_section)
  870. Processing section "[homes]"
  871. [2013/09/13 10:40:06.247049, 2] param/loadparm.c:8327(do_section)
  872. Processing section "[home]"
  873. [2013/09/13 10:40:06.247193, 2] param/loadparm.c:8327(do_section)
  874. Processing section "[Profiles]"
  875. [2013/09/13 10:40:06.247409, 2] param/loadparm.c:8327(do_section)
  876. Processing section "[Profile]"
  877. [2013/09/13 10:40:06.247559, 2] param/loadparm.c:8327(do_section)
  878. Processing section "[Profiles.V2]"
  879. [2013/09/13 10:40:06.247742, 2] param/loadparm.c:8327(do_section)
  880. Processing section "[Profile.v2]"
  881. [2013/09/13 10:40:06.247929, 2] param/loadparm.c:8327(do_section)
  882. Processing section "[mgmt]"
  883. [2013/09/13 10:40:06.248095, 2] param/loadparm.c:8327(do_section)
  884. Processing section "[accData]"
  885. [2013/09/13 10:40:06.248272, 2] param/loadparm.c:8327(do_section)
  886. Processing section "[printers]"
  887. [2013/09/13 10:40:06.248429, 2] param/loadparm.c:8327(do_section)
  888. Processing section "[print$]"
  889. [2013/09/13 10:40:06.248598, 2] param/loadparm.c:8327(do_section)
  890. Processing section "[installkit]"
  891. [2013/09/13 10:40:06.248742, 2] param/loadparm.c:8327(do_section)
  892. Processing section "[public]"
  893. [2013/09/13 10:40:06.248902, 2] param/loadparm.c:8327(do_section)
  894. Processing section "[accounts]"
  895. [2013/09/13 10:40:06.249080, 2] param/loadparm.c:8327(do_section)
  896. Processing section "[PaDFru_Midlands]"
  897. [2013/09/13 10:40:06.249201, 1] param/loadparm.c:7992(lp_do_parameter)
  898. WARNING: The "printer admin" option is deprecated
  899. [2013/09/13 10:40:06.249532, 2] param/loadparm.c:8327(do_section)
  900. Processing section "[PaDFru]"
  901. [2013/09/13 10:40:06.249652, 1] param/loadparm.c:7992(lp_do_parameter)
  902. WARNING: The "printer admin" option is deprecated
  903. [2013/09/13 10:40:06.250094, 2] param/loadparm.c:8327(do_section)
  904. Processing section "[PaDFru_Headed]"
  905. [2013/09/13 10:40:06.250324, 1] param/loadparm.c:7992(lp_do_parameter)
  906. WARNING: The "printer admin" option is deprecated
  907. [2013/09/13 10:40:06.250906, 3] ../lib/util/params.c:550(pm_process)
  908. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/gmdata.conf"
  909. [2013/09/13 10:40:06.250975, 2] param/loadparm.c:8327(do_section)
  910. Processing section "[gm]"
  911. [2013/09/13 10:40:06.251392, 2] param/loadparm.c:8327(do_section)
  912. Processing section "[tt]"
  913. [2013/09/13 10:40:06.251829, 3] ../lib/util/params.c:550(pm_process)
  914. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  915. [2013/09/13 10:40:06.251909, 3] param/loadparm.c:8310(do_section)
  916. Processing section "[global]"
  917. [2013/09/13 10:40:06.252015, 2] param/loadparm.c:8327(do_section)
  918. Processing section "[homes]"
  919. [2013/09/13 10:40:06.252205, 2] param/loadparm.c:8327(do_section)
  920. Processing section "[home]"
  921. [2013/09/13 10:40:06.252308, 2] param/loadparm.c:8327(do_section)
  922. Processing section "[Profiles]"
  923. [2013/09/13 10:40:06.252480, 2] param/loadparm.c:8327(do_section)
  924. Processing section "[Profile]"
  925. [2013/09/13 10:40:06.252585, 2] param/loadparm.c:8327(do_section)
  926. Processing section "[Profiles.V2]"
  927. [2013/09/13 10:40:06.252724, 2] param/loadparm.c:8327(do_section)
  928. Processing section "[Profile.v2]"
  929. [2013/09/13 10:40:06.252870, 2] param/loadparm.c:8327(do_section)
  930. Processing section "[mgmt]"
  931. [2013/09/13 10:40:06.253006, 2] param/loadparm.c:8327(do_section)
  932. Processing section "[accData]"
  933. [2013/09/13 10:40:06.253069, 2] param/loadparm.c:8327(do_section)
  934. Processing section "[printers]"
  935. [2013/09/13 10:40:06.253117, 2] param/loadparm.c:8327(do_section)
  936. Processing section "[print$]"
  937. [2013/09/13 10:40:06.253172, 2] param/loadparm.c:8327(do_section)
  938. Processing section "[installkit]"
  939. [2013/09/13 10:40:06.253216, 2] param/loadparm.c:8327(do_section)
  940. Processing section "[public]"
  941. [2013/09/13 10:40:06.253265, 2] param/loadparm.c:8327(do_section)
  942. Processing section "[accounts]"
  943. [2013/09/13 10:40:06.253323, 2] param/loadparm.c:8327(do_section)
  944. Processing section "[PaDFru_Midlands]"
  945. [2013/09/13 10:40:06.253356, 1] param/loadparm.c:7992(lp_do_parameter)
  946. WARNING: The "printer admin" option is deprecated
  947. [2013/09/13 10:40:06.253498, 2] param/loadparm.c:8327(do_section)
  948. Processing section "[PaDFru]"
  949. [2013/09/13 10:40:06.253531, 1] param/loadparm.c:7992(lp_do_parameter)
  950. WARNING: The "printer admin" option is deprecated
  951. [2013/09/13 10:40:06.253673, 2] param/loadparm.c:8327(do_section)
  952. Processing section "[PaDFru_Headed]"
  953. [2013/09/13 10:40:06.253706, 1] param/loadparm.c:7992(lp_do_parameter)
  954. WARNING: The "printer admin" option is deprecated
  955. [2013/09/13 10:40:06.253856, 2] param/loadparm.c:8327(do_section)
  956. Processing section "[netlogon]"
  957. [2013/09/13 10:40:06.253934, 1] param/loadparm.c:7992(lp_do_parameter)
  958. WARNING: The "share modes" option is deprecated
  959. [2013/09/13 10:40:06.253980, 2] param/loadparm.c:8327(do_section)
  960. Processing section "[netlogoff]"
  961. [2013/09/13 10:40:06.254055, 1] param/loadparm.c:7992(lp_do_parameter)
  962. WARNING: The "share modes" option is deprecated
  963. [2013/09/13 10:40:06.254096, 2] param/loadparm.c:8327(do_section)
  964. Processing section "[printers]"
  965. [2013/09/13 10:40:06.254144, 2] param/loadparm.c:8327(do_section)
  966. Processing section "[print$]"
  967. [2013/09/13 10:40:06.254224, 3] param/loadparm.c:6630(lp_add_ipc)
  968. adding IPC service
  969. [2013/09/13 10:40:06.254307, 2] lib/interface.c:479(interpret_interface)
  970. interpret_interface: Adding interface 192.168.sn.21/24
  971. [2013/09/13 10:40:06.254337, 2] lib/interface.c:341(add_interface)
  972. added interface 192.168.sn.21/ ip=192.168.sn.21 bcast=192.168.sn.255 netmask=255.255.255.0
  973. [2013/09/13 10:40:06.254393, 3] auth/auth.c:219(check_ntlm_password)
  974. check_ntlm_password: Checking password for unmapped user [domain]\[geek]@[CRW7C] with the new password interface
  975. [2013/09/13 10:40:06.254420, 3] auth/auth.c:222(check_ntlm_password)
  976. check_ntlm_password: mapped user is: [domain]\[geek]@[CRW7C]
  977. [2013/09/13 10:40:06.254546, 2] lib/smbldap.c:1018(smbldap_open_connection)
  978. smbldap_open_connection: connection opened
  979. [2013/09/13 10:40:06.255452, 3] lib/smbldap.c:1948(smbldap_check_root_dse)
  980. smbldap_check_root_dse: Expected one rootDSE, got 0
  981. [2013/09/13 10:40:06.255490, 3] lib/smbldap.c:1240(smbldap_connect_system)
  982. ldap_connect_system: successful connection to the LDAP server
  983. [2013/09/13 10:40:06.255856, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  984. init_sam_from_ldap: Entry found for user: geek
  985. [2013/09/13 10:40:06.257455, 3] auth/auth.c:268(check_ntlm_password)
  986. check_ntlm_password: sam authentication for user [geek] succeeded
  987. [2013/09/13 10:40:06.257501, 2] auth/auth.c:309(check_ntlm_password)
  988. check_ntlm_password: authentication for user [geek] -> [geek] -> [geek] succeeded
  989. [2013/09/13 10:40:06.258841, 3] groupdb/mapping.c:772(pdb_create_builtin_alias)
  990. pdb_create_builtin_alias: Could not get a gid out of winbind
  991. [2013/09/13 10:40:06.258935, 2] auth/token_util.c:479(finalize_local_nt_token)
  992. WARNING: Failed to create BUILTIN\Users group! Can Winbind allocate gids?
  993. [2013/09/13 10:40:06.260233, 3] ../libcli/auth/ntlmssp_sign.c:535(ntlmssp_sign_init)
  994. NTLMSSP Sign/Seal - Initialising with flags:
  995. [2013/09/13 10:40:06.260269, 3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags)
  996. Got NTLMSSP neg_flags=0xe2088215
  997. [2013/09/13 10:40:06.260312, 3] smbd/password.c:298(register_existing_vuid)
  998. register_existing_vuid: User name: geek Real name: Current Geek
  999. [2013/09/13 10:40:06.260347, 3] smbd/password.c:308(register_existing_vuid)
  1000. register_existing_vuid: UNIX uid 1012 is UNIX user geek, and will be vuid 100
  1001. [2013/09/13 10:40:06.260422, 3] smbd/password.c:238(register_homes_share)
  1002. Adding homes service for user 'geek' using home directory: '/home/geek'
  1003. [2013/09/13 10:40:06.260480, 3] param/loadparm.c:6582(lp_add_home)
  1004. adding home's share [geek] for user 'geek' at '/home/%u'
  1005. [2013/09/13 10:40:06.261517, 3] smbd/process.c:1662(process_smb)
  1006. Transaction 3 of length 80 (0 toread)
  1007. [2013/09/13 10:40:06.261590, 3] smbd/process.c:1467(switch_message)
  1008. switch message SMBtconX (pid 26694) conn 0x0
  1009. [2013/09/13 10:40:06.261668, 3] lib/access.c:338(allow_access)
  1010. Allowed connection from 192.168.sn.89 (192.168.sn.89)
  1011. [2013/09/13 10:40:06.261714, 3] smbd/service.c:872(make_connection_snum)
  1012. Connect path is '/tmp' for service [IPC$]
  1013. [2013/09/13 10:40:06.261761, 3] smbd/vfs.c:102(vfs_init_default)
  1014. Initialising default vfs hooks
  1015. [2013/09/13 10:40:06.261799, 3] smbd/vfs.c:128(vfs_init_custom)
  1016. Initialising custom vfs hooks from [/[Default VFS]/]
  1017. [2013/09/13 10:40:06.261917, 3] smbd/service.c:1114(make_connection_snum)
  1018. crw7c (192.168.sn.89) connect to service IPC$ initially as user geek (uid=1012, gid=512) (pid 26694)
  1019. [2013/09/13 10:40:06.261955, 3] smbd/reply.c:871(reply_tcon_and_X)
  1020. tconX service=IPC$
  1021. [2013/09/13 10:40:06.273459, 3] smbd/process.c:1662(process_smb)
  1022. Transaction 4 of length 104 (0 toread)
  1023. [2013/09/13 10:40:06.273538, 3] smbd/process.c:1467(switch_message)
  1024. switch message SMBntcreateX (pid 26694) conn 0x88bd290
  1025. [2013/09/13 10:40:06.274479, 3] smbd/process.c:1662(process_smb)
  1026. Transaction 5 of length 76 (0 toread)
  1027. [2013/09/13 10:40:06.274553, 3] smbd/process.c:1467(switch_message)
  1028. switch message SMBtrans2 (pid 26694) conn 0x88bd290
  1029. [2013/09/13 10:40:06.275426, 3] smbd/process.c:1662(process_smb)
  1030. Transaction 6 of length 184 (0 toread)
  1031. [2013/09/13 10:40:06.275506, 3] smbd/process.c:1467(switch_message)
  1032. switch message SMBwriteX (pid 26694) conn 0x88bd290
  1033. [2013/09/13 10:40:06.275614, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1034. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  1035. [2013/09/13 10:40:06.275677, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1036. check_bind_req for \lsarpc
  1037. [2013/09/13 10:40:06.275734, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1038. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  1039. [2013/09/13 10:40:06.275830, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1040. writeX-IPC nwritten=116
  1041. [2013/09/13 10:40:06.276580, 3] smbd/process.c:1662(process_smb)
  1042. Transaction 7 of length 63 (0 toread)
  1043. [2013/09/13 10:40:06.276645, 3] smbd/process.c:1467(switch_message)
  1044. switch message SMBreadX (pid 26694) conn 0x88bd290
  1045. [2013/09/13 10:40:06.276708, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1046. free_pipe_context: destroying talloc pool of size 23
  1047. [2013/09/13 10:40:06.276779, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1048. readX-IPC min=1024 max=1024 nread=68
  1049. [2013/09/13 10:40:06.277516, 3] smbd/process.c:1662(process_smb)
  1050. Transaction 8 of length 168 (0 toread)
  1051. [2013/09/13 10:40:06.277582, 3] smbd/process.c:1467(switch_message)
  1052. switch message SMBtrans (pid 26694) conn 0x88bd290
  1053. [2013/09/13 10:40:06.277647, 3] smbd/ipc.c:560(handle_trans)
  1054. trans <\PIPE\> data=80 params=0 setup=2
  1055. [2013/09/13 10:40:06.277707, 3] smbd/ipc.c:511(named_pipe)
  1056. named pipe command on <> name
  1057. [2013/09/13 10:40:06.277765, 3] smbd/ipc.c:475(api_fd_reply)
  1058. Got API command 0x26 on pipe "lsarpc" (pnum 4530)
  1059. [2013/09/13 10:40:06.277836, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1060. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  1061. [2013/09/13 10:40:06.278003, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1062. free_pipe_context: destroying talloc pool of size 1075
  1063. [2013/09/13 10:40:06.278734, 3] smbd/process.c:1662(process_smb)
  1064. Transaction 9 of length 134 (0 toread)
  1065. [2013/09/13 10:40:06.278799, 3] smbd/process.c:1467(switch_message)
  1066. switch message SMBtrans (pid 26694) conn 0x88bd290
  1067. [2013/09/13 10:40:06.278858, 3] smbd/ipc.c:560(handle_trans)
  1068. trans <\PIPE\> data=46 params=0 setup=2
  1069. [2013/09/13 10:40:06.278943, 3] smbd/ipc.c:511(named_pipe)
  1070. named pipe command on <> name
  1071. [2013/09/13 10:40:06.278995, 3] smbd/ipc.c:475(api_fd_reply)
  1072. Got API command 0x26 on pipe "lsarpc" (pnum 4530)
  1073. [2013/09/13 10:40:06.279060, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1074. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  1075. [2013/09/13 10:40:06.279148, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1076. free_pipe_context: destroying talloc pool of size 27
  1077. [2013/09/13 10:40:06.280300, 3] smbd/process.c:1662(process_smb)
  1078. Transaction 10 of length 134 (0 toread)
  1079. [2013/09/13 10:40:06.280384, 3] smbd/process.c:1467(switch_message)
  1080. switch message SMBtrans (pid 26694) conn 0x88bd290
  1081. [2013/09/13 10:40:06.280447, 3] smbd/ipc.c:560(handle_trans)
  1082. trans <\PIPE\> data=46 params=0 setup=2
  1083. [2013/09/13 10:40:06.280505, 3] smbd/ipc.c:511(named_pipe)
  1084. named pipe command on <> name
  1085. [2013/09/13 10:40:06.280557, 3] smbd/ipc.c:475(api_fd_reply)
  1086. Got API command 0x26 on pipe "lsarpc" (pnum 4530)
  1087. [2013/09/13 10:40:06.280623, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1088. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  1089. [2013/09/13 10:40:06.280733, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1090. free_pipe_context: destroying talloc pool of size 135
  1091. [2013/09/13 10:40:06.281475, 3] smbd/process.c:1662(process_smb)
  1092. Transaction 11 of length 132 (0 toread)
  1093. [2013/09/13 10:40:06.281542, 3] smbd/process.c:1467(switch_message)
  1094. switch message SMBtrans (pid 26694) conn 0x88bd290
  1095. [2013/09/13 10:40:06.281600, 3] smbd/ipc.c:560(handle_trans)
  1096. trans <\PIPE\> data=44 params=0 setup=2
  1097. [2013/09/13 10:40:06.281656, 3] smbd/ipc.c:511(named_pipe)
  1098. named pipe command on <> name
  1099. [2013/09/13 10:40:06.281708, 3] smbd/ipc.c:475(api_fd_reply)
  1100. Got API command 0x26 on pipe "lsarpc" (pnum 4530)
  1101. [2013/09/13 10:40:06.281771, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1102. api_rpcTNP: rpc command: LSA_CLOSE
  1103. [2013/09/13 10:40:06.281831, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1104. Closed policy
  1105. [2013/09/13 10:40:06.281924, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1106. free_pipe_context: destroying talloc pool of size 23
  1107. [2013/09/13 10:40:06.282673, 3] smbd/process.c:1662(process_smb)
  1108. Transaction 12 of length 45 (0 toread)
  1109. [2013/09/13 10:40:06.282738, 3] smbd/process.c:1467(switch_message)
  1110. switch message SMBclose (pid 26694) conn 0x88bd290
  1111. [2013/09/13 10:40:06.282797, 3] smbd/reply.c:4848(reply_close)
  1112. close fd=-1 fnum=17712 (numopen=1)
  1113. [2013/09/13 10:40:06.656383, 3] smbd/process.c:1662(process_smb)
  1114. Transaction 13 of length 104 (0 toread)
  1115. [2013/09/13 10:40:06.656471, 3] smbd/process.c:1467(switch_message)
  1116. switch message SMBntcreateX (pid 26694) conn 0x88bd290
  1117. [2013/09/13 10:40:06.657364, 3] smbd/process.c:1662(process_smb)
  1118. Transaction 14 of length 76 (0 toread)
  1119. [2013/09/13 10:40:06.657447, 3] smbd/process.c:1467(switch_message)
  1120. switch message SMBtrans2 (pid 26694) conn 0x88bd290
  1121. [2013/09/13 10:40:06.658276, 3] smbd/process.c:1662(process_smb)
  1122. Transaction 15 of length 184 (0 toread)
  1123. [2013/09/13 10:40:06.658346, 3] smbd/process.c:1467(switch_message)
  1124. switch message SMBwriteX (pid 26694) conn 0x88bd290
  1125. [2013/09/13 10:40:06.658418, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1126. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  1127. [2013/09/13 10:40:06.658475, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1128. check_bind_req for \lsarpc
  1129. [2013/09/13 10:40:06.658529, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1130. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  1131. [2013/09/13 10:40:06.658609, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1132. writeX-IPC nwritten=116
  1133. [2013/09/13 10:40:06.659432, 3] smbd/process.c:1662(process_smb)
  1134. Transaction 16 of length 63 (0 toread)
  1135. [2013/09/13 10:40:06.659497, 3] smbd/process.c:1467(switch_message)
  1136. switch message SMBreadX (pid 26694) conn 0x88bd290
  1137. [2013/09/13 10:40:06.659557, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1138. free_pipe_context: destroying talloc pool of size 23
  1139. [2013/09/13 10:40:06.659621, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1140. readX-IPC min=1024 max=1024 nread=68
  1141. [2013/09/13 10:40:06.660469, 3] smbd/process.c:1662(process_smb)
  1142. Transaction 17 of length 168 (0 toread)
  1143. [2013/09/13 10:40:06.660534, 3] smbd/process.c:1467(switch_message)
  1144. switch message SMBtrans (pid 26694) conn 0x88bd290
  1145. [2013/09/13 10:40:06.660593, 3] smbd/ipc.c:560(handle_trans)
  1146. trans <\PIPE\> data=80 params=0 setup=2
  1147. [2013/09/13 10:40:06.660651, 3] smbd/ipc.c:511(named_pipe)
  1148. named pipe command on <> name
  1149. [2013/09/13 10:40:06.660703, 3] smbd/ipc.c:475(api_fd_reply)
  1150. Got API command 0x26 on pipe "lsarpc" (pnum 4531)
  1151. [2013/09/13 10:40:06.660769, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1152. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  1153. [2013/09/13 10:40:06.660870, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1154. free_pipe_context: destroying talloc pool of size 1075
  1155. [2013/09/13 10:40:06.661657, 3] smbd/process.c:1662(process_smb)
  1156. Transaction 18 of length 134 (0 toread)
  1157. [2013/09/13 10:40:06.661722, 3] smbd/process.c:1467(switch_message)
  1158. switch message SMBtrans (pid 26694) conn 0x88bd290
  1159. [2013/09/13 10:40:06.661781, 3] smbd/ipc.c:560(handle_trans)
  1160. trans <\PIPE\> data=46 params=0 setup=2
  1161. [2013/09/13 10:40:06.661837, 3] smbd/ipc.c:511(named_pipe)
  1162. named pipe command on <> name
  1163. [2013/09/13 10:40:06.661898, 3] smbd/ipc.c:475(api_fd_reply)
  1164. Got API command 0x26 on pipe "lsarpc" (pnum 4531)
  1165. [2013/09/13 10:40:06.661962, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1166. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  1167. [2013/09/13 10:40:06.662042, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1168. free_pipe_context: destroying talloc pool of size 27
  1169. [2013/09/13 10:40:06.663204, 3] smbd/process.c:1662(process_smb)
  1170. Transaction 19 of length 134 (0 toread)
  1171. [2013/09/13 10:40:06.663287, 3] smbd/process.c:1467(switch_message)
  1172. switch message SMBtrans (pid 26694) conn 0x88bd290
  1173. [2013/09/13 10:40:06.663350, 3] smbd/ipc.c:560(handle_trans)
  1174. trans <\PIPE\> data=46 params=0 setup=2
  1175. [2013/09/13 10:40:06.663408, 3] smbd/ipc.c:511(named_pipe)
  1176. named pipe command on <> name
  1177. [2013/09/13 10:40:06.663461, 3] smbd/ipc.c:475(api_fd_reply)
  1178. Got API command 0x26 on pipe "lsarpc" (pnum 4531)
  1179. [2013/09/13 10:40:06.663526, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1180. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  1181. [2013/09/13 10:40:06.663615, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1182. free_pipe_context: destroying talloc pool of size 135
  1183. [2013/09/13 10:40:06.664377, 3] smbd/process.c:1662(process_smb)
  1184. Transaction 20 of length 132 (0 toread)
  1185. [2013/09/13 10:40:06.664447, 3] smbd/process.c:1467(switch_message)
  1186. switch message SMBtrans (pid 26694) conn 0x88bd290
  1187. [2013/09/13 10:40:06.664506, 3] smbd/ipc.c:560(handle_trans)
  1188. trans <\PIPE\> data=44 params=0 setup=2
  1189. [2013/09/13 10:40:06.664562, 3] smbd/ipc.c:511(named_pipe)
  1190. named pipe command on <> name
  1191. [2013/09/13 10:40:06.664614, 3] smbd/ipc.c:475(api_fd_reply)
  1192. Got API command 0x26 on pipe "lsarpc" (pnum 4531)
  1193. [2013/09/13 10:40:06.664678, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1194. api_rpcTNP: rpc command: LSA_CLOSE
  1195. [2013/09/13 10:40:06.664734, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1196. Closed policy
  1197. [2013/09/13 10:40:06.664810, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1198. free_pipe_context: destroying talloc pool of size 23
  1199. [2013/09/13 10:40:06.665580, 3] smbd/process.c:1662(process_smb)
  1200. Transaction 21 of length 45 (0 toread)
  1201. [2013/09/13 10:40:06.665644, 3] smbd/process.c:1467(switch_message)
  1202. switch message SMBclose (pid 26694) conn 0x88bd290
  1203. [2013/09/13 10:40:06.665700, 3] smbd/reply.c:4848(reply_close)
  1204. close fd=-1 fnum=17713 (numopen=1)
  1205. [2013/09/13 10:40:06.669940, 3] smbd/process.c:1662(process_smb)
  1206. Transaction 22 of length 100 (0 toread)
  1207. [2013/09/13 10:40:06.670021, 3] smbd/process.c:1467(switch_message)
  1208. switch message SMBntcreateX (pid 26694) conn 0x88bd290
  1209. [2013/09/13 10:40:06.670969, 3] smbd/process.c:1662(process_smb)
  1210. Transaction 23 of length 76 (0 toread)
  1211. [2013/09/13 10:40:06.671049, 3] smbd/process.c:1467(switch_message)
  1212. switch message SMBtrans2 (pid 26694) conn 0x88bd290
  1213. [2013/09/13 10:40:06.671953, 3] smbd/process.c:1662(process_smb)
  1214. Transaction 24 of length 184 (0 toread)
  1215. [2013/09/13 10:40:06.672036, 3] smbd/process.c:1467(switch_message)
  1216. switch message SMBwriteX (pid 26694) conn 0x88bd290
  1217. [2013/09/13 10:40:06.672108, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1218. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  1219. [2013/09/13 10:40:06.672164, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1220. check_bind_req for \samr
  1221. [2013/09/13 10:40:06.672218, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1222. check_bind_req: \PIPE\samr -> \PIPE\samr
  1223. [2013/09/13 10:40:06.672295, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1224. writeX-IPC nwritten=116
  1225. [2013/09/13 10:40:06.673013, 3] smbd/process.c:1662(process_smb)
  1226. Transaction 25 of length 63 (0 toread)
  1227. [2013/09/13 10:40:06.673094, 3] smbd/process.c:1467(switch_message)
  1228. switch message SMBreadX (pid 26694) conn 0x88bd290
  1229. [2013/09/13 10:40:06.673157, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1230. free_pipe_context: destroying talloc pool of size 21
  1231. [2013/09/13 10:40:06.673222, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1232. readX-IPC min=1024 max=1024 nread=68
  1233. [2013/09/13 10:40:06.673947, 3] smbd/process.c:1662(process_smb)
  1234. Transaction 26 of length 160 (0 toread)
  1235. [2013/09/13 10:40:06.674012, 3] smbd/process.c:1467(switch_message)
  1236. switch message SMBtrans (pid 26694) conn 0x88bd290
  1237. [2013/09/13 10:40:06.674072, 3] smbd/ipc.c:560(handle_trans)
  1238. trans <\PIPE\> data=72 params=0 setup=2
  1239. [2013/09/13 10:40:06.674129, 3] smbd/ipc.c:511(named_pipe)
  1240. named pipe command on <> name
  1241. [2013/09/13 10:40:06.674181, 3] smbd/ipc.c:475(api_fd_reply)
  1242. Got API command 0x26 on pipe "samr" (pnum 4532)
  1243. [2013/09/13 10:40:06.674247, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1244. api_rpcTNP: rpc command: SAMR_CONNECT5
  1245. [2013/09/13 10:40:06.674362, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1246. free_pipe_context: destroying talloc pool of size 1005
  1247. [2013/09/13 10:40:06.675150, 3] smbd/process.c:1662(process_smb)
  1248. Transaction 27 of length 140 (0 toread)
  1249. [2013/09/13 10:40:06.675216, 3] smbd/process.c:1467(switch_message)
  1250. switch message SMBtrans (pid 26694) conn 0x88bd290
  1251. [2013/09/13 10:40:06.675275, 3] smbd/ipc.c:560(handle_trans)
  1252. trans <\PIPE\> data=52 params=0 setup=2
  1253. [2013/09/13 10:40:06.675331, 3] smbd/ipc.c:511(named_pipe)
  1254. named pipe command on <> name
  1255. [2013/09/13 10:40:06.675382, 3] smbd/ipc.c:475(api_fd_reply)
  1256. Got API command 0x26 on pipe "samr" (pnum 4532)
  1257. [2013/09/13 10:40:06.675447, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1258. api_rpcTNP: rpc command: SAMR_ENUMDOMAINS
  1259. [2013/09/13 10:40:06.675561, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1260. free_pipe_context: destroying talloc pool of size 53
  1261. [2013/09/13 10:40:06.676321, 3] smbd/process.c:1662(process_smb)
  1262. Transaction 28 of length 158 (0 toread)
  1263. [2013/09/13 10:40:06.676387, 3] smbd/process.c:1467(switch_message)
  1264. switch message SMBtrans (pid 26694) conn 0x88bd290
  1265. [2013/09/13 10:40:06.676445, 3] smbd/ipc.c:560(handle_trans)
  1266. trans <\PIPE\> data=70 params=0 setup=2
  1267. [2013/09/13 10:40:06.676501, 3] smbd/ipc.c:511(named_pipe)
  1268. named pipe command on <> name
  1269. [2013/09/13 10:40:06.676552, 3] smbd/ipc.c:475(api_fd_reply)
  1270. Got API command 0x26 on pipe "samr" (pnum 4532)
  1271. [2013/09/13 10:40:06.676615, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1272. api_rpcTNP: rpc command: SAMR_LOOKUPDOMAIN
  1273. [2013/09/13 10:40:06.676698, 2] rpc_server/samr/srv_samr_nt.c:4071(_samr_LookupDomain)
  1274. Returning domain sid for domain DOMAIN -> S-1-5-21-OURSID-3360254768
  1275. [2013/09/13 10:40:06.676784, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1276. free_pipe_context: destroying talloc pool of size 89
  1277. [2013/09/13 10:40:06.677621, 3] smbd/process.c:1662(process_smb)
  1278. Transaction 29 of length 164 (0 toread)
  1279. [2013/09/13 10:40:06.677704, 3] smbd/process.c:1467(switch_message)
  1280. switch message SMBtrans (pid 26694) conn 0x88bd290
  1281. [2013/09/13 10:40:06.677766, 3] smbd/ipc.c:560(handle_trans)
  1282. trans <\PIPE\> data=76 params=0 setup=2
  1283. [2013/09/13 10:40:06.677823, 3] smbd/ipc.c:511(named_pipe)
  1284. named pipe command on <> name
  1285. [2013/09/13 10:40:06.677894, 3] smbd/ipc.c:475(api_fd_reply)
  1286. Got API command 0x26 on pipe "samr" (pnum 4532)
  1287. [2013/09/13 10:40:06.677961, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1288. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  1289. [2013/09/13 10:40:06.678060, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1290. free_pipe_context: destroying talloc pool of size 1005
  1291. [2013/09/13 10:40:06.678947, 3] smbd/process.c:1662(process_smb)
  1292. Transaction 30 of length 172 (0 toread)
  1293. [2013/09/13 10:40:06.679027, 3] smbd/process.c:1467(switch_message)
  1294. switch message SMBtrans (pid 26694) conn 0x88bd290
  1295. [2013/09/13 10:40:06.679090, 3] smbd/ipc.c:560(handle_trans)
  1296. trans <\PIPE\> data=84 params=0 setup=2
  1297. [2013/09/13 10:40:06.679148, 3] smbd/ipc.c:511(named_pipe)
  1298. named pipe command on <> name
  1299. [2013/09/13 10:40:06.67.sn. 3] smbd/ipc.c:475(api_fd_reply)
  1300. Got API command 0x26 on pipe "samr" (pnum 4532)
  1301. [2013/09/13 10:40:06.679266, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1302. api_rpcTNP: rpc command: SAMR_CREATEUSER2
  1303. [2013/09/13 10:40:06.680120, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  1304. init_sam_from_ldap: Entry found for user: crw7c$
  1305. [2013/09/13 10:40:06.681787, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1306. free_pipe_context: destroying talloc pool of size 21
  1307. [2013/09/13 10:40:06.682528, 3] smbd/process.c:1662(process_smb)
  1308. Transaction 31 of length 132 (0 toread)
  1309. [2013/09/13 10:40:06.682595, 3] smbd/process.c:1467(switch_message)
  1310. switch message SMBtrans (pid 26694) conn 0x88bd290
  1311. [2013/09/13 10:40:06.682655, 3] smbd/ipc.c:560(handle_trans)
  1312. trans <\PIPE\> data=44 params=0 setup=2
  1313. [2013/09/13 10:40:06.682712, 3] smbd/ipc.c:511(named_pipe)
  1314. named pipe command on <> name
  1315. [2013/09/13 10:40:06.682764, 3] smbd/ipc.c:475(api_fd_reply)
  1316. Got API command 0x26 on pipe "samr" (pnum 4532)
  1317. [2013/09/13 10:40:06.682828, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1318. api_rpcTNP: rpc command: SAMR_CLOSE
  1319. [2013/09/13 10:40:06.682905, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1320. Closed policy
  1321. [2013/09/13 10:40:06.682981, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1322. free_pipe_context: destroying talloc pool of size 21
  1323. [2013/09/13 10:40:06.683691, 3] smbd/process.c:1662(process_smb)
  1324. Transaction 32 of length 132 (0 toread)
  1325. [2013/09/13 10:40:06.683774, 3] smbd/process.c:1467(switch_message)
  1326. switch message SMBtrans (pid 26694) conn 0x88bd290
  1327. [2013/09/13 10:40:06.683838, 3] smbd/ipc.c:560(handle_trans)
  1328. trans <\PIPE\> data=44 params=0 setup=2
  1329. [2013/09/13 10:40:06.683902, 3] smbd/ipc.c:511(named_pipe)
  1330. named pipe command on <> name
  1331. [2013/09/13 10:40:06.683954, 3] smbd/ipc.c:475(api_fd_reply)
  1332. Got API command 0x26 on pipe "samr" (pnum 4532)
  1333. [2013/09/13 10:40:06.684018, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1334. api_rpcTNP: rpc command: SAMR_CLOSE
  1335. [2013/09/13 10:40:06.684074, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1336. Closed policy
  1337. [2013/09/13 10:40:06.684151, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1338. free_pipe_context: destroying talloc pool of size 21
  1339. [2013/09/13 10:40:06.684919, 3] smbd/process.c:1662(process_smb)
  1340. Transaction 33 of length 45 (0 toread)
  1341. [2013/09/13 10:40:06.685001, 3] smbd/process.c:1467(switch_message)
  1342. switch message SMBclose (pid 26694) conn 0x88bd290
  1343. [2013/09/13 10:40:06.685059, 3] smbd/reply.c:4848(reply_close)
  1344. close fd=-1 fnum=17714 (numopen=1)
  1345. [2013/09/13 10:40:06.686407, 3] smbd/process.c:1662(process_smb)
  1346. Transaction 34 of length 100 (0 toread)
  1347. [2013/09/13 10:40:06.686489, 3] smbd/process.c:1467(switch_message)
  1348. switch message SMBntcreateX (pid 26694) conn 0x88bd290
  1349. [2013/09/13 10:40:06.687254, 3] smbd/process.c:1662(process_smb)
  1350. Transaction 35 of length 76 (0 toread)
  1351. [2013/09/13 10:40:06.687325, 3] smbd/process.c:1467(switch_message)
  1352. switch message SMBtrans2 (pid 26694) conn 0x88bd290
  1353. [2013/09/13 10:40:06.688154, 3] smbd/process.c:1662(process_smb)
  1354. Transaction 36 of length 184 (0 toread)
  1355. [2013/09/13 10:40:06.688218, 3] smbd/process.c:1467(switch_message)
  1356. switch message SMBwriteX (pid 26694) conn 0x88bd290
  1357. [2013/09/13 10:40:06.688303, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1358. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  1359. [2013/09/13 10:40:06.688361, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1360. check_bind_req for \samr
  1361. [2013/09/13 10:40:06.688414, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1362. check_bind_req: \PIPE\samr -> \PIPE\samr
  1363. [2013/09/13 10:40:06.688490, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1364. writeX-IPC nwritten=116
  1365. [2013/09/13 10:40:06.690151, 3] smbd/process.c:1662(process_smb)
  1366. Transaction 37 of length 63 (0 toread)
  1367. [2013/09/13 10:40:06.690215, 3] smbd/process.c:1467(switch_message)
  1368. switch message SMBreadX (pid 26694) conn 0x88bd290
  1369. [2013/09/13 10:40:06.690273, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1370. free_pipe_context: destroying talloc pool of size 21
  1371. [2013/09/13 10:40:06.690337, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1372. readX-IPC min=1024 max=1024 nread=68
  1373. [2013/09/13 10:40:06.691096, 3] smbd/process.c:1662(process_smb)
  1374. Transaction 38 of length 160 (0 toread)
  1375. [2013/09/13 10:40:06.691176, 3] smbd/process.c:1467(switch_message)
  1376. switch message SMBtrans (pid 26694) conn 0x88bd290
  1377. [2013/09/13 10:40:06.691239, 3] smbd/ipc.c:560(handle_trans)
  1378. trans <\PIPE\> data=72 params=0 setup=2
  1379. [2013/09/13 10:40:06.691297, 3] smbd/ipc.c:511(named_pipe)
  1380. named pipe command on <> name
  1381. [2013/09/13 10:40:06.691350, 3] smbd/ipc.c:475(api_fd_reply)
  1382. Got API command 0x26 on pipe "samr" (pnum 4533)
  1383. [2013/09/13 10:40:06.691416, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1384. api_rpcTNP: rpc command: SAMR_CONNECT5
  1385. [2013/09/13 10:40:06.691507, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1386. free_pipe_context: destroying talloc pool of size 1005
  1387. [2013/09/13 10:40:06.692264, 3] smbd/process.c:1662(process_smb)
  1388. Transaction 39 of length 164 (0 toread)
  1389. [2013/09/13 10:40:06.692329, 3] smbd/process.c:1467(switch_message)
  1390. switch message SMBtrans (pid 26694) conn 0x88bd290
  1391. [2013/09/13 10:40:06.692388, 3] smbd/ipc.c:560(handle_trans)
  1392. trans <\PIPE\> data=76 params=0 setup=2
  1393. [2013/09/13 10:40:06.692445, 3] smbd/ipc.c:511(named_pipe)
  1394. named pipe command on <> name
  1395. [2013/09/13 10:40:06.692496, 3] smbd/ipc.c:475(api_fd_reply)
  1396. Got API command 0x26 on pipe "samr" (pnum 4533)
  1397. [2013/09/13 10:40:06.692560, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1398. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  1399. [2013/09/13 10:40:06.692648, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1400. free_pipe_context: destroying talloc pool of size 1005
  1401. [2013/09/13 10:40:06.693367, 3] smbd/process.c:1662(process_smb)
  1402. Transaction 40 of length 180 (0 toread)
  1403. [2013/09/13 10:40:06.693431, 3] smbd/process.c:1467(switch_message)
  1404. switch message SMBtrans (pid 26694) conn 0x88bd290
  1405. [2013/09/13 10:40:06.693490, 3] smbd/ipc.c:560(handle_trans)
  1406. trans <\PIPE\> data=92 params=0 setup=2
  1407. [2013/09/13 10:40:06.693546, 3] smbd/ipc.c:511(named_pipe)
  1408. named pipe command on <> name
  1409. [2013/09/13 10:40:06.693597, 3] smbd/ipc.c:475(api_fd_reply)
  1410. Got API command 0x26 on pipe "samr" (pnum 4533)
  1411. [2013/09/13 10:40:06.693660, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1412. api_rpcTNP: rpc command: SAMR_LOOKUPNAMES
  1413. [2013/09/13 10:40:06.694330, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  1414. init_sam_from_ldap: Entry found for user: crw7c$
  1415. [2013/09/13 10:40:06.695926, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1416. free_pipe_context: destroying talloc pool of size 33
  1417. [2013/09/13 10:40:06.696712, 3] smbd/process.c:1662(process_smb)
  1418. Transaction 41 of length 140 (0 toread)
  1419. [2013/09/13 10:40:06.696799, 3] smbd/process.c:1467(switch_message)
  1420. switch message SMBtrans (pid 26694) conn 0x88bd290
  1421. [2013/09/13 10:40:06.696861, 3] smbd/ipc.c:560(handle_trans)
  1422. trans <\PIPE\> data=52 params=0 setup=2
  1423. [2013/09/13 10:40:06.696919, 3] smbd/ipc.c:511(named_pipe)
  1424. named pipe command on <> name
  1425. [2013/09/13 10:40:06.696971, 3] smbd/ipc.c:475(api_fd_reply)
  1426. Got API command 0x26 on pipe "samr" (pnum 4533)
  1427. [2013/09/13 10:40:06.697036, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1428. api_rpcTNP: rpc command: SAMR_OPENUSER
  1429. [2013/09/13 10:40:06.697292, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1430. free_pipe_context: destroying talloc pool of size 1237
  1431. [2013/09/13 10:40:06.698022, 3] smbd/process.c:1662(process_smb)
  1432. Transaction 42 of length 134 (0 toread)
  1433. [2013/09/13 10:40:06.698087, 3] smbd/process.c:1467(switch_message)
  1434. switch message SMBtrans (pid 26694) conn 0x88bd290
  1435. [2013/09/13 10:40:06.698146, 3] smbd/ipc.c:560(handle_trans)
  1436. trans <\PIPE\> data=46 params=0 setup=2
  1437. [2013/09/13 10:40:06.698202, 3] smbd/ipc.c:511(named_pipe)
  1438. named pipe command on <> name
  1439. [2013/09/13 10:40:06.698253, 3] smbd/ipc.c:475(api_fd_reply)
  1440. Got API command 0x26 on pipe "samr" (pnum 4533)
  1441. [2013/09/13 10:40:06.698317, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1442. api_rpcTNP: rpc command: SAMR_QUERYUSERINFO
  1443. [2013/09/13 10:40:06.698507, 3] rpc_server/samr/srv_samr_nt.c:3011(_samr_QueryUserInfo)
  1444. User:[crw7c$]
  1445. [2013/09/13 10:40:06.698607, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1446. free_pipe_context: destroying talloc pool of size 749
  1447. [2013/09/13 10:40:06.699321, 3] smbd/process.c:1662(process_smb)
  1448. Transaction 43 of length 132 (0 toread)
  1449. [2013/09/13 10:40:06.699386, 3] smbd/process.c:1467(switch_message)
  1450. switch message SMBtrans (pid 26694) conn 0x88bd290
  1451. [2013/09/13 10:40:06.699444, 3] smbd/ipc.c:560(handle_trans)
  1452. trans <\PIPE\> data=44 params=0 setup=2
  1453. [2013/09/13 10:40:06.699499, 3] smbd/ipc.c:511(named_pipe)
  1454. named pipe command on <> name
  1455. [2013/09/13 10:40:06.699551, 3] smbd/ipc.c:475(api_fd_reply)
  1456. Got API command 0x26 on pipe "samr" (pnum 4533)
  1457. [2013/09/13 10:40:06.699614, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1458. api_rpcTNP: rpc command: SAMR_GETUSERPWINFO
  1459. [2013/09/13 10:40:06.700198, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1460. free_pipe_context: destroying talloc pool of size 21
  1461. [2013/09/13 10:40:06.701316, 3] smbd/process.c:1662(process_smb)
  1462. Transaction 44 of length 669 (0 toread)
  1463. [2013/09/13 10:40:06.701410, 3] smbd/process.c:1467(switch_message)
  1464. switch message SMBtrans (pid 26694) conn 0x88bd290
  1465. [2013/09/13 10:40:06.703058, 3] smbd/ipc.c:560(handle_trans)
  1466. trans <\PIPE\> data=581 params=0 setup=2
  1467. [2013/09/13 10:40:06.703152, 3] smbd/ipc.c:511(named_pipe)
  1468. named pipe command on <> name
  1469. [2013/09/13 10:40:06.703208, 3] smbd/ipc.c:475(api_fd_reply)
  1470. Got API command 0x26 on pipe "samr" (pnum 4533)
  1471. [2013/09/13 10:40:06.703276, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1472. api_rpcTNP: rpc command: SAMR_SETUSERINFO2
  1473. [2013/09/13 10:40:06.704674, 2] passdb/pdb_ldap.c:1180(init_ldap_from_sam)
  1474. init_ldap_from_sam: Setting entry for user: crw7c$
  1475. [2013/09/13 10:40:06.705749, 2] passdb/pdb_ldap.c:2042(ldapsam_update_sam_account)
  1476. ldapsam_update_sam_account: successfully modified uid = crw7c$ in the LDAP database
  1477. [2013/09/13 10:40:06.705879, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1478. free_pipe_context: destroying talloc pool of size 21
  1479. [2013/09/13 10:40:06.706729, 3] smbd/process.c:1662(process_smb)
  1480. Transaction 45 of length 132 (0 toread)
  1481. [2013/09/13 10:40:06.706793, 3] smbd/process.c:1467(switch_message)
  1482. switch message SMBtrans (pid 26694) conn 0x88bd290
  1483. [2013/09/13 10:40:06.706854, 3] smbd/ipc.c:560(handle_trans)
  1484. trans <\PIPE\> data=44 params=0 setup=2
  1485. [2013/09/13 10:40:06.706914, 3] smbd/ipc.c:511(named_pipe)
  1486. named pipe command on <> name
  1487. [2013/09/13 10:40:06.706967, 3] smbd/ipc.c:475(api_fd_reply)
  1488. Got API command 0x26 on pipe "samr" (pnum 4533)
  1489. [2013/09/13 10:40:06.707031, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1490. api_rpcTNP: rpc command: SAMR_CLOSE
  1491. [2013/09/13 10:40:06.707088, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1492. Closed policy
  1493. [2013/09/13 10:40:06.707163, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1494. free_pipe_context: destroying talloc pool of size 21
  1495. [2013/09/13 10:40:06.707915, 3] smbd/process.c:1662(process_smb)
  1496. Transaction 46 of length 132 (0 toread)
  1497. [2013/09/13 10:40:06.707977, 3] smbd/process.c:1467(switch_message)
  1498. switch message SMBtrans (pid 26694) conn 0x88bd290
  1499. [2013/09/13 10:40:06.708036, 3] smbd/ipc.c:560(handle_trans)
  1500. trans <\PIPE\> data=44 params=0 setup=2
  1501. [2013/09/13 10:40:06.708109, 3] smbd/ipc.c:511(named_pipe)
  1502. named pipe command on <> name
  1503. [2013/09/13 10:40:06.708161, 3] smbd/ipc.c:475(api_fd_reply)
  1504. Got API command 0x26 on pipe "samr" (pnum 4533)
  1505. [2013/09/13 10:40:06.708224, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1506. api_rpcTNP: rpc command: SAMR_CLOSE
  1507. [2013/09/13 10:40:06.708280, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1508. Closed policy
  1509. [2013/09/13 10:40:06.708353, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1510. free_pipe_context: destroying talloc pool of size 21
  1511. [2013/09/13 10:40:06.709066, 3] smbd/process.c:1662(process_smb)
  1512. Transaction 47 of length 132 (0 toread)
  1513. [2013/09/13 10:40:06.709129, 3] smbd/process.c:1467(switch_message)
  1514. switch message SMBtrans (pid 26694) conn 0x88bd290
  1515. [2013/09/13 10:40:06.709187, 3] smbd/ipc.c:560(handle_trans)
  1516. trans <\PIPE\> data=44 params=0 setup=2
  1517. [2013/09/13 10:40:06.709243, 3] smbd/ipc.c:511(named_pipe)
  1518. named pipe command on <> name
  1519. [2013/09/13 10:40:06.709294, 3] smbd/ipc.c:475(api_fd_reply)
  1520. Got API command 0x26 on pipe "samr" (pnum 4533)
  1521. [2013/09/13 10:40:06.709356, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1522. api_rpcTNP: rpc command: SAMR_CLOSE
  1523. [2013/09/13 10:40:06.709412, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1524. Closed policy
  1525. [2013/09/13 10:40:06.709486, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1526. free_pipe_context: destroying talloc pool of size 21
  1527. [2013/09/13 10:40:06.710228, 3] smbd/process.c:1662(process_smb)
  1528. Transaction 48 of length 45 (0 toread)
  1529. [2013/09/13 10:40:06.710289, 3] smbd/process.c:1467(switch_message)
  1530. switch message SMBclose (pid 26694) conn 0x88bd290
  1531. [2013/09/13 10:40:06.710344, 3] smbd/reply.c:4848(reply_close)
  1532. close fd=-1 fnum=17715 (numopen=1)
  1533. [2013/09/13 10:40:06.727422, 3] smbd/process.c:1662(process_smb)
  1534. Transaction 49 of length 108 (0 toread)
  1535. [2013/09/13 10:40:06.727493, 3] smbd/process.c:1467(switch_message)
  1536. switch message SMBntcreateX (pid 26694) conn 0x88bd290
  1537. [2013/09/13 10:40:06.728431, 3] smbd/process.c:1662(process_smb)
  1538. Transaction 50 of length 76 (0 toread)
  1539. [2013/09/13 10:40:06.728464, 3] smbd/process.c:1467(switch_message)
  1540. switch message SMBtrans2 (pid 26694) conn 0x88bd290
  1541. [2013/09/13 10:40:06.729369, 3] smbd/process.c:1662(process_smb)
  1542. Transaction 51 of length 184 (0 toread)
  1543. [2013/09/13 10:40:06.729401, 3] smbd/process.c:1467(switch_message)
  1544. switch message SMBwriteX (pid 26694) conn 0x88bd290
  1545. [2013/09/13 10:40:06.729437, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1546. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  1547. [2013/09/13 10:40:06.729464, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1548. check_bind_req for \netlogon
  1549. [2013/09/13 10:40:06.729490, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1550. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  1551. [2013/09/13 10:40:06.729529, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1552. writeX-IPC nwritten=116
  1553. [2013/09/13 10:40:06.730261, 3] smbd/process.c:1662(process_smb)
  1554. Transaction 52 of length 63 (0 toread)
  1555. [2013/09/13 10:40:06.730291, 3] smbd/process.c:1467(switch_message)
  1556. switch message SMBreadX (pid 26694) conn 0x88bd290
  1557. [2013/09/13 10:40:06.730320, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1558. free_pipe_context: destroying talloc pool of size 25
  1559. [2013/09/13 10:40:06.730351, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1560. readX-IPC min=1024 max=1024 nread=72
  1561. [2013/09/13 10:40:06.731094, 3] smbd/process.c:1662(process_smb)
  1562. Transaction 53 of length 148 (0 toread)
  1563. [2013/09/13 10:40:06.731124, 3] smbd/process.c:1467(switch_message)
  1564. switch message SMBtrans (pid 26694) conn 0x88bd290
  1565. [2013/09/13 10:40:06.731153, 3] smbd/ipc.c:560(handle_trans)
  1566. trans <\PIPE\> data=60 params=0 setup=2
  1567. [2013/09/13 10:40:06.731180, 3] smbd/ipc.c:511(named_pipe)
  1568. named pipe command on <> name
  1569. [2013/09/13 10:40:06.731205, 3] smbd/ipc.c:475(api_fd_reply)
  1570. Got API command 0x26 on pipe "NETLOGON" (pnum 4534)
  1571. [2013/09/13 10:40:06.731237, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1572. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  1573. [2013/09/13 10:40:06.731297, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1574. free_pipe_context: destroying talloc pool of size 29
  1575. [2013/09/13 10:40:06.732076, 3] smbd/process.c:1662(process_smb)
  1576. Transaction 54 of length 45 (0 toread)
  1577. [2013/09/13 10:40:06.732107, 3] smbd/process.c:1467(switch_message)
  1578. switch message SMBclose (pid 26694) conn 0x88bd290
  1579. [2013/09/13 10:40:06.732133, 3] smbd/reply.c:4848(reply_close)
  1580. close fd=-1 fnum=17716 (numopen=1)
  1581. [2013/09/13 10:40:06.733480, 3] smbd/process.c:1662(process_smb)
  1582. Transaction 55 of length 108 (0 toread)
  1583. [2013/09/13 10:40:06.733530, 3] smbd/process.c:1467(switch_message)
  1584. switch message SMBntcreateX (pid 26694) conn 0x88bd290
  1585. [2013/09/13 10:40:06.734312, 3] smbd/process.c:1662(process_smb)
  1586. Transaction 56 of length 76 (0 toread)
  1587. [2013/09/13 10:40:06.734359, 3] smbd/process.c:1467(switch_message)
  1588. switch message SMBtrans2 (pid 26694) conn 0x88bd290
  1589. [2013/09/13 10:40:06.735156, 3] smbd/process.c:1662(process_smb)
  1590. Transaction 57 of length 184 (0 toread)
  1591. [2013/09/13 10:40:06.735188, 3] smbd/process.c:1467(switch_message)
  1592. switch message SMBwriteX (pid 26694) conn 0x88bd290
  1593. [2013/09/13 10:40:06.735221, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1594. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  1595. [2013/09/13 10:40:06.735248, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1596. check_bind_req for \netlogon
  1597. [2013/09/13 10:40:06.735275, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1598. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  1599. [2013/09/13 10:40:06.735312, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1600. writeX-IPC nwritten=116
  1601. [2013/09/13 10:40:06.735991, 3] smbd/process.c:1662(process_smb)
  1602. Transaction 58 of length 63 (0 toread)
  1603. [2013/09/13 10:40:06.736022, 3] smbd/process.c:1467(switch_message)
  1604. switch message SMBreadX (pid 26694) conn 0x88bd290
  1605. [2013/09/13 10:40:06.736050, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1606. free_pipe_context: destroying talloc pool of size 25
  1607. [2013/09/13 10:40:06.736081, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1608. readX-IPC min=1024 max=1024 nread=72
  1609. [2013/09/13 10:40:06.736756, 3] smbd/process.c:1662(process_smb)
  1610. Transaction 59 of length 148 (0 toread)
  1611. [2013/09/13 10:40:06.736786, 3] smbd/process.c:1467(switch_message)
  1612. switch message SMBtrans (pid 26694) conn 0x88bd290
  1613. [2013/09/13 10:40:06.736820, 3] smbd/ipc.c:560(handle_trans)
  1614. trans <\PIPE\> data=60 params=0 setup=2
  1615. [2013/09/13 10:40:06.736848, 3] smbd/ipc.c:511(named_pipe)
  1616. named pipe command on <> name
  1617. [2013/09/13 10:40:06.736875, 3] smbd/ipc.c:475(api_fd_reply)
  1618. Got API command 0x26 on pipe "NETLOGON" (pnum 4535)
  1619. [2013/09/13 10:40:06.736906, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1620. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  1621. [2013/09/13 10:40:06.736943, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1622. free_pipe_context: destroying talloc pool of size 29
  1623. [2013/09/13 10:40:06.737648, 3] smbd/process.c:1662(process_smb)
  1624. Transaction 60 of length 45 (0 toread)
  1625. [2013/09/13 10:40:06.737678, 3] smbd/process.c:1467(switch_message)
  1626. switch message SMBclose (pid 26694) conn 0x88bd290
  1627. [2013/09/13 10:40:06.737703, 3] smbd/reply.c:4848(reply_close)
  1628. close fd=-1 fnum=17717 (numopen=1)
  1629. [2013/09/13 10:40:06.738899, 3] smbd/process.c:1662(process_smb)
  1630. Transaction 61 of length 108 (0 toread)
  1631. [2013/09/13 10:40:06.738935, 3] smbd/process.c:1467(switch_message)
  1632. switch message SMBntcreateX (pid 26694) conn 0x88bd290
  1633. [2013/09/13 10:40:06.739652, 3] smbd/process.c:1662(process_smb)
  1634. Transaction 62 of length 76 (0 toread)
  1635. [2013/09/13 10:40:06.739683, 3] smbd/process.c:1467(switch_message)
  1636. switch message SMBtrans2 (pid 26694) conn 0x88bd290
  1637. [2013/09/13 10:40:06.740500, 3] smbd/process.c:1662(process_smb)
  1638. Transaction 63 of length 184 (0 toread)
  1639. [2013/09/13 10:40:06.740540, 3] smbd/process.c:1467(switch_message)
  1640. switch message SMBwriteX (pid 26694) conn 0x88bd290
  1641. [2013/09/13 10:40:06.740574, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1642. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  1643. [2013/09/13 10:40:06.740601, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1644. check_bind_req for \netlogon
  1645. [2013/09/13 10:40:06.740638, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1646. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  1647. [2013/09/13 10:40:06.740675, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1648. writeX-IPC nwritten=116
  1649. [2013/09/13 10:40:06.741381, 3] smbd/process.c:1662(process_smb)
  1650. Transaction 64 of length 63 (0 toread)
  1651. [2013/09/13 10:40:06.741411, 3] smbd/process.c:1467(switch_message)
  1652. switch message SMBreadX (pid 26694) conn 0x88bd290
  1653. [2013/09/13 10:40:06.741438, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1654. free_pipe_context: destroying talloc pool of size 25
  1655. [2013/09/13 10:40:06.741468, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1656. readX-IPC min=1024 max=1024 nread=72
  1657. [2013/09/13 10:40:06.742144, 3] smbd/process.c:1662(process_smb)
  1658. Transaction 65 of length 144 (0 toread)
  1659. [2013/09/13 10:40:06.742174, 3] smbd/process.c:1467(switch_message)
  1660. switch message SMBtrans (pid 26694) conn 0x88bd290
  1661. [2013/09/13 10:40:06.742201, 3] smbd/ipc.c:560(handle_trans)
  1662. trans <\PIPE\> data=56 params=0 setup=2
  1663. [2013/09/13 10:40:06.742227, 3] smbd/ipc.c:511(named_pipe)
  1664. named pipe command on <> name
  1665. [2013/09/13 10:40:06.742251, 3] smbd/ipc.c:475(api_fd_reply)
  1666. Got API command 0x26 on pipe "NETLOGON" (pnum 4536)
  1667. [2013/09/13 10:40:06.742281, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1668. api_rpcTNP: rpc command: NETR_NETRENUMERATETRUSTEDDOMAINS
  1669. [2013/09/13 10:40:06.742701, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1670. Closed policy
  1671. [2013/09/13 10:40:06.742756, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1672. free_pipe_context: destroying talloc pool of size 1498
  1673. [2013/09/13 10:40:06.743464, 3] smbd/process.c:1662(process_smb)
  1674. Transaction 66 of length 45 (0 toread)
  1675. [2013/09/13 10:40:06.743496, 3] smbd/process.c:1467(switch_message)
  1676. switch message SMBclose (pid 26694) conn 0x88bd290
  1677. [2013/09/13 10:40:06.743523, 3] smbd/reply.c:4848(reply_close)
  1678. close fd=-1 fnum=17718 (numopen=1)
  1679. [2013/09/13 10:40:22.510122, 3] smbd/process.c:1662(process_smb)
  1680. Transaction 67 of length 39 (0 toread)
  1681. [2013/09/13 10:40:22.510235, 3] smbd/process.c:1467(switch_message)
  1682. switch message SMBtdis (pid 26694) conn 0x88bd290
  1683. [2013/09/13 10:40:22.510272, 3] smbd/service.c:1378(close_cnum)
  1684. crw7c (192.168.sn.89) closed connection to service IPC$
  1685. [2013/09/13 10:40:22.510303, 3] smbd/connection.c:35(yield_connection)
  1686. Yielding connection to IPC$
  1687. [2013/09/13 10:40:22.510976, 3] smbd/process.c:1662(process_smb)
  1688. Transaction 68 of length 43 (0 toread)
  1689. [2013/09/13 10:40:22.511046, 3] smbd/process.c:1467(switch_message)
  1690. switch message SMBulogoffX (pid 26694) conn 0x0
  1691. [2013/09/13 10:40:22.511106, 3] smbd/reply.c:2096(reply_ulogoffX)
  1692. ulogoffX vuid=100
  1693. [2013/09/13 10:40:22.511780, 1] smbd/process.c:457(receive_smb_talloc)
  1694. receive_smb_raw_talloc failed for client 192.168.sn.89 read error = NT_STATUS_CONNECTION_RESET.
  1695. [2013/09/13 10:40:22.511894, 3] smbd/server_exit.c:181(exit_server_common)
  1696. Server exit (failed to receive smb request)
  1697. [2013/09/13 10:46:01.584071, 3] param/loadparm.c:9572(lp_load_ex)
  1698. lp_load_ex: refreshing parameters
  1699. [2013/09/13 10:46:01.584172, 3] param/loadparm.c:5192(init_globals)
  1700. Initialising global parameters
  1701. [2013/09/13 10:46:01.584336, 3] ../lib/util/params.c:550(pm_process)
  1702. params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
  1703. [2013/09/13 10:46:01.584403, 3] param/loadparm.c:8310(do_section)
  1704. Processing section "[global]"
  1705. [2013/09/13 10:46:01.584505, 3] ../lib/util/params.c:550(pm_process)
  1706. params.c:pm_process() - Processing configuration file "/etc/samba/alias.conf"
  1707. [2013/09/13 10:46:01.584577, 1] param/loadparm.c:7992(lp_do_parameter)
  1708. WARNING: The "enable privileges" option is deprecated
  1709. [2013/09/13 10:46:01.585065, 1] ../lib/util/params.c:350(Parameter)
  1710. params.c:Parameter() - Ignoring badly formed line in configuration file: all combinations of upper and lower case.
  1711. [2013/09/13 10:46:01.585591, 3] ../lib/util/params.c:550(pm_process)
  1712. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/venus.conf"
  1713. [2013/09/13 10:46:01.585731, 3] ../lib/util/params.c:550(pm_process)
  1714. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  1715. [2013/09/13 10:46:01.585790, 3] param/loadparm.c:8310(do_section)
  1716. Processing section "[global]"
  1717. [2013/09/13 10:46:01.585892, 2] param/loadparm.c:8327(do_section)
  1718. Processing section "[homes]"
  1719. [2013/09/13 10:46:01.586037, 2] param/loadparm.c:8327(do_section)
  1720. Processing section "[home]"
  1721. [2013/09/13 10:46:01.586181, 2] param/loadparm.c:8327(do_section)
  1722. Processing section "[Profiles]"
  1723. [2013/09/13 10:46:01.586399, 2] param/loadparm.c:8327(do_section)
  1724. Processing section "[Profile]"
  1725. [2013/09/13 10:46:01.586550, 2] param/loadparm.c:8327(do_section)
  1726. Processing section "[Profiles.V2]"
  1727. [2013/09/13 10:46:01.586732, 2] param/loadparm.c:8327(do_section)
  1728. Processing section "[Profile.v2]"
  1729. [2013/09/13 10:46:01.586914, 2] param/loadparm.c:8327(do_section)
  1730. Processing section "[mgmt]"
  1731. [2013/09/13 10:46:01.587079, 2] param/loadparm.c:8327(do_section)
  1732. Processing section "[accData]"
  1733. [2013/09/13 10:46:01.587255, 2] param/loadparm.c:8327(do_section)
  1734. Processing section "[printers]"
  1735. [2013/09/13 10:46:01.587415, 2] param/loadparm.c:8327(do_section)
  1736. Processing section "[print$]"
  1737. [2013/09/13 10:46:01.587585, 2] param/loadparm.c:8327(do_section)
  1738. Processing section "[installkit]"
  1739. [2013/09/13 10:46:01.587729, 2] param/loadparm.c:8327(do_section)
  1740. Processing section "[public]"
  1741. [2013/09/13 10:46:01.587885, 2] param/loadparm.c:8327(do_section)
  1742. Processing section "[accounts]"
  1743. [2013/09/13 10:46:01.588062, 2] param/loadparm.c:8327(do_section)
  1744. Processing section "[PaDFru_Midlands]"
  1745. [2013/09/13 10:46:01.588183, 1] param/loadparm.c:7992(lp_do_parameter)
  1746. WARNING: The "printer admin" option is deprecated
  1747. [2013/09/13 10:46:01.588483, 2] param/loadparm.c:8327(do_section)
  1748. Processing section "[PaDFru]"
  1749. [2013/09/13 10:46:01.588538, 1] param/loadparm.c:7992(lp_do_parameter)
  1750. WARNING: The "printer admin" option is deprecated
  1751. [2013/09/13 10:46:01.588680, 2] param/loadparm.c:8327(do_section)
  1752. Processing section "[PaDFru_Headed]"
  1753. [2013/09/13 10:46:01.588732, 1] param/loadparm.c:7992(lp_do_parameter)
  1754. WARNING: The "printer admin" option is deprecated
  1755. [2013/09/13 10:46:01.588899, 3] ../lib/util/params.c:550(pm_process)
  1756. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/gmdata.conf"
  1757. [2013/09/13 10:46:01.588925, 2] param/loadparm.c:8327(do_section)
  1758. Processing section "[gm]"
  1759. [2013/09/13 10:46:01.589018, 2] param/loadparm.c:8327(do_section)
  1760. Processing section "[tt]"
  1761. [2013/09/13 10:46:01.589128, 3] ../lib/util/params.c:550(pm_process)
  1762. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  1763. [2013/09/13 10:46:01.589154, 3] param/loadparm.c:8310(do_section)
  1764. Processing section "[global]"
  1765. [2013/09/13 10:46:01.589199, 2] param/loadparm.c:8327(do_section)
  1766. Processing section "[homes]"
  1767. [2013/09/13 10:46:01.589242, 2] param/loadparm.c:8327(do_section)
  1768. Processing section "[home]"
  1769. [2013/09/13 10:46:01.589292, 2] param/loadparm.c:8327(do_section)
  1770. Processing section "[Profiles]"
  1771. [2013/09/13 10:46:01.589375, 2] param/loadparm.c:8327(do_section)
  1772. Processing section "[Profile]"
  1773. [2013/09/13 10:46:01.589426, 2] param/loadparm.c:8327(do_section)
  1774. Processing section "[Profiles.V2]"
  1775. [2013/09/13 10:46:01.589485, 2] param/loadparm.c:8327(do_section)
  1776. Processing section "[Profile.v2]"
  1777. [2013/09/13 10:46:01.589545, 2] param/loadparm.c:8327(do_section)
  1778. Processing section "[mgmt]"
  1779. [2013/09/13 10:46:01.589597, 2] param/loadparm.c:8327(do_section)
  1780. Processing section "[accData]"
  1781. [2013/09/13 10:46:01.589654, 2] param/loadparm.c:8327(do_section)
  1782. Processing section "[printers]"
  1783. [2013/09/13 10:46:01.589702, 2] param/loadparm.c:8327(do_section)
  1784. Processing section "[print$]"
  1785. [2013/09/13 10:46:01.589756, 2] param/loadparm.c:8327(do_section)
  1786. Processing section "[installkit]"
  1787. [2013/09/13 10:46:01.589800, 2] param/loadparm.c:8327(do_section)
  1788. Processing section "[public]"
  1789. [2013/09/13 10:46:01.589854, 2] param/loadparm.c:8327(do_section)
  1790. Processing section "[accounts]"
  1791. [2013/09/13 10:46:01.589912, 2] param/loadparm.c:8327(do_section)
  1792. Processing section "[PaDFru_Midlands]"
  1793. [2013/09/13 10:46:01.589945, 1] param/loadparm.c:7992(lp_do_parameter)
  1794. WARNING: The "printer admin" option is deprecated
  1795. [2013/09/13 10:46:01.590086, 2] param/loadparm.c:8327(do_section)
  1796. Processing section "[PaDFru]"
  1797. [2013/09/13 10:46:01.590119, 1] param/loadparm.c:7992(lp_do_parameter)
  1798. WARNING: The "printer admin" option is deprecated
  1799. [2013/09/13 10:46:01.590264, 2] param/loadparm.c:8327(do_section)
  1800. Processing section "[PaDFru_Headed]"
  1801. [2013/09/13 10:46:01.590300, 1] param/loadparm.c:7992(lp_do_parameter)
  1802. WARNING: The "printer admin" option is deprecated
  1803. [2013/09/13 10:46:01.590459, 2] param/loadparm.c:8327(do_section)
  1804. Processing section "[netlogon]"
  1805. [2013/09/13 10:46:01.590528, 1] param/loadparm.c:7992(lp_do_parameter)
  1806. WARNING: The "share modes" option is deprecated
  1807. [2013/09/13 10:46:01.590568, 2] param/loadparm.c:8327(do_section)
  1808. Processing section "[netlogoff]"
  1809. [2013/09/13 10:46:01.590642, 1] param/loadparm.c:7992(lp_do_parameter)
  1810. WARNING: The "share modes" option is deprecated
  1811. [2013/09/13 10:46:01.590682, 2] param/loadparm.c:8327(do_section)
  1812. Processing section "[printers]"
  1813. [2013/09/13 10:46:01.590730, 2] param/loadparm.c:8327(do_section)
  1814. Processing section "[print$]"
  1815. [2013/09/13 10:46:01.590809, 3] param/loadparm.c:6630(lp_add_ipc)
  1816. adding IPC service
  1817. [2013/09/13 10:46:01.590892, 2] lib/interface.c:479(interpret_interface)
  1818. interpret_interface: Adding interface 192.168.sn.21/24
  1819. [2013/09/13 10:46:01.590922, 2] lib/interface.c:341(add_interface)
  1820. added interface 192.168.sn.21/ ip=192.168.sn.21 bcast=192.168.sn.255 netmask=255.255.255.0
  1821. [2013/09/13 10:46:01.590977, 3] auth/auth.c:219(check_ntlm_password)
  1822. check_ntlm_password: Checking password for unmapped user [domain]\[geek]@[CRW7C] with the new password interface
  1823. [2013/09/13 10:46:01.591004, 3] auth/auth.c:222(check_ntlm_password)
  1824. check_ntlm_password: mapped user is: [domain]\[geek]@[CRW7C]
  1825. [2013/09/13 10:46:01.591127, 2] lib/smbldap.c:1018(smbldap_open_connection)
  1826. smbldap_open_connection: connection opened
  1827. [2013/09/13 10:46:01.591800, 3] lib/smbldap.c:1948(smbldap_check_root_dse)
  1828. smbldap_check_root_dse: Expected one rootDSE, got 0
  1829. [2013/09/13 10:46:01.591837, 3] lib/smbldap.c:1240(smbldap_connect_system)
  1830. ldap_connect_system: successful connection to the LDAP server
  1831. [2013/09/13 10:46:01.592113, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  1832. init_sam_from_ldap: Entry found for user: geek
  1833. [2013/09/13 10:46:01.593905, 3] auth/auth.c:268(check_ntlm_password)
  1834. check_ntlm_password: sam authentication for user [geek] succeeded
  1835. [2013/09/13 10:46:01.593955, 2] auth/auth.c:309(check_ntlm_password)
  1836. check_ntlm_password: authentication for user [geek] -> [geek] -> [geek] succeeded
  1837. [2013/09/13 10:46:01.595869, 3] groupdb/mapping.c:772(pdb_create_builtin_alias)
  1838. pdb_create_builtin_alias: Could not get a gid out of winbind
  1839. [2013/09/13 10:46:01.595913, 2] auth/token_util.c:479(finalize_local_nt_token)
  1840. WARNING: Failed to create BUILTIN\Users group! Can Winbind allocate gids?
  1841. [2013/09/13 10:46:01.597086, 3] ../libcli/auth/ntlmssp_sign.c:535(ntlmssp_sign_init)
  1842. NTLMSSP Sign/Seal - Initialising with flags:
  1843. [2013/09/13 10:46:01.597122, 3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags)
  1844. Got NTLMSSP neg_flags=0xe2088215
  1845. [2013/09/13 10:46:01.597165, 3] smbd/password.c:298(register_existing_vuid)
  1846. register_existing_vuid: User name: geek Real name: Current Geek
  1847. [2013/09/13 10:46:01.597193, 3] smbd/password.c:308(register_existing_vuid)
  1848. register_existing_vuid: UNIX uid 1012 is UNIX user geek, and will be vuid 100
  1849. [2013/09/13 10:46:01.597269, 3] smbd/password.c:238(register_homes_share)
  1850. Adding homes service for user 'geek' using home directory: '/home/geek'
  1851. [2013/09/13 10:46:01.597334, 3] param/loadparm.c:6582(lp_add_home)
  1852. adding home's share [geek] for user 'geek' at '/home/%u'
  1853. [2013/09/13 10:46:01.598848, 3] smbd/process.c:1662(process_smb)
  1854. Transaction 3 of length 80 (0 toread)
  1855. [2013/09/13 10:46:01.598951, 3] smbd/process.c:1467(switch_message)
  1856. switch message SMBtconX (pid 28394) conn 0x0
  1857. [2013/09/13 10:46:01.599036, 3] lib/access.c:338(allow_access)
  1858. Allowed connection from 192.168.sn.89 (192.168.sn.89)
  1859. [2013/09/13 10:46:01.599083, 3] smbd/service.c:872(make_connection_snum)
  1860. Connect path is '/tmp' for service [IPC$]
  1861. [2013/09/13 10:46:01.599130, 3] smbd/vfs.c:102(vfs_init_default)
  1862. Initialising default vfs hooks
  1863. [2013/09/13 10:46:01.599168, 3] smbd/vfs.c:128(vfs_init_custom)
  1864. Initialising custom vfs hooks from [/[Default VFS]/]
  1865. [2013/09/13 10:46:01.599277, 3] smbd/service.c:1114(make_connection_snum)
  1866. crw7c (192.168.sn.89) connect to service IPC$ initially as user geek (uid=1012, gid=512) (pid 28394)
  1867. [2013/09/13 10:46:01.599321, 3] smbd/reply.c:871(reply_tcon_and_X)
  1868. tconX service=IPC$
  1869. [2013/09/13 10:46:01.613615, 3] smbd/process.c:1662(process_smb)
  1870. Transaction 4 of length 104 (0 toread)
  1871. [2013/09/13 10:46:01.613699, 3] smbd/process.c:1467(switch_message)
  1872. switch message SMBntcreateX (pid 28394) conn 0x88ceed8
  1873. [2013/09/13 10:46:01.614795, 3] smbd/process.c:1662(process_smb)
  1874. Transaction 5 of length 76 (0 toread)
  1875. [2013/09/13 10:46:01.614866, 3] smbd/process.c:1467(switch_message)
  1876. switch message SMBtrans2 (pid 28394) conn 0x88ceed8
  1877. [2013/09/13 10:46:01.615945, 3] smbd/process.c:1662(process_smb)
  1878. Transaction 6 of length 184 (0 toread)
  1879. [2013/09/13 10:46:01.616011, 3] smbd/process.c:1467(switch_message)
  1880. switch message SMBwriteX (pid 28394) conn 0x88ceed8
  1881. [2013/09/13 10:46:01.616115, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1882. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  1883. [2013/09/13 10:46:01.616178, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1884. check_bind_req for \lsarpc
  1885. [2013/09/13 10:46:01.616234, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1886. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  1887. [2013/09/13 10:46:01.616332, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1888. writeX-IPC nwritten=116
  1889. [2013/09/13 10:46:01.617325, 3] smbd/process.c:1662(process_smb)
  1890. Transaction 7 of length 63 (0 toread)
  1891. [2013/09/13 10:46:01.617389, 3] smbd/process.c:1467(switch_message)
  1892. switch message SMBreadX (pid 28394) conn 0x88ceed8
  1893. [2013/09/13 10:46:01.617452, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1894. free_pipe_context: destroying talloc pool of size 23
  1895. [2013/09/13 10:46:01.617523, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1896. readX-IPC min=1024 max=1024 nread=68
  1897. [2013/09/13 10:46:01.618479, 3] smbd/process.c:1662(process_smb)
  1898. Transaction 8 of length 168 (0 toread)
  1899. [2013/09/13 10:46:01.618543, 3] smbd/process.c:1467(switch_message)
  1900. switch message SMBtrans (pid 28394) conn 0x88ceed8
  1901. [2013/09/13 10:46:01.618609, 3] smbd/ipc.c:560(handle_trans)
  1902. trans <\PIPE\> data=80 params=0 setup=2
  1903. [2013/09/13 10:46:01.618669, 3] smbd/ipc.c:511(named_pipe)
  1904. named pipe command on <> name
  1905. [2013/09/13 10:46:01.618726, 3] smbd/ipc.c:475(api_fd_reply)
  1906. Got API command 0x26 on pipe "lsarpc" (pnum 4033)
  1907. [2013/09/13 10:46:01.618797, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1908. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  1909. [2013/09/13 10:46:01.618928, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1910. free_pipe_context: destroying talloc pool of size 1075
  1911. [2013/09/13 10:46:01.619848, 3] smbd/process.c:1662(process_smb)
  1912. Transaction 9 of length 134 (0 toread)
  1913. [2013/09/13 10:46:01.619928, 3] smbd/process.c:1467(switch_message)
  1914. switch message SMBtrans (pid 28394) conn 0x88ceed8
  1915. [2013/09/13 10:46:01.619991, 3] smbd/ipc.c:560(handle_trans)
  1916. trans <\PIPE\> data=46 params=0 setup=2
  1917. [2013/09/13 10:46:01..sn.9, 3] smbd/ipc.c:511(named_pipe)
  1918. named pipe command on <> name
  1919. [2013/09/13 10:46:01.620102, 3] smbd/ipc.c:475(api_fd_reply)
  1920. Got API command 0x26 on pipe "lsarpc" (pnum 4033)
  1921. [2013/09/13 10:46:01.620167, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1922. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  1923. [2013/09/13 10:46:01.620257, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1924. free_pipe_context: destroying talloc pool of size 27
  1925. [2013/09/13 10:46:01.621637, 3] smbd/process.c:1662(process_smb)
  1926. Transaction 10 of length 134 (0 toread)
  1927. [2013/09/13 10:46:01.621705, 3] smbd/process.c:1467(switch_message)
  1928. switch message SMBtrans (pid 28394) conn 0x88ceed8
  1929. [2013/09/13 10:46:01.621765, 3] smbd/ipc.c:560(handle_trans)
  1930. trans <\PIPE\> data=46 params=0 setup=2
  1931. [2013/09/13 10:46:01.621821, 3] smbd/ipc.c:511(named_pipe)
  1932. named pipe command on <> name
  1933. [2013/09/13 10:46:01.621873, 3] smbd/ipc.c:475(api_fd_reply)
  1934. Got API command 0x26 on pipe "lsarpc" (pnum 4033)
  1935. [2013/09/13 10:46:01.621937, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1936. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  1937. [2013/09/13 10:46:01.622044, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1938. free_pipe_context: destroying talloc pool of size 135
  1939. [2013/09/13 10:46:01.623013, 3] smbd/process.c:1662(process_smb)
  1940. Transaction 11 of length 132 (0 toread)
  1941. [2013/09/13 10:46:01.623078, 3] smbd/process.c:1467(switch_message)
  1942. switch message SMBtrans (pid 28394) conn 0x88ceed8
  1943. [2013/09/13 10:46:01.623137, 3] smbd/ipc.c:560(handle_trans)
  1944. trans <\PIPE\> data=44 params=0 setup=2
  1945. [2013/09/13 10:46:01.623192, 3] smbd/ipc.c:511(named_pipe)
  1946. named pipe command on <> name
  1947. [2013/09/13 10:46:01.623244, 3] smbd/ipc.c:475(api_fd_reply)
  1948. Got API command 0x26 on pipe "lsarpc" (pnum 4033)
  1949. [2013/09/13 10:46:01.623307, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  1950. api_rpcTNP: rpc command: LSA_CLOSE
  1951. [2013/09/13 10:46:01.623371, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  1952. Closed policy
  1953. [2013/09/13 10:46:01.623453, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1954. free_pipe_context: destroying talloc pool of size 23
  1955. [2013/09/13 10:46:01.624598, 3] smbd/process.c:1662(process_smb)
  1956. Transaction 12 of length 45 (0 toread)
  1957. [2013/09/13 10:46:01.624663, 3] smbd/process.c:1467(switch_message)
  1958. switch message SMBclose (pid 28394) conn 0x88ceed8
  1959. [2013/09/13 10:46:01.624721, 3] smbd/reply.c:4848(reply_close)
  1960. close fd=-1 fnum=16435 (numopen=1)
  1961. [2013/09/13 10:46:01.979004, 3] smbd/process.c:1662(process_smb)
  1962. Transaction 13 of length 104 (0 toread)
  1963. [2013/09/13 10:46:01.979090, 3] smbd/process.c:1467(switch_message)
  1964. switch message SMBntcreateX (pid 28394) conn 0x88ceed8
  1965. [2013/09/13 10:46:01.979930, 3] smbd/process.c:1662(process_smb)
  1966. Transaction 14 of length 76 (0 toread)
  1967. [2013/09/13 10:46:01.980013, 3] smbd/process.c:1467(switch_message)
  1968. switch message SMBtrans2 (pid 28394) conn 0x88ceed8
  1969. [2013/09/13 10:46:01.980852, 3] smbd/process.c:1662(process_smb)
  1970. Transaction 15 of length 184 (0 toread)
  1971. [2013/09/13 10:46:01.980932, 3] smbd/process.c:1467(switch_message)
  1972. switch message SMBwriteX (pid 28394) conn 0x88ceed8
  1973. [2013/09/13 10:46:01.981003, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  1974. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  1975. [2013/09/13 10:46:01.981060, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  1976. check_bind_req for \lsarpc
  1977. [2013/09/13 10:46:01.981113, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  1978. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  1979. [2013/09/13 10:46:01.981190, 3] smbd/pipes.c:361(pipe_write_andx_done)
  1980. writeX-IPC nwritten=116
  1981. [2013/09/13 10:46:01.981900, 3] smbd/process.c:1662(process_smb)
  1982. Transaction 16 of length 63 (0 toread)
  1983. [2013/09/13 10:46:01.981966, 3] smbd/process.c:1467(switch_message)
  1984. switch message SMBreadX (pid 28394) conn 0x88ceed8
  1985. [2013/09/13 10:46:01.982026, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  1986. free_pipe_context: destroying talloc pool of size 23
  1987. [2013/09/13 10:46:01.982089, 3] smbd/pipes.c:485(pipe_read_andx_done)
  1988. readX-IPC min=1024 max=1024 nread=68
  1989. [2013/09/13 10:46:01.983023, 3] smbd/process.c:1662(process_smb)
  1990. Transaction 17 of length 168 (0 toread)
  1991. [2013/09/13 10:46:01.983086, 3] smbd/process.c:1467(switch_message)
  1992. switch message SMBtrans (pid 28394) conn 0x88ceed8
  1993. [2013/09/13 10:46:01.983145, 3] smbd/ipc.c:560(handle_trans)
  1994. trans <\PIPE\> data=80 params=0 setup=2
  1995. [2013/09/13 10:46:01.983202, 3] smbd/ipc.c:511(named_pipe)
  1996. named pipe command on <> name
  1997. [2013/09/13 10:46:01.983270, 3] smbd/ipc.c:475(api_fd_reply)
  1998. Got API command 0x26 on pipe "lsarpc" (pnum 4034)
  1999. [2013/09/13 10:46:01.983349, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2000. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  2001. [2013/09/13 10:46:01.983445, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2002. free_pipe_context: destroying talloc pool of size 1075
  2003. [2013/09/13 10:46:01.984198, 3] smbd/process.c:1662(process_smb)
  2004. Transaction 18 of length 134 (0 toread)
  2005. [2013/09/13 10:46:01.984263, 3] smbd/process.c:1467(switch_message)
  2006. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2007. [2013/09/13 10:46:01.984333, 3] smbd/ipc.c:560(handle_trans)
  2008. trans <\PIPE\> data=46 params=0 setup=2
  2009. [2013/09/13 10:46:01.984390, 3] smbd/ipc.c:511(named_pipe)
  2010. named pipe command on <> name
  2011. [2013/09/13 10:46:01.984441, 3] smbd/ipc.c:475(api_fd_reply)
  2012. Got API command 0x26 on pipe "lsarpc" (pnum 4034)
  2013. [2013/09/13 10:46:01.984505, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2014. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  2015. [2013/09/13 10:46:01.984584, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2016. free_pipe_context: destroying talloc pool of size 27
  2017. [2013/09/13 10:46:01.985837, 3] smbd/process.c:1662(process_smb)
  2018. Transaction 19 of length 134 (0 toread)
  2019. [2013/09/13 10:46:01.985918, 3] smbd/process.c:1467(switch_message)
  2020. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2021. [2013/09/13 10:46:01.985981, 3] smbd/ipc.c:560(handle_trans)
  2022. trans <\PIPE\> data=46 params=0 setup=2
  2023. [2013/09/13 10:46:01.986039, 3] smbd/ipc.c:511(named_pipe)
  2024. named pipe command on <> name
  2025. [2013/09/13 10:46:01.986091, 3] smbd/ipc.c:475(api_fd_reply)
  2026. Got API command 0x26 on pipe "lsarpc" (pnum 4034)
  2027. [2013/09/13 10:46:01.986156, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2028. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  2029. [2013/09/13 10:46:01.986242, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2030. free_pipe_context: destroying talloc pool of size 135
  2031. [2013/09/13 10:46:01.987023, 3] smbd/process.c:1662(process_smb)
  2032. Transaction 20 of length 132 (0 toread)
  2033. [2013/09/13 10:46:01.987089, 3] smbd/process.c:1467(switch_message)
  2034. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2035. [2013/09/13 10:46:01.987148, 3] smbd/ipc.c:560(handle_trans)
  2036. trans <\PIPE\> data=44 params=0 setup=2
  2037. [2013/09/13 10:46:01.987204, 3] smbd/ipc.c:511(named_pipe)
  2038. named pipe command on <> name
  2039. [2013/09/13 10:46:01.987255, 3] smbd/ipc.c:475(api_fd_reply)
  2040. Got API command 0x26 on pipe "lsarpc" (pnum 4034)
  2041. [2013/09/13 10:46:01.987320, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2042. api_rpcTNP: rpc command: LSA_CLOSE
  2043. [2013/09/13 10:46:01.987377, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2044. Closed policy
  2045. [2013/09/13 10:46:01.987453, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2046. free_pipe_context: destroying talloc pool of size 23
  2047. [2013/09/13 10:46:01.988216, 3] smbd/process.c:1662(process_smb)
  2048. Transaction 21 of length 45 (0 toread)
  2049. [2013/09/13 10:46:01.988281, 3] smbd/process.c:1467(switch_message)
  2050. switch message SMBclose (pid 28394) conn 0x88ceed8
  2051. [2013/09/13 10:46:01.988345, 3] smbd/reply.c:4848(reply_close)
  2052. close fd=-1 fnum=16436 (numopen=1)
  2053. [2013/09/13 10:46:01.992153, 3] smbd/process.c:1662(process_smb)
  2054. Transaction 22 of length 100 (0 toread)
  2055. [2013/09/13 10:46:01.992217, 3] smbd/process.c:1467(switch_message)
  2056. switch message SMBntcreateX (pid 28394) conn 0x88ceed8
  2057. [2013/09/13 10:46:01.993103, 3] smbd/process.c:1662(process_smb)
  2058. Transaction 23 of length 76 (0 toread)
  2059. [2013/09/13 10:46:01.993186, 3] smbd/process.c:1467(switch_message)
  2060. switch message SMBtrans2 (pid 28394) conn 0x88ceed8
  2061. [2013/09/13 10:46:01.994091, 3] smbd/process.c:1662(process_smb)
  2062. Transaction 24 of length 184 (0 toread)
  2063. [2013/09/13 10:46:01.994173, 3] smbd/process.c:1467(switch_message)
  2064. switch message SMBwriteX (pid 28394) conn 0x88ceed8
  2065. [2013/09/13 10:46:01.994243, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  2066. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  2067. [2013/09/13 10:46:01.994307, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  2068. check_bind_req for \samr
  2069. [2013/09/13 10:46:01.994376, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  2070. check_bind_req: \PIPE\samr -> \PIPE\samr
  2071. [2013/09/13 10:46:01.994455, 3] smbd/pipes.c:361(pipe_write_andx_done)
  2072. writeX-IPC nwritten=116
  2073. [2013/09/13 10:46:01.995235, 3] smbd/process.c:1662(process_smb)
  2074. Transaction 25 of length 63 (0 toread)
  2075. [2013/09/13 10:46:01.995323, 3] smbd/process.c:1467(switch_message)
  2076. switch message SMBreadX (pid 28394) conn 0x88ceed8
  2077. [2013/09/13 10:46:01.995388, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2078. free_pipe_context: destroying talloc pool of size 21
  2079. [2013/09/13 10:46:01.995454, 3] smbd/pipes.c:485(pipe_read_andx_done)
  2080. readX-IPC min=1024 max=1024 nread=68
  2081. [2013/09/13 10:46:01.996222, 3] smbd/process.c:1662(process_smb)
  2082. Transaction 26 of length 160 (0 toread)
  2083. [2013/09/13 10:46:01.996304, 3] smbd/process.c:1467(switch_message)
  2084. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2085. [2013/09/13 10:46:01.996372, 3] smbd/ipc.c:560(handle_trans)
  2086. trans <\PIPE\> data=72 params=0 setup=2
  2087. [2013/09/13 10:46:01.996430, 3] smbd/ipc.c:511(named_pipe)
  2088. named pipe command on <> name
  2089. [2013/09/13 10:46:01.996482, 3] smbd/ipc.c:475(api_fd_reply)
  2090. Got API command 0x26 on pipe "samr" (pnum 4035)
  2091. [2013/09/13 10:46:01.996548, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2092. api_rpcTNP: rpc command: SAMR_CONNECT5
  2093. [2013/09/13 10:46:01.996662, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2094. free_pipe_context: destroying talloc pool of size 1005
  2095. [2013/09/13 10:46:01.997476, 3] smbd/process.c:1662(process_smb)
  2096. Transaction 27 of length 140 (0 toread)
  2097. [2013/09/13 10:46:01.997558, 3] smbd/process.c:1467(switch_message)
  2098. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2099. [2013/09/13 10:46:01.997620, 3] smbd/ipc.c:560(handle_trans)
  2100. trans <\PIPE\> data=52 params=0 setup=2
  2101. [2013/09/13 10:46:01.997678, 3] smbd/ipc.c:511(named_pipe)
  2102. named pipe command on <> name
  2103. [2013/09/13 10:46:01.997730, 3] smbd/ipc.c:475(api_fd_reply)
  2104. Got API command 0x26 on pipe "samr" (pnum 4035)
  2105. [2013/09/13 10:46:01.997795, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2106. api_rpcTNP: rpc command: SAMR_ENUMDOMAINS
  2107. [2013/09/13 10:46:01.997907, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2108. free_pipe_context: destroying talloc pool of size 53
  2109. [2013/09/13 10:46:01.998714, 3] smbd/process.c:1662(process_smb)
  2110. Transaction 28 of length 158 (0 toread)
  2111. [2013/09/13 10:46:01.998780, 3] smbd/process.c:1467(switch_message)
  2112. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2113. [2013/09/13 10:46:01.998839, 3] smbd/ipc.c:560(handle_trans)
  2114. trans <\PIPE\> data=70 params=0 setup=2
  2115. [2013/09/13 10:46:01.998894, 3] smbd/ipc.c:511(named_pipe)
  2116. named pipe command on <> name
  2117. [2013/09/13 10:46:01.998945, 3] smbd/ipc.c:475(api_fd_reply)
  2118. Got API command 0x26 on pipe "samr" (pnum 4035)
  2119. [2013/09/13 10:46:01.999008, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2120. api_rpcTNP: rpc command: SAMR_LOOKUPDOMAIN
  2121. [2013/09/13 10:46:01.999086, 2] rpc_server/samr/srv_samr_nt.c:4071(_samr_LookupDomain)
  2122. Returning domain sid for domain DOMAIN -> S-1-5-21-OURSID-3360254768
  2123. [2013/09/13 10:46:01.999172, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2124. free_pipe_context: destroying talloc pool of size 89
  2125. [2013/09/13 10:46:01.999882, 3] smbd/process.c:1662(process_smb)
  2126. Transaction 29 of length 164 (0 toread)
  2127. [2013/09/13 10:46:01.999947, 3] smbd/process.c:1467(switch_message)
  2128. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2129. [2013/09/13 10:46:02.000006, 3] smbd/ipc.c:560(handle_trans)
  2130. trans <\PIPE\> data=76 params=0 setup=2
  2131. [2013/09/13 10:46:02.000062, 3] smbd/ipc.c:511(named_pipe)
  2132. named pipe command on <> name
  2133. [2013/09/13 10:46:02.000113, 3] smbd/ipc.c:475(api_fd_reply)
  2134. Got API command 0x26 on pipe "samr" (pnum 4035)
  2135. [2013/09/13 10:46:02.000176, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2136. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  2137. [2013/09/13 10:46:02.000271, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2138. free_pipe_context: destroying talloc pool of size 1005
  2139. [2013/09/13 10:46:02.000998, 3] smbd/process.c:1662(process_smb)
  2140. Transaction 30 of length 172 (0 toread)
  2141. [2013/09/13 10:46:02.001075, 3] smbd/process.c:1467(switch_message)
  2142. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2143. [2013/09/13 10:46:02.001136, 3] smbd/ipc.c:560(handle_trans)
  2144. trans <\PIPE\> data=84 params=0 setup=2
  2145. [2013/09/13 10:46:02.001193, 3] smbd/ipc.c:511(named_pipe)
  2146. named pipe command on <> name
  2147. [2013/09/13 10:46:02.001244, 3] smbd/ipc.c:475(api_fd_reply)
  2148. Got API command 0x26 on pipe "samr" (pnum 4035)
  2149. [2013/09/13 10:46:02.001319, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2150. api_rpcTNP: rpc command: SAMR_CREATEUSER2
  2151. [2013/09/13 10:46:02.002169, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  2152. init_sam_from_ldap: Entry found for user: crw7c$
  2153. [2013/09/13 10:46:02.003927, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2154. free_pipe_context: destroying talloc pool of size 21
  2155. [2013/09/13 10:46:02.004850, 3] smbd/process.c:1662(process_smb)
  2156. Transaction 31 of length 132 (0 toread)
  2157. [2013/09/13 10:46:02.004918, 3] smbd/process.c:1467(switch_message)
  2158. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2159. [2013/09/13 10:46:02.004978, 3] smbd/ipc.c:560(handle_trans)
  2160. trans <\PIPE\> data=44 params=0 setup=2
  2161. [2013/09/13 10:46:02.005034, 3] smbd/ipc.c:511(named_pipe)
  2162. named pipe command on <> name
  2163. [2013/09/13 10:46:02.005086, 3] smbd/ipc.c:475(api_fd_reply)
  2164. Got API command 0x26 on pipe "samr" (pnum 4035)
  2165. [2013/09/13 10:46:02.005150, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2166. api_rpcTNP: rpc command: SAMR_CLOSE
  2167. [2013/09/13 10:46:02.005218, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2168. Closed policy
  2169. [2013/09/13 10:46:02.005303, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2170. free_pipe_context: destroying talloc pool of size 21
  2171. [2013/09/13 10:46:02.006028, 3] smbd/process.c:1662(process_smb)
  2172. Transaction 32 of length 132 (0 toread)
  2173. [2013/09/13 10:46:02.006092, 3] smbd/process.c:1467(switch_message)
  2174. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2175. [2013/09/13 10:46:02.006150, 3] smbd/ipc.c:560(handle_trans)
  2176. trans <\PIPE\> data=44 params=0 setup=2
  2177. [2013/09/13 10:46:02.006206, 3] smbd/ipc.c:511(named_pipe)
  2178. named pipe command on <> name
  2179. [2013/09/13 10:46:02.006262, 3] smbd/ipc.c:475(api_fd_reply)
  2180. Got API command 0x26 on pipe "samr" (pnum 4035)
  2181. [2013/09/13 10:46:02.006326, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2182. api_rpcTNP: rpc command: SAMR_CLOSE
  2183. [2013/09/13 10:46:02.006381, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2184. Closed policy
  2185. [2013/09/13 10:46:02.006454, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2186. free_pipe_context: destroying talloc pool of size 21
  2187. [2013/09/13 10:46:02.007256, 3] smbd/process.c:1662(process_smb)
  2188. Transaction 33 of length 45 (0 toread)
  2189. [2013/09/13 10:46:02.007321, 3] smbd/process.c:1467(switch_message)
  2190. switch message SMBclose (pid 28394) conn 0x88ceed8
  2191. [2013/09/13 10:46:02.007376, 3] smbd/reply.c:4848(reply_close)
  2192. close fd=-1 fnum=16437 (numopen=1)
  2193. [2013/09/13 10:46:02.008754, 3] smbd/process.c:1662(process_smb)
  2194. Transaction 34 of length 100 (0 toread)
  2195. [2013/09/13 10:46:02.008820, 3] smbd/process.c:1467(switch_message)
  2196. switch message SMBntcreateX (pid 28394) conn 0x88ceed8
  2197. [2013/09/13 10:46:02.009568, 3] smbd/process.c:1662(process_smb)
  2198. Transaction 35 of length 76 (0 toread)
  2199. [2013/09/13 10:46:02.009648, 3] smbd/process.c:1467(switch_message)
  2200. switch message SMBtrans2 (pid 28394) conn 0x88ceed8
  2201. [2013/09/13 10:46:02.010483, 3] smbd/process.c:1662(process_smb)
  2202. Transaction 36 of length 184 (0 toread)
  2203. [2013/09/13 10:46:02.010550, 3] smbd/process.c:1467(switch_message)
  2204. switch message SMBwriteX (pid 28394) conn 0x88ceed8
  2205. [2013/09/13 10:46:02.010618, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  2206. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  2207. [2013/09/13 10:46:02.010675, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  2208. check_bind_req for \samr
  2209. [2013/09/13 10:46:02.010728, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  2210. check_bind_req: \PIPE\samr -> \PIPE\samr
  2211. [2013/09/13 10:46:02.010805, 3] smbd/pipes.c:361(pipe_write_andx_done)
  2212. writeX-IPC nwritten=116
  2213. [2013/09/13 10:46:02.011520, 3] smbd/process.c:1662(process_smb)
  2214. Transaction 37 of length 63 (0 toread)
  2215. [2013/09/13 10:46:02.011600, 3] smbd/process.c:1467(switch_message)
  2216. switch message SMBreadX (pid 28394) conn 0x88ceed8
  2217. [2013/09/13 10:46:02.011659, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2218. free_pipe_context: destroying talloc pool of size 21
  2219. [2013/09/13 10:46:02.011723, 3] smbd/pipes.c:485(pipe_read_andx_done)
  2220. readX-IPC min=1024 max=1024 nread=68
  2221. [2013/09/13 10:46:02.012447, 3] smbd/process.c:1662(process_smb)
  2222. Transaction 38 of length 160 (0 toread)
  2223. [2013/09/13 10:46:02.012511, 3] smbd/process.c:1467(switch_message)
  2224. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2225. [2013/09/13 10:46:02.012569, 3] smbd/ipc.c:560(handle_trans)
  2226. trans <\PIPE\> data=72 params=0 setup=2
  2227. [2013/09/13 10:46:02.012626, 3] smbd/ipc.c:511(named_pipe)
  2228. named pipe command on <> name
  2229. [2013/09/13 10:46:02.012676, 3] smbd/ipc.c:475(api_fd_reply)
  2230. Got API command 0x26 on pipe "samr" (pnum 4036)
  2231. [2013/09/13 10:46:02.012741, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2232. api_rpcTNP: rpc command: SAMR_CONNECT5
  2233. [2013/09/13 10:46:02.012831, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2234. free_pipe_context: destroying talloc pool of size 1005
  2235. [2013/09/13 10:46:02.013612, 3] smbd/process.c:1662(process_smb)
  2236. Transaction 39 of length 164 (0 toread)
  2237. [2013/09/13 10:46:02.013692, 3] smbd/process.c:1467(switch_message)
  2238. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2239. [2013/09/13 10:46:02.013755, 3] smbd/ipc.c:560(handle_trans)
  2240. trans <\PIPE\> data=76 params=0 setup=2
  2241. [2013/09/13 10:46:02.013812, 3] smbd/ipc.c:511(named_pipe)
  2242. named pipe command on <> name
  2243. [2013/09/13 10:46:02.013864, 3] smbd/ipc.c:475(api_fd_reply)
  2244. Got API command 0x26 on pipe "samr" (pnum 4036)
  2245. [2013/09/13 10:46:02.013929, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2246. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  2247. [2013/09/13 10:46:02.014020, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2248. free_pipe_context: destroying talloc pool of size 1005
  2249. [2013/09/13 10:46:02.014743, 3] smbd/process.c:1662(process_smb)
  2250. Transaction 40 of length 180 (0 toread)
  2251. [2013/09/13 10:46:02.014809, 3] smbd/process.c:1467(switch_message)
  2252. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2253. [2013/09/13 10:46:02.014868, 3] smbd/ipc.c:560(handle_trans)
  2254. trans <\PIPE\> data=92 params=0 setup=2
  2255. [2013/09/13 10:46:02.014923, 3] smbd/ipc.c:511(named_pipe)
  2256. named pipe command on <> name
  2257. [2013/09/13 10:46:02.014974, 3] smbd/ipc.c:475(api_fd_reply)
  2258. Got API command 0x26 on pipe "samr" (pnum 4036)
  2259. [2013/09/13 10:46:02.015038, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2260. api_rpcTNP: rpc command: SAMR_LOOKUPNAMES
  2261. [2013/09/13 10:46:02.015695, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  2262. init_sam_from_ldap: Entry found for user: crw7c$
  2263. [2013/09/13 10:46:02.017428, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2264. free_pipe_context: destroying talloc pool of size 33
  2265. [2013/09/13 10:46:02.018143, 3] smbd/process.c:1662(process_smb)
  2266. Transaction 41 of length 140 (0 toread)
  2267. [2013/09/13 10:46:02.018213, 3] smbd/process.c:1467(switch_message)
  2268. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2269. [2013/09/13 10:46:02.018281, 3] smbd/ipc.c:560(handle_trans)
  2270. trans <\PIPE\> data=52 params=0 setup=2
  2271. [2013/09/13 10:46:02.018338, 3] smbd/ipc.c:511(named_pipe)
  2272. named pipe command on <> name
  2273. [2013/09/13 10:46:02.018389, 3] smbd/ipc.c:475(api_fd_reply)
  2274. Got API command 0x26 on pipe "samr" (pnum 4036)
  2275. [2013/09/13 10:46:02.018453, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2276. api_rpcTNP: rpc command: SAMR_OPENUSER
  2277. [2013/09/13 10:46:02.018676, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2278. free_pipe_context: destroying talloc pool of size 1237
  2279. [2013/09/13 10:46:02.019418, 3] smbd/process.c:1662(process_smb)
  2280. Transaction 42 of length 134 (0 toread)
  2281. [2013/09/13 10:46:02.019484, 3] smbd/process.c:1467(switch_message)
  2282. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2283. [2013/09/13 10:46:02.019543, 3] smbd/ipc.c:560(handle_trans)
  2284. trans <\PIPE\> data=46 params=0 setup=2
  2285. [2013/09/13 10:46:02.019598, 3] smbd/ipc.c:511(named_pipe)
  2286. named pipe command on <> name
  2287. [2013/09/13 10:46:02.019664, 3] smbd/ipc.c:475(api_fd_reply)
  2288. Got API command 0x26 on pipe "samr" (pnum 4036)
  2289. [2013/09/13 10:46:02.019729, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2290. api_rpcTNP: rpc command: SAMR_QUERYUSERINFO
  2291. [2013/09/13 10:46:02.019918, 3] rpc_server/samr/srv_samr_nt.c:3011(_samr_QueryUserInfo)
  2292. User:[crw7c$]
  2293. [2013/09/13 10:46:02..sn.5, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2294. free_pipe_context: destroying talloc pool of size 749
  2295. [2013/09/13 10:46:02.020748, 3] smbd/process.c:1662(process_smb)
  2296. Transaction 43 of length 132 (0 toread)
  2297. [2013/09/13 10:46:02.020813, 3] smbd/process.c:1467(switch_message)
  2298. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2299. [2013/09/13 10:46:02.020872, 3] smbd/ipc.c:560(handle_trans)
  2300. trans <\PIPE\> data=44 params=0 setup=2
  2301. [2013/09/13 10:46:02.020928, 3] smbd/ipc.c:511(named_pipe)
  2302. named pipe command on <> name
  2303. [2013/09/13 10:46:02.020979, 3] smbd/ipc.c:475(api_fd_reply)
  2304. Got API command 0x26 on pipe "samr" (pnum 4036)
  2305. [2013/09/13 10:46:02.021042, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2306. api_rpcTNP: rpc command: SAMR_GETUSERPWINFO
  2307. [2013/09/13 10:46:02.021600, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2308. free_pipe_context: destroying talloc pool of size 21
  2309. [2013/09/13 10:46:02.022692, 3] smbd/process.c:1662(process_smb)
  2310. Transaction 44 of length 669 (0 toread)
  2311. [2013/09/13 10:46:02.022764, 3] smbd/process.c:1467(switch_message)
  2312. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2313. [2013/09/13 10:46:02.022825, 3] smbd/ipc.c:560(handle_trans)
  2314. trans <\PIPE\> data=581 params=0 setup=2
  2315. [2013/09/13 10:46:02.022881, 3] smbd/ipc.c:511(named_pipe)
  2316. named pipe command on <> name
  2317. [2013/09/13 10:46:02.022932, 3] smbd/ipc.c:475(api_fd_reply)
  2318. Got API command 0x26 on pipe "samr" (pnum 4036)
  2319. [2013/09/13 10:46:02.022997, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2320. api_rpcTNP: rpc command: SAMR_SETUSERINFO2
  2321. [2013/09/13 10:46:02.023938, 2] passdb/pdb_ldap.c:1180(init_ldap_from_sam)
  2322. init_ldap_from_sam: Setting entry for user: crw7c$
  2323. [2013/09/13 10:46:02.024951, 2] passdb/pdb_ldap.c:2042(ldapsam_update_sam_account)
  2324. ldapsam_update_sam_account: successfully modified uid = crw7c$ in the LDAP database
  2325. [2013/09/13 10:46:02.025071, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2326. free_pipe_context: destroying talloc pool of size 21
  2327. [2013/09/13 10:46:02.025821, 3] smbd/process.c:1662(process_smb)
  2328. Transaction 45 of length 132 (0 toread)
  2329. [2013/09/13 10:46:02.025892, 3] smbd/process.c:1467(switch_message)
  2330. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2331. [2013/09/13 10:46:02.025953, 3] smbd/ipc.c:560(handle_trans)
  2332. trans <\PIPE\> data=44 params=0 setup=2
  2333. [2013/09/13 10:46:02.026009, 3] smbd/ipc.c:511(named_pipe)
  2334. named pipe command on <> name
  2335. [2013/09/13 10:46:02.026061, 3] smbd/ipc.c:475(api_fd_reply)
  2336. Got API command 0x26 on pipe "samr" (pnum 4036)
  2337. [2013/09/13 10:46:02.026124, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2338. api_rpcTNP: rpc command: SAMR_CLOSE
  2339. [2013/09/13 10:46:02.026180, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2340. Closed policy
  2341. [2013/09/13 10:46:02.026255, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2342. free_pipe_context: destroying talloc pool of size 21
  2343. [2013/09/13 10:46:02.026973, 3] smbd/process.c:1662(process_smb)
  2344. Transaction 46 of length 132 (0 toread)
  2345. [2013/09/13 10:46:02.027038, 3] smbd/process.c:1467(switch_message)
  2346. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2347. [2013/09/13 10:46:02.027097, 3] smbd/ipc.c:560(handle_trans)
  2348. trans <\PIPE\> data=44 params=0 setup=2
  2349. [2013/09/13 10:46:02.027154, 3] smbd/ipc.c:511(named_pipe)
  2350. named pipe command on <> name
  2351. [2013/09/13 10:46:02.027205, 3] smbd/ipc.c:475(api_fd_reply)
  2352. Got API command 0x26 on pipe "samr" (pnum 4036)
  2353. [2013/09/13 10:46:02.027268, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2354. api_rpcTNP: rpc command: SAMR_CLOSE
  2355. [2013/09/13 10:46:02.027334, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2356. Closed policy
  2357. [2013/09/13 10:46:02.027408, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2358. free_pipe_context: destroying talloc pool of size 21
  2359. [2013/09/13 10:46:02.028125, 3] smbd/process.c:1662(process_smb)
  2360. Transaction 47 of length 132 (0 toread)
  2361. [2013/09/13 10:46:02.028191, 3] smbd/process.c:1467(switch_message)
  2362. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2363. [2013/09/13 10:46:02.028249, 3] smbd/ipc.c:560(handle_trans)
  2364. trans <\PIPE\> data=44 params=0 setup=2
  2365. [2013/09/13 10:46:02.028320, 3] smbd/ipc.c:511(named_pipe)
  2366. named pipe command on <> name
  2367. [2013/09/13 10:46:02.028372, 3] smbd/ipc.c:475(api_fd_reply)
  2368. Got API command 0x26 on pipe "samr" (pnum 4036)
  2369. [2013/09/13 10:46:02.028435, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2370. api_rpcTNP: rpc command: SAMR_CLOSE
  2371. [2013/09/13 10:46:02.028491, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2372. Closed policy
  2373. [2013/09/13 10:46:02.028565, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2374. free_pipe_context: destroying talloc pool of size 21
  2375. [2013/09/13 10:46:02.029466, 3] smbd/process.c:1662(process_smb)
  2376. Transaction 48 of length 45 (0 toread)
  2377. [2013/09/13 10:46:02.029531, 3] smbd/process.c:1467(switch_message)
  2378. switch message SMBclose (pid 28394) conn 0x88ceed8
  2379. [2013/09/13 10:46:02.029587, 3] smbd/reply.c:4848(reply_close)
  2380. close fd=-1 fnum=16438 (numopen=1)
  2381. [2013/09/13 10:46:02.046695, 3] smbd/process.c:1662(process_smb)
  2382. Transaction 49 of length 108 (0 toread)
  2383. [2013/09/13 10:46:02.046778, 3] smbd/process.c:1467(switch_message)
  2384. switch message SMBntcreateX (pid 28394) conn 0x88ceed8
  2385. [2013/09/13 10:46:02.047715, 3] smbd/process.c:1662(process_smb)
  2386. Transaction 50 of length 76 (0 toread)
  2387. [2013/09/13 10:46:02.047795, 3] smbd/process.c:1467(switch_message)
  2388. switch message SMBtrans2 (pid 28394) conn 0x88ceed8
  2389. [2013/09/13 10:46:02.048727, 3] smbd/process.c:1662(process_smb)
  2390. Transaction 51 of length 184 (0 toread)
  2391. [2013/09/13 10:46:02.048795, 3] smbd/process.c:1467(switch_message)
  2392. switch message SMBwriteX (pid 28394) conn 0x88ceed8
  2393. [2013/09/13 10:46:02.048864, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  2394. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  2395. [2013/09/13 10:46:02.048921, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  2396. check_bind_req for \netlogon
  2397. [2013/09/13 10:46:02.048975, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  2398. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  2399. [2013/09/13 10:46:02.049053, 3] smbd/pipes.c:361(pipe_write_andx_done)
  2400. writeX-IPC nwritten=116
  2401. [2013/09/13 10:46:02.049853, 3] smbd/process.c:1662(process_smb)
  2402. Transaction 52 of length 63 (0 toread)
  2403. [2013/09/13 10:46:02.049918, 3] smbd/process.c:1467(switch_message)
  2404. switch message SMBreadX (pid 28394) conn 0x88ceed8
  2405. [2013/09/13 10:46:02.049976, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2406. free_pipe_context: destroying talloc pool of size 25
  2407. [2013/09/13 10:46:02.050040, 3] smbd/pipes.c:485(pipe_read_andx_done)
  2408. readX-IPC min=1024 max=1024 nread=72
  2409. [2013/09/13 10:46:02.050932, 3] smbd/process.c:1662(process_smb)
  2410. Transaction 53 of length 148 (0 toread)
  2411. [2013/09/13 10:46:02.051015, 3] smbd/process.c:1467(switch_message)
  2412. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2413. [2013/09/13 10:46:02.051079, 3] smbd/ipc.c:560(handle_trans)
  2414. trans <\PIPE\> data=60 params=0 setup=2
  2415. [2013/09/13 10:46:02.051136, 3] smbd/ipc.c:511(named_pipe)
  2416. named pipe command on <> name
  2417. [2013/09/13 10:46:02.051188, 3] smbd/ipc.c:475(api_fd_reply)
  2418. Got API command 0x26 on pipe "NETLOGON" (pnum 4037)
  2419. [2013/09/13 10:46:02.051254, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2420. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  2421. [2013/09/13 10:46:02.051356, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2422. free_pipe_context: destroying talloc pool of size 29
  2423. [2013/09/13 10:46:02.052318, 3] smbd/process.c:1662(process_smb)
  2424. Transaction 54 of length 45 (0 toread)
  2425. [2013/09/13 10:46:02.052399, 3] smbd/process.c:1467(switch_message)
  2426. switch message SMBclose (pid 28394) conn 0x88ceed8
  2427. [2013/09/13 10:46:02.052458, 3] smbd/reply.c:4848(reply_close)
  2428. close fd=-1 fnum=16439 (numopen=1)
  2429. [2013/09/13 10:46:02.053893, 3] smbd/process.c:1662(process_smb)
  2430. Transaction 55 of length 108 (0 toread)
  2431. [2013/09/13 10:46:02.053992, 3] smbd/process.c:1467(switch_message)
  2432. switch message SMBntcreateX (pid 28394) conn 0x88ceed8
  2433. [2013/09/13 10:46:02.054798, 3] smbd/process.c:1662(process_smb)
  2434. Transaction 56 of length 76 (0 toread)
  2435. [2013/09/13 10:46:02.054878, 3] smbd/process.c:1467(switch_message)
  2436. switch message SMBtrans2 (pid 28394) conn 0x88ceed8
  2437. [2013/09/13 10:46:02.055713, 3] smbd/process.c:1662(process_smb)
  2438. Transaction 57 of length 184 (0 toread)
  2439. [2013/09/13 10:46:02.055780, 3] smbd/process.c:1467(switch_message)
  2440. switch message SMBwriteX (pid 28394) conn 0x88ceed8
  2441. [2013/09/13 10:46:02.055848, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  2442. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  2443. [2013/09/13 10:46:02.055905, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  2444. check_bind_req for \netlogon
  2445. [2013/09/13 10:46:02.055959, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  2446. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  2447. [2013/09/13 10:46:02.056036, 3] smbd/pipes.c:361(pipe_write_andx_done)
  2448. writeX-IPC nwritten=116
  2449. [2013/09/13 10:46:02.056752, 3] smbd/process.c:1662(process_smb)
  2450. Transaction 58 of length 63 (0 toread)
  2451. [2013/09/13 10:46:02.056817, 3] smbd/process.c:1467(switch_message)
  2452. switch message SMBreadX (pid 28394) conn 0x88ceed8
  2453. [2013/09/13 10:46:02.056876, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2454. free_pipe_context: destroying talloc pool of size 25
  2455. [2013/09/13 10:46:02.056939, 3] smbd/pipes.c:485(pipe_read_andx_done)
  2456. readX-IPC min=1024 max=1024 nread=72
  2457. [2013/09/13 10:46:02.057646, 3] smbd/process.c:1662(process_smb)
  2458. Transaction 59 of length 148 (0 toread)
  2459. [2013/09/13 10:46:02.057711, 3] smbd/process.c:1467(switch_message)
  2460. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2461. [2013/09/13 10:46:02.057769, 3] smbd/ipc.c:560(handle_trans)
  2462. trans <\PIPE\> data=60 params=0 setup=2
  2463. [2013/09/13 10:46:02.057825, 3] smbd/ipc.c:511(named_pipe)
  2464. named pipe command on <> name
  2465. [2013/09/13 10:46:02.057876, 3] smbd/ipc.c:475(api_fd_reply)
  2466. Got API command 0x26 on pipe "NETLOGON" (pnum 4038)
  2467. [2013/09/13 10:46:02.057941, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2468. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  2469. [2013/09/13 10:46:02.058019, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2470. free_pipe_context: destroying talloc pool of size 29
  2471. [2013/09/13 10:46:02.058760, 3] smbd/process.c:1662(process_smb)
  2472. Transaction 60 of length 45 (0 toread)
  2473. [2013/09/13 10:46:02.058841, 3] smbd/process.c:1467(switch_message)
  2474. switch message SMBclose (pid 28394) conn 0x88ceed8
  2475. [2013/09/13 10:46:02.058899, 3] smbd/reply.c:4848(reply_close)
  2476. close fd=-1 fnum=16440 (numopen=1)
  2477. [2013/09/13 10:46:02.060233, 3] smbd/process.c:1662(process_smb)
  2478. Transaction 61 of length 108 (0 toread)
  2479. [2013/09/13 10:46:02.060310, 3] smbd/process.c:1467(switch_message)
  2480. switch message SMBntcreateX (pid 28394) conn 0x88ceed8
  2481. [2013/09/13 10:46:02.061131, 3] smbd/process.c:1662(process_smb)
  2482. Transaction 62 of length 76 (0 toread)
  2483. [2013/09/13 10:46:02.061198, 3] smbd/process.c:1467(switch_message)
  2484. switch message SMBtrans2 (pid 28394) conn 0x88ceed8
  2485. [2013/09/13 10:46:02.062033, 3] smbd/process.c:1662(process_smb)
  2486. Transaction 63 of length 184 (0 toread)
  2487. [2013/09/13 10:46:02.062110, 3] smbd/process.c:1467(switch_message)
  2488. switch message SMBwriteX (pid 28394) conn 0x88ceed8
  2489. [2013/09/13 10:46:02.062181, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  2490. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  2491. [2013/09/13 10:46:02.062237, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  2492. check_bind_req for \netlogon
  2493. [2013/09/13 10:46:02.062291, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  2494. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  2495. [2013/09/13 10:46:02.062376, 3] smbd/pipes.c:361(pipe_write_andx_done)
  2496. writeX-IPC nwritten=116
  2497. [2013/09/13 10:46:02.063162, 3] smbd/process.c:1662(process_smb)
  2498. Transaction 64 of length 63 (0 toread)
  2499. [2013/09/13 10:46:02.063255, 3] smbd/process.c:1467(switch_message)
  2500. switch message SMBreadX (pid 28394) conn 0x88ceed8
  2501. [2013/09/13 10:46:02.063333, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2502. free_pipe_context: destroying talloc pool of size 25
  2503. [2013/09/13 10:46:02.063401, 3] smbd/pipes.c:485(pipe_read_andx_done)
  2504. readX-IPC min=1024 max=1024 nread=72
  2505. [2013/09/13 10:46:02.064172, 3] smbd/process.c:1662(process_smb)
  2506. Transaction 65 of length 144 (0 toread)
  2507. [2013/09/13 10:46:02.064269, 3] smbd/process.c:1467(switch_message)
  2508. switch message SMBtrans (pid 28394) conn 0x88ceed8
  2509. [2013/09/13 10:46:02.064334, 3] smbd/ipc.c:560(handle_trans)
  2510. trans <\PIPE\> data=56 params=0 setup=2
  2511. [2013/09/13 10:46:02.064391, 3] smbd/ipc.c:511(named_pipe)
  2512. named pipe command on <> name
  2513. [2013/09/13 10:46:02.064443, 3] smbd/ipc.c:475(api_fd_reply)
  2514. Got API command 0x26 on pipe "NETLOGON" (pnum 4039)
  2515. [2013/09/13 10:46:02.064508, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2516. api_rpcTNP: rpc command: NETR_NETRENUMERATETRUSTEDDOMAINS
  2517. [2013/09/13 10:46:02.065004, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2518. Closed policy
  2519. [2013/09/13 10:46:02.065120, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2520. free_pipe_context: destroying talloc pool of size 1498
  2521. [2013/09/13 10:46:02.065855, 3] smbd/process.c:1662(process_smb)
  2522. Transaction 66 of length 45 (0 toread)
  2523. [2013/09/13 10:46:02.065925, 3] smbd/process.c:1467(switch_message)
  2524. switch message SMBclose (pid 28394) conn 0x88ceed8
  2525. [2013/09/13 10:46:02.065982, 3] smbd/reply.c:4848(reply_close)
  2526. close fd=-1 fnum=16441 (numopen=1)
  2527. [2013/09/13 10:46:16.506509, 3] smbd/process.c:1662(process_smb)
  2528. Transaction 67 of length 39 (0 toread)
  2529. [2013/09/13 10:46:16.506608, 3] smbd/process.c:1467(switch_message)
  2530. switch message SMBtdis (pid 28394) conn 0x88ceed8
  2531. [2013/09/13 10:46:16.506688, 3] smbd/service.c:1378(close_cnum)
  2532. crw7c (192.168.sn.89) closed connection to service IPC$
  2533. [2013/09/13 10:46:16.506754, 3] smbd/connection.c:35(yield_connection)
  2534. Yielding connection to IPC$
  2535. [2013/09/13 10:46:16.507464, 3] smbd/process.c:1662(process_smb)
  2536. Transaction 68 of length 43 (0 toread)
  2537. [2013/09/13 10:46:16.507533, 3] smbd/process.c:1467(switch_message)
  2538. switch message SMBulogoffX (pid 28394) conn 0x0
  2539. [2013/09/13 10:46:16.507626, 3] smbd/reply.c:2096(reply_ulogoffX)
  2540. ulogoffX vuid=100
  2541. [2013/09/13 10:46:16.508285, 1] smbd/process.c:457(receive_smb_talloc)
  2542. receive_smb_raw_talloc failed for client 192.168.sn.89 read error = NT_STATUS_CONNECTION_RESET.
  2543. [2013/09/13 10:46:16.508451, 3] smbd/server_exit.c:181(exit_server_common)
  2544. Server exit (failed to receive smb request)
  2545. [2013/09/13 10:53:31.657875, 3] param/loadparm.c:9572(lp_load_ex)
  2546. lp_load_ex: refreshing parameters
  2547. [2013/09/13 10:53:31.675689, 3] param/loadparm.c:5192(init_globals)
  2548. Initialising global parameters
  2549. [2013/09/13 10:53:31.675867, 3] ../lib/util/params.c:550(pm_process)
  2550. params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
  2551. [2013/09/13 10:53:31.675936, 3] param/loadparm.c:8310(do_section)
  2552. Processing section "[global]"
  2553. [2013/09/13 10:53:31.676041, 3] ../lib/util/params.c:550(pm_process)
  2554. params.c:pm_process() - Processing configuration file "/etc/samba/alias.conf"
  2555. [2013/09/13 10:53:31.676115, 1] param/loadparm.c:7992(lp_do_parameter)
  2556. WARNING: The "enable privileges" option is deprecated
  2557. [2013/09/13 10:53:31.676606, 1] ../lib/util/params.c:350(Parameter)
  2558. params.c:Parameter() - Ignoring badly formed line in configuration file: all combinations of upper and lower case.
  2559. [2013/09/13 10:53:31.685165, 3] ../lib/util/params.c:550(pm_process)
  2560. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/venus.conf"
  2561. [2013/09/13 10:53:31.685301, 3] ../lib/util/params.c:550(pm_process)
  2562. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  2563. [2013/09/13 10:53:31.685361, 3] param/loadparm.c:8310(do_section)
  2564. Processing section "[global]"
  2565. [2013/09/13 10:53:31.685466, 2] param/loadparm.c:8327(do_section)
  2566. Processing section "[homes]"
  2567. [2013/09/13 10:53:31.685623, 2] param/loadparm.c:8327(do_section)
  2568. Processing section "[home]"
  2569. [2013/09/13 10:53:31.685789, 2] param/loadparm.c:8327(do_section)
  2570. Processing section "[Profiles]"
  2571. [2013/09/13 10:53:31.686007, 2] param/loadparm.c:8327(do_section)
  2572. Processing section "[Profile]"
  2573. [2013/09/13 10:53:31.686157, 2] param/loadparm.c:8327(do_section)
  2574. Processing section "[Profiles.V2]"
  2575. [2013/09/13 10:53:31.686339, 2] param/loadparm.c:8327(do_section)
  2576. Processing section "[Profile.v2]"
  2577. [2013/09/13 10:53:31.686521, 2] param/loadparm.c:8327(do_section)
  2578. Processing section "[mgmt]"
  2579. [2013/09/13 10:53:31.686690, 2] param/loadparm.c:8327(do_section)
  2580. Processing section "[accData]"
  2581. [2013/09/13 10:53:31.686866, 2] param/loadparm.c:8327(do_section)
  2582. Processing section "[printers]"
  2583. [2013/09/13 10:53:31.687021, 2] param/loadparm.c:8327(do_section)
  2584. Processing section "[print$]"
  2585. [2013/09/13 10:53:31.687190, 2] param/loadparm.c:8327(do_section)
  2586. Processing section "[installkit]"
  2587. [2013/09/13 10:53:31.687333, 2] param/loadparm.c:8327(do_section)
  2588. Processing section "[public]"
  2589. [2013/09/13 10:53:31.687489, 2] param/loadparm.c:8327(do_section)
  2590. Processing section "[accounts]"
  2591. [2013/09/13 10:53:31.687683, 2] param/loadparm.c:8327(do_section)
  2592. Processing section "[PaDFru_Midlands]"
  2593. [2013/09/13 10:53:31.687804, 1] param/loadparm.c:7992(lp_do_parameter)
  2594. WARNING: The "printer admin" option is deprecated
  2595. [2013/09/13 10:53:31.688134, 2] param/loadparm.c:8327(do_section)
  2596. Processing section "[PaDFru]"
  2597. [2013/09/13 10:53:31.688253, 1] param/loadparm.c:7992(lp_do_parameter)
  2598. WARNING: The "printer admin" option is deprecated
  2599. [2013/09/13 10:53:31.688585, 2] param/loadparm.c:8327(do_section)
  2600. Processing section "[PaDFru_Headed]"
  2601. [2013/09/13 10:53:31.688705, 1] param/loadparm.c:7992(lp_do_parameter)
  2602. WARNING: The "printer admin" option is deprecated
  2603. [2013/09/13 10:53:31.689090, 3] ../lib/util/params.c:550(pm_process)
  2604. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/gmdata.conf"
  2605. [2013/09/13 10:53:31.689150, 2] param/loadparm.c:8327(do_section)
  2606. Processing section "[gm]"
  2607. [2013/09/13 10:53:31.689365, 2] param/loadparm.c:8327(do_section)
  2608. Processing section "[tt]"
  2609. [2013/09/13 10:53:31.689622, 3] ../lib/util/params.c:550(pm_process)
  2610. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  2611. [2013/09/13 10:53:31.689682, 3] param/loadparm.c:8310(do_section)
  2612. Processing section "[global]"
  2613. [2013/09/13 10:53:31.689785, 2] param/loadparm.c:8327(do_section)
  2614. Processing section "[homes]"
  2615. [2013/09/13 10:53:31.689885, 2] param/loadparm.c:8327(do_section)
  2616. Processing section "[home]"
  2617. [2013/09/13 10:53:31.689984, 2] param/loadparm.c:8327(do_section)
  2618. Processing section "[Profiles]"
  2619. [2013/09/13 10:53:31.690153, 2] param/loadparm.c:8327(do_section)
  2620. Processing section "[Profile]"
  2621. [2013/09/13 10:53:31.690258, 2] param/loadparm.c:8327(do_section)
  2622. Processing section "[Profiles.V2]"
  2623. [2013/09/13 10:53:31.690395, 2] param/loadparm.c:8327(do_section)
  2624. Processing section "[Profile.v2]"
  2625. [2013/09/13 10:53:31.690535, 2] param/loadparm.c:8327(do_section)
  2626. Processing section "[mgmt]"
  2627. [2013/09/13 10:53:31.690655, 2] param/loadparm.c:8327(do_section)
  2628. Processing section "[accData]"
  2629. [2013/09/13 10:53:31.690786, 2] param/loadparm.c:8327(do_section)
  2630. Processing section "[printers]"
  2631. [2013/09/13 10:53:31.690897, 2] param/loadparm.c:8327(do_section)
  2632. Processing section "[print$]"
  2633. [2013/09/13 10:53:31.691022, 2] param/loadparm.c:8327(do_section)
  2634. Processing section "[installkit]"
  2635. [2013/09/13 10:53:31.691122, 2] param/loadparm.c:8327(do_section)
  2636. Processing section "[public]"
  2637. [2013/09/13 10:53:31.691233, 2] param/loadparm.c:8327(do_section)
  2638. Processing section "[accounts]"
  2639. [2013/09/13 10:53:31.691364, 2] param/loadparm.c:8327(do_section)
  2640. Processing section "[PaDFru_Midlands]"
  2641. [2013/09/13 10:53:31.691439, 1] param/loadparm.c:7992(lp_do_parameter)
  2642. WARNING: The "printer admin" option is deprecated
  2643. [2013/09/13 10:53:31.691771, 2] param/loadparm.c:8327(do_section)
  2644. Processing section "[PaDFru]"
  2645. [2013/09/13 10:53:31.691847, 1] param/loadparm.c:7992(lp_do_parameter)
  2646. WARNING: The "printer admin" option is deprecated
  2647. [2013/09/13 10:53:31.692191, 2] param/loadparm.c:8327(do_section)
  2648. Processing section "[PaDFru_Headed]"
  2649. [2013/09/13 10:53:31.692267, 1] param/loadparm.c:7992(lp_do_parameter)
  2650. WARNING: The "printer admin" option is deprecated
  2651. [2013/09/13 10:53:31.692601, 2] param/loadparm.c:8327(do_section)
  2652. Processing section "[netlogon]"
  2653. [2013/09/13 10:53:31.692758, 1] param/loadparm.c:7992(lp_do_parameter)
  2654. WARNING: The "share modes" option is deprecated
  2655. [2013/09/13 10:53:31.692849, 2] param/loadparm.c:8327(do_section)
  2656. Processing section "[netlogoff]"
  2657. [2013/09/13 10:53:31.693022, 1] param/loadparm.c:7992(lp_do_parameter)
  2658. WARNING: The "share modes" option is deprecated
  2659. [2013/09/13 10:53:31.693113, 2] param/loadparm.c:8327(do_section)
  2660. Processing section "[printers]"
  2661. [2013/09/13 10:53:31.693222, 2] param/loadparm.c:8327(do_section)
  2662. Processing section "[print$]"
  2663. [2013/09/13 10:53:31.693405, 3] param/loadparm.c:6630(lp_add_ipc)
  2664. adding IPC service
  2665. [2013/09/13 10:53:31.693595, 2] lib/interface.c:479(interpret_interface)
  2666. interpret_interface: Adding interface 192.168.sn.21/24
  2667. [2013/09/13 10:53:31.693663, 2] lib/interface.c:341(add_interface)
  2668. added interface 192.168.sn.21/ ip=192.168.sn.21 bcast=192.168.sn.255 netmask=255.255.255.0
  2669. [2013/09/13 10:53:31.693784, 3] auth/auth.c:219(check_ntlm_password)
  2670. check_ntlm_password: Checking password for unmapped user [DOMAIN]\[ijh-a]@[CRW7C] with the new password interface
  2671. [2013/09/13 10:53:31.693844, 3] auth/auth.c:222(check_ntlm_password)
  2672. check_ntlm_password: mapped user is: [DOMAIN]\[ijh-a]@[CRW7C]
  2673. [2013/09/13 10:53:31.694117, 2] lib/smbldap.c:1018(smbldap_open_connection)
  2674. smbldap_open_connection: connection opened
  2675. [2013/09/13 10:53:31.695159, 3] lib/smbldap.c:1948(smbldap_check_root_dse)
  2676. smbldap_check_root_dse: Expected one rootDSE, got 0
  2677. [2013/09/13 10:53:31.695238, 3] lib/smbldap.c:1240(smbldap_connect_system)
  2678. ldap_connect_system: successful connection to the LDAP server
  2679. [2013/09/13 10:53:31.695828, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  2680. init_sam_from_ldap: Entry found for user: ijh-a
  2681. [2013/09/13 10:53:31.699522, 3] auth/auth.c:268(check_ntlm_password)
  2682. check_ntlm_password: sam authentication for user [ijh-a] succeeded
  2683. [2013/09/13 10:53:31.699614, 2] auth/auth.c:309(check_ntlm_password)
  2684. check_ntlm_password: authentication for user [ijh-a] -> [ijh-a] -> [ijh-a] succeeded
  2685. [2013/09/13 10:53:31.701682, 3] groupdb/mapping.c:772(pdb_create_builtin_alias)
  2686. pdb_create_builtin_alias: Could not get a gid out of winbind
  2687. [2013/09/13 10:53:31.719400, 2] auth/token_util.c:479(finalize_local_nt_token)
  2688. WARNING: Failed to create BUILTIN\Users group! Can Winbind allocate gids?
  2689. [2013/09/13 10:53:31.722018, 3] ../libcli/auth/ntlmssp_sign.c:535(ntlmssp_sign_init)
  2690. NTLMSSP Sign/Seal - Initialising with flags:
  2691. [2013/09/13 10:53:31.722090, 3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags)
  2692. Got NTLMSSP neg_flags=0xe2088215
  2693. [2013/09/13 10:53:31.722182, 3] smbd/password.c:298(register_existing_vuid)
  2694. register_existing_vuid: User name: ijh-a Real name: IJH Admin
  2695. [2013/09/13 10:53:31.722238, 3] smbd/password.c:308(register_existing_vuid)
  2696. register_existing_vuid: UNIX uid 1014 is UNIX user ijh-a, and will be vuid 100
  2697. [2013/09/13 10:53:31.722386, 3] smbd/password.c:238(register_homes_share)
  2698. Adding homes service for user 'ijh-a' using home directory: '/home/ijh-a'
  2699. [2013/09/13 10:53:31.722511, 3] param/loadparm.c:6582(lp_add_home)
  2700. adding home's share [ijh-a] for user 'ijh-a' at '/home/%u'
  2701. [2013/09/13 10:53:31.723788, 3] smbd/process.c:1662(process_smb)
  2702. Transaction 3 of length 80 (0 toread)
  2703. [2013/09/13 10:53:31.723883, 3] smbd/process.c:1467(switch_message)
  2704. switch message SMBtconX (pid 30658) conn 0x0
  2705. [2013/09/13 10:53:31.724032, 3] lib/access.c:338(allow_access)
  2706. Allowed connection from 192.168.sn.89 (192.168.sn.89)
  2707. [2013/09/13 10:53:31.724126, 3] smbd/service.c:872(make_connection_snum)
  2708. Connect path is '/tmp' for service [IPC$]
  2709. [2013/09/13 10:53:31.724222, 3] smbd/vfs.c:102(vfs_init_default)
  2710. Initialising default vfs hooks
  2711. [2013/09/13 10:53:31.735036, 3] smbd/vfs.c:128(vfs_init_custom)
  2712. Initialising custom vfs hooks from [/[Default VFS]/]
  2713. [2013/09/13 10:53:31.735278, 3] smbd/service.c:1114(make_connection_snum)
  2714. crw7c (192.168.sn.89) connect to service IPC$ initially as user ijh-a (uid=1014, gid=512) (pid 30658)
  2715. [2013/09/13 10:53:31.735355, 3] smbd/reply.c:871(reply_tcon_and_X)
  2716. tconX service=IPC$
  2717. [2013/09/13 10:53:31.747273, 3] smbd/process.c:1662(process_smb)
  2718. Transaction 4 of length 104 (0 toread)
  2719. [2013/09/13 10:53:31.747355, 3] smbd/process.c:1467(switch_message)
  2720. switch message SMBntcreateX (pid 30658) conn 0x88bc498
  2721. [2013/09/13 10:53:31.748250, 3] smbd/process.c:1662(process_smb)
  2722. Transaction 5 of length 76 (0 toread)
  2723. [2013/09/13 10:53:31.748320, 3] smbd/process.c:1467(switch_message)
  2724. switch message SMBtrans2 (pid 30658) conn 0x88bc498
  2725. [2013/09/13 10:53:31.749133, 3] smbd/process.c:1662(process_smb)
  2726. Transaction 6 of length 184 (0 toread)
  2727. [2013/09/13 10:53:31.749199, 3] smbd/process.c:1467(switch_message)
  2728. switch message SMBwriteX (pid 30658) conn 0x88bc498
  2729. [2013/09/13 10:53:31.749303, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  2730. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  2731. [2013/09/13 10:53:31.749366, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  2732. check_bind_req for \lsarpc
  2733. [2013/09/13 10:53:31.749422, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  2734. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  2735. [2013/09/13 10:53:31.749520, 3] smbd/pipes.c:361(pipe_write_andx_done)
  2736. writeX-IPC nwritten=116
  2737. [2013/09/13 10:53:31.750313, 3] smbd/process.c:1662(process_smb)
  2738. Transaction 7 of length 63 (0 toread)
  2739. [2013/09/13 10:53:31.750395, 3] smbd/process.c:1467(switch_message)
  2740. switch message SMBreadX (pid 30658) conn 0x88bc498
  2741. [2013/09/13 10:53:31.750462, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2742. free_pipe_context: destroying talloc pool of size 23
  2743. [2013/09/13 10:53:31.750540, 3] smbd/pipes.c:485(pipe_read_andx_done)
  2744. readX-IPC min=1024 max=1024 nread=68
  2745. [2013/09/13 10:53:31.751336, 3] smbd/process.c:1662(process_smb)
  2746. Transaction 8 of length 168 (0 toread)
  2747. [2013/09/13 10:53:31.751418, 3] smbd/process.c:1467(switch_message)
  2748. switch message SMBtrans (pid 30658) conn 0x88bc498
  2749. [2013/09/13 10:53:31.751488, 3] smbd/ipc.c:560(handle_trans)
  2750. trans <\PIPE\> data=80 params=0 setup=2
  2751. [2013/09/13 10:53:31.751556, 3] smbd/ipc.c:511(named_pipe)
  2752. named pipe command on <> name
  2753. [2013/09/13 10:53:31.751614, 3] smbd/ipc.c:475(api_fd_reply)
  2754. Got API command 0x26 on pipe "lsarpc" (pnum 2759)
  2755. [2013/09/13 10:53:31.751686, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2756. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  2757. [2013/09/13 10:53:31.751815, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2758. free_pipe_context: destroying talloc pool of size 1075
  2759. [2013/09/13 10:53:31.752602, 3] smbd/process.c:1662(process_smb)
  2760. Transaction 9 of length 134 (0 toread)
  2761. [2013/09/13 10:53:31.752682, 3] smbd/process.c:1467(switch_message)
  2762. switch message SMBtrans (pid 30658) conn 0x88bc498
  2763. [2013/09/13 10:53:31.752745, 3] smbd/ipc.c:560(handle_trans)
  2764. trans <\PIPE\> data=46 params=0 setup=2
  2765. [2013/09/13 10:53:31.752803, 3] smbd/ipc.c:511(named_pipe)
  2766. named pipe command on <> name
  2767. [2013/09/13 10:53:31.752855, 3] smbd/ipc.c:475(api_fd_reply)
  2768. Got API command 0x26 on pipe "lsarpc" (pnum 2759)
  2769. [2013/09/13 10:53:31.752919, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2770. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  2771. [2013/09/13 10:53:31.757622, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2772. free_pipe_context: destroying talloc pool of size 27
  2773. [2013/09/13 10:53:31.758761, 3] smbd/process.c:1662(process_smb)
  2774. Transaction 10 of length 134 (0 toread)
  2775. [2013/09/13 10:53:31.758844, 3] smbd/process.c:1467(switch_message)
  2776. switch message SMBtrans (pid 30658) conn 0x88bc498
  2777. [2013/09/13 10:53:31.758907, 3] smbd/ipc.c:560(handle_trans)
  2778. trans <\PIPE\> data=46 params=0 setup=2
  2779. [2013/09/13 10:53:31.758965, 3] smbd/ipc.c:511(named_pipe)
  2780. named pipe command on <> name
  2781. [2013/09/13 10:53:31.759034, 3] smbd/ipc.c:475(api_fd_reply)
  2782. Got API command 0x26 on pipe "lsarpc" (pnum 2759)
  2783. [2013/09/13 10:53:31.759101, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2784. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  2785. [2013/09/13 10:53:31.759211, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2786. free_pipe_context: destroying talloc pool of size 135
  2787. [2013/09/13 10:53:31.760027, 3] smbd/process.c:1662(process_smb)
  2788. Transaction 11 of length 132 (0 toread)
  2789. [2013/09/13 10:53:31.760108, 3] smbd/process.c:1467(switch_message)
  2790. switch message SMBtrans (pid 30658) conn 0x88bc498
  2791. [2013/09/13 10:53:31.760172, 3] smbd/ipc.c:560(handle_trans)
  2792. trans <\PIPE\> data=44 params=0 setup=2
  2793. [2013/09/13 10:53:31.760230, 3] smbd/ipc.c:511(named_pipe)
  2794. named pipe command on <> name
  2795. [2013/09/13 10:53:31.760282, 3] smbd/ipc.c:475(api_fd_reply)
  2796. Got API command 0x26 on pipe "lsarpc" (pnum 2759)
  2797. [2013/09/13 10:53:31.760347, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2798. api_rpcTNP: rpc command: LSA_CLOSE
  2799. [2013/09/13 10:53:31.760407, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2800. Closed policy
  2801. [2013/09/13 10:53:31.760491, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2802. free_pipe_context: destroying talloc pool of size 23
  2803. [2013/09/13 10:53:31.761216, 3] smbd/process.c:1662(process_smb)
  2804. Transaction 12 of length 45 (0 toread)
  2805. [2013/09/13 10:53:31.761285, 3] smbd/process.c:1467(switch_message)
  2806. switch message SMBclose (pid 30658) conn 0x88bc498
  2807. [2013/09/13 10:53:31.761343, 3] smbd/reply.c:4848(reply_close)
  2808. close fd=-1 fnum=10073 (numopen=1)
  2809. [2013/09/13 10:53:32.118940, 3] smbd/process.c:1662(process_smb)
  2810. Transaction 13 of length 104 (0 toread)
  2811. [2013/09/13 10:53:32.119020, 3] smbd/process.c:1467(switch_message)
  2812. switch message SMBntcreateX (pid 30658) conn 0x88bc498
  2813. [2013/09/13 10:53:32..sn.9, 3] smbd/process.c:1662(process_smb)
  2814. Transaction 14 of length 76 (0 toread)
  2815. [2013/09/13 10:53:32.120147, 3] smbd/process.c:1467(switch_message)
  2816. switch message SMBtrans2 (pid 30658) conn 0x88bc498
  2817. [2013/09/13 10:53:32.121135, 3] smbd/process.c:1662(process_smb)
  2818. Transaction 15 of length 184 (0 toread)
  2819. [2013/09/13 10:53:32.121218, 3] smbd/process.c:1467(switch_message)
  2820. switch message SMBwriteX (pid 30658) conn 0x88bc498
  2821. [2013/09/13 10:53:32.121289, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  2822. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  2823. [2013/09/13 10:53:32.121345, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  2824. check_bind_req for \lsarpc
  2825. [2013/09/13 10:53:32.121399, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  2826. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  2827. [2013/09/13 10:53:32.121474, 3] smbd/pipes.c:361(pipe_write_andx_done)
  2828. writeX-IPC nwritten=116
  2829. [2013/09/13 10:53:32.122308, 3] smbd/process.c:1662(process_smb)
  2830. Transaction 16 of length 63 (0 toread)
  2831. [2013/09/13 10:53:32.122390, 3] smbd/process.c:1467(switch_message)
  2832. switch message SMBreadX (pid 30658) conn 0x88bc498
  2833. [2013/09/13 10:53:32.122454, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2834. free_pipe_context: destroying talloc pool of size 23
  2835. [2013/09/13 10:53:32.122531, 3] smbd/pipes.c:485(pipe_read_andx_done)
  2836. readX-IPC min=1024 max=1024 nread=68
  2837. [2013/09/13 10:53:32.123397, 3] smbd/process.c:1662(process_smb)
  2838. Transaction 17 of length 168 (0 toread)
  2839. [2013/09/13 10:53:32.123479, 3] smbd/process.c:1467(switch_message)
  2840. switch message SMBtrans (pid 30658) conn 0x88bc498
  2841. [2013/09/13 10:53:32.123550, 3] smbd/ipc.c:560(handle_trans)
  2842. trans <\PIPE\> data=80 params=0 setup=2
  2843. [2013/09/13 10:53:32.123609, 3] smbd/ipc.c:511(named_pipe)
  2844. named pipe command on <> name
  2845. [2013/09/13 10:53:32.123661, 3] smbd/ipc.c:475(api_fd_reply)
  2846. Got API command 0x26 on pipe "lsarpc" (pnum 275a)
  2847. [2013/09/13 10:53:32.123726, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2848. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  2849. [2013/09/13 10:53:32.123818, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2850. free_pipe_context: destroying talloc pool of size 1075
  2851. [2013/09/13 10:53:32.124600, 3] smbd/process.c:1662(process_smb)
  2852. Transaction 18 of length 134 (0 toread)
  2853. [2013/09/13 10:53:32.124698, 3] smbd/process.c:1467(switch_message)
  2854. switch message SMBtrans (pid 30658) conn 0x88bc498
  2855. [2013/09/13 10:53:32.124763, 3] smbd/ipc.c:560(handle_trans)
  2856. trans <\PIPE\> data=46 params=0 setup=2
  2857. [2013/09/13 10:53:32.124821, 3] smbd/ipc.c:511(named_pipe)
  2858. named pipe command on <> name
  2859. [2013/09/13 10:53:32.124873, 3] smbd/ipc.c:475(api_fd_reply)
  2860. Got API command 0x26 on pipe "lsarpc" (pnum 275a)
  2861. [2013/09/13 10:53:32.124938, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2862. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  2863. [2013/09/13 10:53:32.125017, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2864. free_pipe_context: destroying talloc pool of size 27
  2865. [2013/09/13 10:53:32.126132, 3] smbd/process.c:1662(process_smb)
  2866. Transaction 19 of length 134 (0 toread)
  2867. [2013/09/13 10:53:32.126207, 3] smbd/process.c:1467(switch_message)
  2868. switch message SMBtrans (pid 30658) conn 0x88bc498
  2869. [2013/09/13 10:53:32.126269, 3] smbd/ipc.c:560(handle_trans)
  2870. trans <\PIPE\> data=46 params=0 setup=2
  2871. [2013/09/13 10:53:32.126326, 3] smbd/ipc.c:511(named_pipe)
  2872. named pipe command on <> name
  2873. [2013/09/13 10:53:32.126378, 3] smbd/ipc.c:475(api_fd_reply)
  2874. Got API command 0x26 on pipe "lsarpc" (pnum 275a)
  2875. [2013/09/13 10:53:32.126441, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2876. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  2877. [2013/09/13 10:53:32.126538, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2878. free_pipe_context: destroying talloc pool of size 135
  2879. [2013/09/13 10:53:32.127253, 3] smbd/process.c:1662(process_smb)
  2880. Transaction 20 of length 132 (0 toread)
  2881. [2013/09/13 10:53:32.127323, 3] smbd/process.c:1467(switch_message)
  2882. switch message SMBtrans (pid 30658) conn 0x88bc498
  2883. [2013/09/13 10:53:32.127383, 3] smbd/ipc.c:560(handle_trans)
  2884. trans <\PIPE\> data=44 params=0 setup=2
  2885. [2013/09/13 10:53:32.127446, 3] smbd/ipc.c:511(named_pipe)
  2886. named pipe command on <> name
  2887. [2013/09/13 10:53:32.127499, 3] smbd/ipc.c:475(api_fd_reply)
  2888. Got API command 0x26 on pipe "lsarpc" (pnum 275a)
  2889. [2013/09/13 10:53:32.127563, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2890. api_rpcTNP: rpc command: LSA_CLOSE
  2891. [2013/09/13 10:53:32.127618, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  2892. Closed policy
  2893. [2013/09/13 10:53:32.127694, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2894. free_pipe_context: destroying talloc pool of size 23
  2895. [2013/09/13 10:53:32.128425, 3] smbd/process.c:1662(process_smb)
  2896. Transaction 21 of length 45 (0 toread)
  2897. [2013/09/13 10:53:32.128492, 3] smbd/process.c:1467(switch_message)
  2898. switch message SMBclose (pid 30658) conn 0x88bc498
  2899. [2013/09/13 10:53:32.128547, 3] smbd/reply.c:4848(reply_close)
  2900. close fd=-1 fnum=10074 (numopen=1)
  2901. [2013/09/13 10:53:32.132690, 3] smbd/process.c:1662(process_smb)
  2902. Transaction 22 of length 100 (0 toread)
  2903. [2013/09/13 10:53:32.132772, 3] smbd/process.c:1467(switch_message)
  2904. switch message SMBntcreateX (pid 30658) conn 0x88bc498
  2905. [2013/09/13 10:53:32.133540, 3] smbd/process.c:1662(process_smb)
  2906. Transaction 23 of length 76 (0 toread)
  2907. [2013/09/13 10:53:32.133611, 3] smbd/process.c:1467(switch_message)
  2908. switch message SMBtrans2 (pid 30658) conn 0x88bc498
  2909. [2013/09/13 10:53:32.134417, 3] smbd/process.c:1662(process_smb)
  2910. Transaction 24 of length 184 (0 toread)
  2911. [2013/09/13 10:53:32.134482, 3] smbd/process.c:1467(switch_message)
  2912. switch message SMBwriteX (pid 30658) conn 0x88bc498
  2913. [2013/09/13 10:53:32.134553, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  2914. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  2915. [2013/09/13 10:53:32.134609, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  2916. check_bind_req for \samr
  2917. [2013/09/13 10:53:32.134663, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  2918. check_bind_req: \PIPE\samr -> \PIPE\samr
  2919. [2013/09/13 10:53:32.134738, 3] smbd/pipes.c:361(pipe_write_andx_done)
  2920. writeX-IPC nwritten=116
  2921. [2013/09/13 10:53:32.135430, 3] smbd/process.c:1662(process_smb)
  2922. Transaction 25 of length 63 (0 toread)
  2923. [2013/09/13 10:53:32.135493, 3] smbd/process.c:1467(switch_message)
  2924. switch message SMBreadX (pid 30658) conn 0x88bc498
  2925. [2013/09/13 10:53:32.135556, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2926. free_pipe_context: destroying talloc pool of size 21
  2927. [2013/09/13 10:53:32.135634, 3] smbd/pipes.c:485(pipe_read_andx_done)
  2928. readX-IPC min=1024 max=1024 nread=68
  2929. [2013/09/13 10:53:32.136367, 3] smbd/process.c:1662(process_smb)
  2930. Transaction 26 of length 160 (0 toread)
  2931. [2013/09/13 10:53:32.136431, 3] smbd/process.c:1467(switch_message)
  2932. switch message SMBtrans (pid 30658) conn 0x88bc498
  2933. [2013/09/13 10:53:32.136489, 3] smbd/ipc.c:560(handle_trans)
  2934. trans <\PIPE\> data=72 params=0 setup=2
  2935. [2013/09/13 10:53:32.136555, 3] smbd/ipc.c:511(named_pipe)
  2936. named pipe command on <> name
  2937. [2013/09/13 10:53:32.136606, 3] smbd/ipc.c:475(api_fd_reply)
  2938. Got API command 0x26 on pipe "samr" (pnum 275b)
  2939. [2013/09/13 10:53:32.136670, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2940. api_rpcTNP: rpc command: SAMR_CONNECT5
  2941. [2013/09/13 10:53:32.136783, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2942. free_pipe_context: destroying talloc pool of size 1005
  2943. [2013/09/13 10:53:32.137529, 3] smbd/process.c:1662(process_smb)
  2944. Transaction 27 of length 140 (0 toread)
  2945. [2013/09/13 10:53:32.137594, 3] smbd/process.c:1467(switch_message)
  2946. switch message SMBtrans (pid 30658) conn 0x88bc498
  2947. [2013/09/13 10:53:32.137652, 3] smbd/ipc.c:560(handle_trans)
  2948. trans <\PIPE\> data=52 params=0 setup=2
  2949. [2013/09/13 10:53:32.137709, 3] smbd/ipc.c:511(named_pipe)
  2950. named pipe command on <> name
  2951. [2013/09/13 10:53:32.137760, 3] smbd/ipc.c:475(api_fd_reply)
  2952. Got API command 0x26 on pipe "samr" (pnum 275b)
  2953. [2013/09/13 10:53:32.137823, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2954. api_rpcTNP: rpc command: SAMR_ENUMDOMAINS
  2955. [2013/09/13 10:53:32.141328, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2956. free_pipe_context: destroying talloc pool of size 53
  2957. [2013/09/13 10:53:32.142311, 3] smbd/process.c:1662(process_smb)
  2958. Transaction 28 of length 158 (0 toread)
  2959. [2013/09/13 10:53:32.142396, 3] smbd/process.c:1467(switch_message)
  2960. switch message SMBtrans (pid 30658) conn 0x88bc498
  2961. [2013/09/13 10:53:32.142460, 3] smbd/ipc.c:560(handle_trans)
  2962. trans <\PIPE\> data=70 params=0 setup=2
  2963. [2013/09/13 10:53:32.142528, 3] smbd/ipc.c:511(named_pipe)
  2964. named pipe command on <> name
  2965. [2013/09/13 10:53:32.142580, 3] smbd/ipc.c:475(api_fd_reply)
  2966. Got API command 0x26 on pipe "samr" (pnum 275b)
  2967. [2013/09/13 10:53:32.142646, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2968. api_rpcTNP: rpc command: SAMR_LOOKUPDOMAIN
  2969. [2013/09/13 10:53:32.142724, 2] rpc_server/samr/srv_samr_nt.c:4071(_samr_LookupDomain)
  2970. Returning domain sid for domain DOMAIN -> S-1-5-21-OURSID-3360254768
  2971. [2013/09/13 10:53:32.142816, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2972. free_pipe_context: destroying talloc pool of size 89
  2973. [2013/09/13 10:53:32.143556, 3] smbd/process.c:1662(process_smb)
  2974. Transaction 29 of length 164 (0 toread)
  2975. [2013/09/13 10:53:32.143638, 3] smbd/process.c:1467(switch_message)
  2976. switch message SMBtrans (pid 30658) conn 0x88bc498
  2977. [2013/09/13 10:53:32.143702, 3] smbd/ipc.c:560(handle_trans)
  2978. trans <\PIPE\> data=76 params=0 setup=2
  2979. [2013/09/13 10:53:32.143760, 3] smbd/ipc.c:511(named_pipe)
  2980. named pipe command on <> name
  2981. [2013/09/13 10:53:32.143811, 3] smbd/ipc.c:475(api_fd_reply)
  2982. Got API command 0x26 on pipe "samr" (pnum 275b)
  2983. [2013/09/13 10:53:32.143876, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2984. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  2985. [2013/09/13 10:53:32.143974, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  2986. free_pipe_context: destroying talloc pool of size 1005
  2987. [2013/09/13 10:53:32.144683, 3] smbd/process.c:1662(process_smb)
  2988. Transaction 30 of length 172 (0 toread)
  2989. [2013/09/13 10:53:32.144762, 3] smbd/process.c:1467(switch_message)
  2990. switch message SMBtrans (pid 30658) conn 0x88bc498
  2991. [2013/09/13 10:53:32.144825, 3] smbd/ipc.c:560(handle_trans)
  2992. trans <\PIPE\> data=84 params=0 setup=2
  2993. [2013/09/13 10:53:32.144883, 3] smbd/ipc.c:511(named_pipe)
  2994. named pipe command on <> name
  2995. [2013/09/13 10:53:32.144934, 3] smbd/ipc.c:475(api_fd_reply)
  2996. Got API command 0x26 on pipe "samr" (pnum 275b)
  2997. [2013/09/13 10:53:32.145013, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  2998. api_rpcTNP: rpc command: SAMR_CREATEUSER2
  2999. [2013/09/13 10:53:32.162770, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  3000. init_sam_from_ldap: Entry found for user: crw7c$
  3001. [2013/09/13 10:53:32.164558, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3002. free_pipe_context: destroying talloc pool of size 21
  3003. [2013/09/13 10:53:32.165469, 3] smbd/process.c:1662(process_smb)
  3004. Transaction 31 of length 132 (0 toread)
  3005. [2013/09/13 10:53:32.165551, 3] smbd/process.c:1467(switch_message)
  3006. switch message SMBtrans (pid 30658) conn 0x88bc498
  3007. [2013/09/13 10:53:32.165614, 3] smbd/ipc.c:560(handle_trans)
  3008. trans <\PIPE\> data=44 params=0 setup=2
  3009. [2013/09/13 10:53:32.165671, 3] smbd/ipc.c:511(named_pipe)
  3010. named pipe command on <> name
  3011. [2013/09/13 10:53:32.165723, 3] smbd/ipc.c:475(api_fd_reply)
  3012. Got API command 0x26 on pipe "samr" (pnum 275b)
  3013. [2013/09/13 10:53:32.165788, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3014. api_rpcTNP: rpc command: SAMR_CLOSE
  3015. [2013/09/13 10:53:32.165856, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3016. Closed policy
  3017. [2013/09/13 10:53:32.165932, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3018. free_pipe_context: destroying talloc pool of size 21
  3019. [2013/09/13 10:53:32.166712, 3] smbd/process.c:1662(process_smb)
  3020. Transaction 32 of length 132 (0 toread)
  3021. [2013/09/13 10:53:32.166792, 3] smbd/process.c:1467(switch_message)
  3022. switch message SMBtrans (pid 30658) conn 0x88bc498
  3023. [2013/09/13 10:53:32.166855, 3] smbd/ipc.c:560(handle_trans)
  3024. trans <\PIPE\> data=44 params=0 setup=2
  3025. [2013/09/13 10:53:32.166911, 3] smbd/ipc.c:511(named_pipe)
  3026. named pipe command on <> name
  3027. [2013/09/13 10:53:32.166963, 3] smbd/ipc.c:475(api_fd_reply)
  3028. Got API command 0x26 on pipe "samr" (pnum 275b)
  3029. [2013/09/13 10:53:32.167027, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3030. api_rpcTNP: rpc command: SAMR_CLOSE
  3031. [2013/09/13 10:53:32.167083, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3032. Closed policy
  3033. [2013/09/13 10:53:32.167158, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3034. free_pipe_context: destroying talloc pool of size 21
  3035. [2013/09/13 10:53:32.167884, 3] smbd/process.c:1662(process_smb)
  3036. Transaction 33 of length 45 (0 toread)
  3037. [2013/09/13 10:53:32.167953, 3] smbd/process.c:1467(switch_message)
  3038. switch message SMBclose (pid 30658) conn 0x88bc498
  3039. [2013/09/13 10:53:32.168007, 3] smbd/reply.c:4848(reply_close)
  3040. close fd=-1 fnum=10075 (numopen=1)
  3041. [2013/09/13 10:53:32.169533, 3] smbd/process.c:1662(process_smb)
  3042. Transaction 34 of length 100 (0 toread)
  3043. [2013/09/13 10:53:32.169596, 3] smbd/process.c:1467(switch_message)
  3044. switch message SMBntcreateX (pid 30658) conn 0x88bc498
  3045. [2013/09/13 10:53:32.170423, 3] smbd/process.c:1662(process_smb)
  3046. Transaction 35 of length 76 (0 toread)
  3047. [2013/09/13 10:53:32.170487, 3] smbd/process.c:1467(switch_message)
  3048. switch message SMBtrans2 (pid 30658) conn 0x88bc498
  3049. [2013/09/13 10:53:32.171323, 3] smbd/process.c:1662(process_smb)
  3050. Transaction 36 of length 184 (0 toread)
  3051. [2013/09/13 10:53:32.171386, 3] smbd/process.c:1467(switch_message)
  3052. switch message SMBwriteX (pid 30658) conn 0x88bc498
  3053. [2013/09/13 10:53:32.171452, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  3054. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  3055. [2013/09/13 10:53:32.171517, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  3056. check_bind_req for \samr
  3057. [2013/09/13 10:53:32.171570, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  3058. check_bind_req: \PIPE\samr -> \PIPE\samr
  3059. [2013/09/13 10:53:32.171646, 3] smbd/pipes.c:361(pipe_write_andx_done)
  3060. writeX-IPC nwritten=116
  3061. [2013/09/13 10:53:32.172380, 3] smbd/process.c:1662(process_smb)
  3062. Transaction 37 of length 63 (0 toread)
  3063. [2013/09/13 10:53:32.172462, 3] smbd/process.c:1467(switch_message)
  3064. switch message SMBreadX (pid 30658) conn 0x88bc498
  3065. [2013/09/13 10:53:32.172533, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3066. free_pipe_context: destroying talloc pool of size 21
  3067. [2013/09/13 10:53:32.172599, 3] smbd/pipes.c:485(pipe_read_andx_done)
  3068. readX-IPC min=1024 max=1024 nread=68
  3069. [2013/09/13 10:53:32.173361, 3] smbd/process.c:1662(process_smb)
  3070. Transaction 38 of length 160 (0 toread)
  3071. [2013/09/13 10:53:32.173456, 3] smbd/process.c:1467(switch_message)
  3072. switch message SMBtrans (pid 30658) conn 0x88bc498
  3073. [2013/09/13 10:53:32.173524, 3] smbd/ipc.c:560(handle_trans)
  3074. trans <\PIPE\> data=72 params=0 setup=2
  3075. [2013/09/13 10:53:32.173582, 3] smbd/ipc.c:511(named_pipe)
  3076. named pipe command on <> name
  3077. [2013/09/13 10:53:32.173633, 3] smbd/ipc.c:475(api_fd_reply)
  3078. Got API command 0x26 on pipe "samr" (pnum 275c)
  3079. [2013/09/13 10:53:32.173699, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3080. api_rpcTNP: rpc command: SAMR_CONNECT5
  3081. [2013/09/13 10:53:32.173789, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3082. free_pipe_context: destroying talloc pool of size 1005
  3083. [2013/09/13 10:53:32.174602, 3] smbd/process.c:1662(process_smb)
  3084. Transaction 39 of length 164 (0 toread)
  3085. [2013/09/13 10:53:32.174682, 3] smbd/process.c:1467(switch_message)
  3086. switch message SMBtrans (pid 30658) conn 0x88bc498
  3087. [2013/09/13 10:53:32.174744, 3] smbd/ipc.c:560(handle_trans)
  3088. trans <\PIPE\> data=76 params=0 setup=2
  3089. [2013/09/13 10:53:32.174801, 3] smbd/ipc.c:511(named_pipe)
  3090. named pipe command on <> name
  3091. [2013/09/13 10:53:32.174853, 3] smbd/ipc.c:475(api_fd_reply)
  3092. Got API command 0x26 on pipe "samr" (pnum 275c)
  3093. [2013/09/13 10:53:32.174918, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3094. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  3095. [2013/09/13 10:53:32.175007, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3096. free_pipe_context: destroying talloc pool of size 1005
  3097. [2013/09/13 10:53:32.175704, 3] smbd/process.c:1662(process_smb)
  3098. Transaction 40 of length 180 (0 toread)
  3099. [2013/09/13 10:53:32.175783, 3] smbd/process.c:1467(switch_message)
  3100. switch message SMBtrans (pid 30658) conn 0x88bc498
  3101. [2013/09/13 10:53:32.175846, 3] smbd/ipc.c:560(handle_trans)
  3102. trans <\PIPE\> data=92 params=0 setup=2
  3103. [2013/09/13 10:53:32.175903, 3] smbd/ipc.c:511(named_pipe)
  3104. named pipe command on <> name
  3105. [2013/09/13 10:53:32.175955, 3] smbd/ipc.c:475(api_fd_reply)
  3106. Got API command 0x26 on pipe "samr" (pnum 275c)
  3107. [2013/09/13 10:53:32.176020, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3108. api_rpcTNP: rpc command: SAMR_LOOKUPNAMES
  3109. [2013/09/13 10:53:32.176721, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  3110. init_sam_from_ldap: Entry found for user: crw7c$
  3111. [2013/09/13 10:53:32.178479, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3112. free_pipe_context: destroying talloc pool of size 33
  3113. [2013/09/13 10:53:32.179197, 3] smbd/process.c:1662(process_smb)
  3114. Transaction 41 of length 140 (0 toread)
  3115. [2013/09/13 10:53:32.179263, 3] smbd/process.c:1467(switch_message)
  3116. switch message SMBtrans (pid 30658) conn 0x88bc498
  3117. [2013/09/13 10:53:32.179322, 3] smbd/ipc.c:560(handle_trans)
  3118. trans <\PIPE\> data=52 params=0 setup=2
  3119. [2013/09/13 10:53:32.179379, 3] smbd/ipc.c:511(named_pipe)
  3120. named pipe command on <> name
  3121. [2013/09/13 10:53:32.179429, 3] smbd/ipc.c:475(api_fd_reply)
  3122. Got API command 0x26 on pipe "samr" (pnum 275c)
  3123. [2013/09/13 10:53:32.179501, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3124. api_rpcTNP: rpc command: SAMR_OPENUSER
  3125. [2013/09/13 10:53:32.179724, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3126. free_pipe_context: destroying talloc pool of size 1237
  3127. [2013/09/13 10:53:32.180534, 3] smbd/process.c:1662(process_smb)
  3128. Transaction 42 of length 134 (0 toread)
  3129. [2013/09/13 10:53:32.180613, 3] smbd/process.c:1467(switch_message)
  3130. switch message SMBtrans (pid 30658) conn 0x88bc498
  3131. [2013/09/13 10:53:32.180675, 3] smbd/ipc.c:560(handle_trans)
  3132. trans <\PIPE\> data=46 params=0 setup=2
  3133. [2013/09/13 10:53:32.180733, 3] smbd/ipc.c:511(named_pipe)
  3134. named pipe command on <> name
  3135. [2013/09/13 10:53:32.180784, 3] smbd/ipc.c:475(api_fd_reply)
  3136. Got API command 0x26 on pipe "samr" (pnum 275c)
  3137. [2013/09/13 10:53:32.180848, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3138. api_rpcTNP: rpc command: SAMR_QUERYUSERINFO
  3139. [2013/09/13 10:53:32.181043, 3] rpc_server/samr/srv_samr_nt.c:3011(_samr_QueryUserInfo)
  3140. User:[crw7c$]
  3141. [2013/09/13 10:53:32.181144, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3142. free_pipe_context: destroying talloc pool of size 749
  3143. [2013/09/13 10:53:32.181847, 3] smbd/process.c:1662(process_smb)
  3144. Transaction 43 of length 132 (0 toread)
  3145. [2013/09/13 10:53:32.181927, 3] smbd/process.c:1467(switch_message)
  3146. switch message SMBtrans (pid 30658) conn 0x88bc498
  3147. [2013/09/13 10:53:32.181989, 3] smbd/ipc.c:560(handle_trans)
  3148. trans <\PIPE\> data=44 params=0 setup=2
  3149. [2013/09/13 10:53:32.182046, 3] smbd/ipc.c:511(named_pipe)
  3150. named pipe command on <> name
  3151. [2013/09/13 10:53:32.182098, 3] smbd/ipc.c:475(api_fd_reply)
  3152. Got API command 0x26 on pipe "samr" (pnum 275c)
  3153. [2013/09/13 10:53:32.182162, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3154. api_rpcTNP: rpc command: SAMR_GETUSERPWINFO
  3155. [2013/09/13 10:53:32.182795, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3156. free_pipe_context: destroying talloc pool of size 21
  3157. [2013/09/13 10:53:32.183817, 3] smbd/process.c:1662(process_smb)
  3158. Transaction 44 of length 669 (0 toread)
  3159. [2013/09/13 10:53:32.183883, 3] smbd/process.c:1467(switch_message)
  3160. switch message SMBtrans (pid 30658) conn 0x88bc498
  3161. [2013/09/13 10:53:32.183942, 3] smbd/ipc.c:560(handle_trans)
  3162. trans <\PIPE\> data=581 params=0 setup=2
  3163. [2013/09/13 10:53:32.183998, 3] smbd/ipc.c:511(named_pipe)
  3164. named pipe command on <> name
  3165. [2013/09/13 10:53:32.184049, 3] smbd/ipc.c:475(api_fd_reply)
  3166. Got API command 0x26 on pipe "samr" (pnum 275c)
  3167. [2013/09/13 10:53:32.184114, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3168. api_rpcTNP: rpc command: SAMR_SETUSERINFO2
  3169. [2013/09/13 10:53:32.186061, 2] passdb/pdb_ldap.c:1180(init_ldap_from_sam)
  3170. init_ldap_from_sam: Setting entry for user: crw7c$
  3171. [2013/09/13 10:53:32.239620, 2] passdb/pdb_ldap.c:2042(ldapsam_update_sam_account)
  3172. ldapsam_update_sam_account: successfully modified uid = crw7c$ in the LDAP database
  3173. [2013/09/13 10:53:32.239747, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3174. free_pipe_context: destroying talloc pool of size 21
  3175. [2013/09/13 10:53:32.240761, 3] smbd/process.c:1662(process_smb)
  3176. Transaction 45 of length 132 (0 toread)
  3177. [2013/09/13 10:53:32.240858, 3] smbd/process.c:1467(switch_message)
  3178. switch message SMBtrans (pid 30658) conn 0x88bc498
  3179. [2013/09/13 10:53:32.240921, 3] smbd/ipc.c:560(handle_trans)
  3180. trans <\PIPE\> data=44 params=0 setup=2
  3181. [2013/09/13 10:53:32.240978, 3] smbd/ipc.c:511(named_pipe)
  3182. named pipe command on <> name
  3183. [2013/09/13 10:53:32.241030, 3] smbd/ipc.c:475(api_fd_reply)
  3184. Got API command 0x26 on pipe "samr" (pnum 275c)
  3185. [2013/09/13 10:53:32.241094, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3186. api_rpcTNP: rpc command: SAMR_CLOSE
  3187. [2013/09/13 10:53:32.241150, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3188. Closed policy
  3189. [2013/09/13 10:53:32.241227, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3190. free_pipe_context: destroying talloc pool of size 21
  3191. [2013/09/13 10:53:32.241936, 3] smbd/process.c:1662(process_smb)
  3192. Transaction 46 of length 132 (0 toread)
  3193. [2013/09/13 10:53:32.2.sn., 3] smbd/process.c:1467(switch_message)
  3194. switch message SMBtrans (pid 30658) conn 0x88bc498
  3195. [2013/09/13 10:53:32.242060, 3] smbd/ipc.c:560(handle_trans)
  3196. trans <\PIPE\> data=44 params=0 setup=2
  3197. [2013/09/13 10:53:32.242116, 3] smbd/ipc.c:511(named_pipe)
  3198. named pipe command on <> name
  3199. [2013/09/13 10:53:32.242166, 3] smbd/ipc.c:475(api_fd_reply)
  3200. Got API command 0x26 on pipe "samr" (pnum 275c)
  3201. [2013/09/13 10:53:32.242229, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3202. api_rpcTNP: rpc command: SAMR_CLOSE
  3203. [2013/09/13 10:53:32.242284, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3204. Closed policy
  3205. [2013/09/13 10:53:32.242357, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3206. free_pipe_context: destroying talloc pool of size 21
  3207. [2013/09/13 10:53:32.243034, 3] smbd/process.c:1662(process_smb)
  3208. Transaction 47 of length 132 (0 toread)
  3209. [2013/09/13 10:53:32.243098, 3] smbd/process.c:1467(switch_message)
  3210. switch message SMBtrans (pid 30658) conn 0x88bc498
  3211. [2013/09/13 10:53:32.243157, 3] smbd/ipc.c:560(handle_trans)
  3212. trans <\PIPE\> data=44 params=0 setup=2
  3213. [2013/09/13 10:53:32.243212, 3] smbd/ipc.c:511(named_pipe)
  3214. named pipe command on <> name
  3215. [2013/09/13 10:53:32.243277, 3] smbd/ipc.c:475(api_fd_reply)
  3216. Got API command 0x26 on pipe "samr" (pnum 275c)
  3217. [2013/09/13 10:53:32.243341, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3218. api_rpcTNP: rpc command: SAMR_CLOSE
  3219. [2013/09/13 10:53:32.243396, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3220. Closed policy
  3221. [2013/09/13 10:53:32.243470, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3222. free_pipe_context: destroying talloc pool of size 21
  3223. [2013/09/13 10:53:32.244223, 3] smbd/process.c:1662(process_smb)
  3224. Transaction 48 of length 45 (0 toread)
  3225. [2013/09/13 10:53:32.244287, 3] smbd/process.c:1467(switch_message)
  3226. switch message SMBclose (pid 30658) conn 0x88bc498
  3227. [2013/09/13 10:53:32.244342, 3] smbd/reply.c:4848(reply_close)
  3228. close fd=-1 fnum=10076 (numopen=1)
  3229. [2013/09/13 10:53:32.261020, 3] smbd/process.c:1662(process_smb)
  3230. Transaction 49 of length 108 (0 toread)
  3231. [2013/09/13 10:53:32.261100, 3] smbd/process.c:1467(switch_message)
  3232. switch message SMBntcreateX (pid 30658) conn 0x88bc498
  3233. [2013/09/13 10:53:32.261977, 3] smbd/process.c:1662(process_smb)
  3234. Transaction 50 of length 76 (0 toread)
  3235. [2013/09/13 10:53:32.262045, 3] smbd/process.c:1467(switch_message)
  3236. switch message SMBtrans2 (pid 30658) conn 0x88bc498
  3237. [2013/09/13 10:53:32.263140, 3] smbd/process.c:1662(process_smb)
  3238. Transaction 51 of length 184 (0 toread)
  3239. [2013/09/13 10:53:32.263206, 3] smbd/process.c:1467(switch_message)
  3240. switch message SMBwriteX (pid 30658) conn 0x88bc498
  3241. [2013/09/13 10:53:32.263272, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  3242. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  3243. [2013/09/13 10:53:32.263328, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  3244. check_bind_req for \netlogon
  3245. [2013/09/13 10:53:32.263382, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  3246. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  3247. [2013/09/13 10:53:32.263458, 3] smbd/pipes.c:361(pipe_write_andx_done)
  3248. writeX-IPC nwritten=116
  3249. [2013/09/13 10:53:32.264275, 3] smbd/process.c:1662(process_smb)
  3250. Transaction 52 of length 63 (0 toread)
  3251. [2013/09/13 10:53:32.264338, 3] smbd/process.c:1467(switch_message)
  3252. switch message SMBreadX (pid 30658) conn 0x88bc498
  3253. [2013/09/13 10:53:32.264396, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3254. free_pipe_context: destroying talloc pool of size 25
  3255. [2013/09/13 10:53:32.264459, 3] smbd/pipes.c:485(pipe_read_andx_done)
  3256. readX-IPC min=1024 max=1024 nread=72
  3257. [2013/09/13 10:53:32.265238, 3] smbd/process.c:1662(process_smb)
  3258. Transaction 53 of length 148 (0 toread)
  3259. [2013/09/13 10:53:32.265301, 3] smbd/process.c:1467(switch_message)
  3260. switch message SMBtrans (pid 30658) conn 0x88bc498
  3261. [2013/09/13 10:53:32.265359, 3] smbd/ipc.c:560(handle_trans)
  3262. trans <\PIPE\> data=60 params=0 setup=2
  3263. [2013/09/13 10:53:32.265415, 3] smbd/ipc.c:511(named_pipe)
  3264. named pipe command on <> name
  3265. [2013/09/13 10:53:32.265466, 3] smbd/ipc.c:475(api_fd_reply)
  3266. Got API command 0x26 on pipe "NETLOGON" (pnum 275d)
  3267. [2013/09/13 10:53:32.265539, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3268. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  3269. [2013/09/13 10:53:32.295787, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3270. free_pipe_context: destroying talloc pool of size 29
  3271. [2013/09/13 10:53:32.296964, 3] smbd/process.c:1662(process_smb)
  3272. Transaction 54 of length 45 (0 toread)
  3273. [2013/09/13 10:53:32.297047, 3] smbd/process.c:1467(switch_message)
  3274. switch message SMBclose (pid 30658) conn 0x88bc498
  3275. [2013/09/13 10:53:32.297105, 3] smbd/reply.c:4848(reply_close)
  3276. close fd=-1 fnum=10077 (numopen=1)
  3277. [2013/09/13 10:53:32.298518, 3] smbd/process.c:1662(process_smb)
  3278. Transaction 55 of length 108 (0 toread)
  3279. [2013/09/13 10:53:32.298585, 3] smbd/process.c:1467(switch_message)
  3280. switch message SMBntcreateX (pid 30658) conn 0x88bc498
  3281. [2013/09/13 10:53:32.299335, 3] smbd/process.c:1662(process_smb)
  3282. Transaction 56 of length 76 (0 toread)
  3283. [2013/09/13 10:53:32.299400, 3] smbd/process.c:1467(switch_message)
  3284. switch message SMBtrans2 (pid 30658) conn 0x88bc498
  3285. [2013/09/13 10:53:32.300206, 3] smbd/process.c:1662(process_smb)
  3286. Transaction 57 of length 184 (0 toread)
  3287. [2013/09/13 10:53:32.300284, 3] smbd/process.c:1467(switch_message)
  3288. switch message SMBwriteX (pid 30658) conn 0x88bc498
  3289. [2013/09/13 10:53:32.300352, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  3290. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  3291. [2013/09/13 10:53:32.300408, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  3292. check_bind_req for \netlogon
  3293. [2013/09/13 10:53:32.300461, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  3294. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  3295. [2013/09/13 10:53:32.300543, 3] smbd/pipes.c:361(pipe_write_andx_done)
  3296. writeX-IPC nwritten=116
  3297. [2013/09/13 10:53:32.301327, 3] smbd/process.c:1662(process_smb)
  3298. Transaction 58 of length 63 (0 toread)
  3299. [2013/09/13 10:53:32.301407, 3] smbd/process.c:1467(switch_message)
  3300. switch message SMBreadX (pid 30658) conn 0x88bc498
  3301. [2013/09/13 10:53:32.301469, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3302. free_pipe_context: destroying talloc pool of size 25
  3303. [2013/09/13 10:53:32.301541, 3] smbd/pipes.c:485(pipe_read_andx_done)
  3304. readX-IPC min=1024 max=1024 nread=72
  3305. [2013/09/13 10:53:32.302239, 3] smbd/process.c:1662(process_smb)
  3306. Transaction 59 of length 148 (0 toread)
  3307. [2013/09/13 10:53:32.302303, 3] smbd/process.c:1467(switch_message)
  3308. switch message SMBtrans (pid 30658) conn 0x88bc498
  3309. [2013/09/13 10:53:32.302361, 3] smbd/ipc.c:560(handle_trans)
  3310. trans <\PIPE\> data=60 params=0 setup=2
  3311. [2013/09/13 10:53:32.302418, 3] smbd/ipc.c:511(named_pipe)
  3312. named pipe command on <> name
  3313. [2013/09/13 10:53:32.302469, 3] smbd/ipc.c:475(api_fd_reply)
  3314. Got API command 0x26 on pipe "NETLOGON" (pnum 275e)
  3315. [2013/09/13 10:53:32.302551, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3316. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  3317. [2013/09/13 10:53:32.302630, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3318. free_pipe_context: destroying talloc pool of size 29
  3319. [2013/09/13 10:53:32.303387, 3] smbd/process.c:1662(process_smb)
  3320. Transaction 60 of length 45 (0 toread)
  3321. [2013/09/13 10:53:32.303451, 3] smbd/process.c:1467(switch_message)
  3322. switch message SMBclose (pid 30658) conn 0x88bc498
  3323. [2013/09/13 10:53:32.303511, 3] smbd/reply.c:4848(reply_close)
  3324. close fd=-1 fnum=10078 (numopen=1)
  3325. [2013/09/13 10:53:32.304722, 3] smbd/process.c:1662(process_smb)
  3326. Transaction 61 of length 108 (0 toread)
  3327. [2013/09/13 10:53:32.304787, 3] smbd/process.c:1467(switch_message)
  3328. switch message SMBntcreateX (pid 30658) conn 0x88bc498
  3329. [2013/09/13 10:53:32.305545, 3] smbd/process.c:1662(process_smb)
  3330. Transaction 62 of length 76 (0 toread)
  3331. [2013/09/13 10:53:32.305611, 3] smbd/process.c:1467(switch_message)
  3332. switch message SMBtrans2 (pid 30658) conn 0x88bc498
  3333. [2013/09/13 10:53:32.306598, 3] smbd/process.c:1662(process_smb)
  3334. Transaction 63 of length 184 (0 toread)
  3335. [2013/09/13 10:53:32.306677, 3] smbd/process.c:1467(switch_message)
  3336. switch message SMBwriteX (pid 30658) conn 0x88bc498
  3337. [2013/09/13 10:53:32.306748, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  3338. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  3339. [2013/09/13 10:53:32.306804, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  3340. check_bind_req for \netlogon
  3341. [2013/09/13 10:53:32.306858, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  3342. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  3343. [2013/09/13 10:53:32.306934, 3] smbd/pipes.c:361(pipe_write_andx_done)
  3344. writeX-IPC nwritten=116
  3345. [2013/09/13 10:53:32.307643, 3] smbd/process.c:1662(process_smb)
  3346. Transaction 64 of length 63 (0 toread)
  3347. [2013/09/13 10:53:32.307722, 3] smbd/process.c:1467(switch_message)
  3348. switch message SMBreadX (pid 30658) conn 0x88bc498
  3349. [2013/09/13 10:53:32.307784, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3350. free_pipe_context: destroying talloc pool of size 25
  3351. [2013/09/13 10:53:32.307850, 3] smbd/pipes.c:485(pipe_read_andx_done)
  3352. readX-IPC min=1024 max=1024 nread=72
  3353. [2013/09/13 10:53:32.308531, 3] smbd/process.c:1662(process_smb)
  3354. Transaction 65 of length 144 (0 toread)
  3355. [2013/09/13 10:53:32.308595, 3] smbd/process.c:1467(switch_message)
  3356. switch message SMBtrans (pid 30658) conn 0x88bc498
  3357. [2013/09/13 10:53:32.308671, 3] smbd/ipc.c:560(handle_trans)
  3358. trans <\PIPE\> data=56 params=0 setup=2
  3359. [2013/09/13 10:53:32.308728, 3] smbd/ipc.c:511(named_pipe)
  3360. named pipe command on <> name
  3361. [2013/09/13 10:53:32.308780, 3] smbd/ipc.c:475(api_fd_reply)
  3362. Got API command 0x26 on pipe "NETLOGON" (pnum 275f)
  3363. [2013/09/13 10:53:32.308844, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3364. api_rpcTNP: rpc command: NETR_NETRENUMERATETRUSTEDDOMAINS
  3365. [2013/09/13 10:53:32.320789, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3366. Closed policy
  3367. [2013/09/13 10:53:32.326126, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3368. free_pipe_context: destroying talloc pool of size 1354
  3369. [2013/09/13 10:53:32.326952, 3] smbd/process.c:1662(process_smb)
  3370. Transaction 66 of length 45 (0 toread)
  3371. [2013/09/13 10:53:32.327034, 3] smbd/process.c:1467(switch_message)
  3372. switch message SMBclose (pid 30658) conn 0x88bc498
  3373. [2013/09/13 10:53:32.327091, 3] smbd/reply.c:4848(reply_close)
  3374. close fd=-1 fnum=10079 (numopen=1)
  3375. [2013/09/13 10:53:46.506133, 3] smbd/process.c:1662(process_smb)
  3376. Transaction 67 of length 39 (0 toread)
  3377. [2013/09/13 10:53:46.506233, 3] smbd/process.c:1467(switch_message)
  3378. switch message SMBtdis (pid 30658) conn 0x88bc498
  3379. [2013/09/13 10:53:46.506312, 3] smbd/service.c:1378(close_cnum)
  3380. crw7c (192.168.sn.89) closed connection to service IPC$
  3381. [2013/09/13 10:53:46.506389, 3] smbd/connection.c:35(yield_connection)
  3382. Yielding connection to IPC$
  3383. [2013/09/13 10:53:46.507067, 3] smbd/process.c:1662(process_smb)
  3384. Transaction 68 of length 43 (0 toread)
  3385. [2013/09/13 10:53:46.507136, 3] smbd/process.c:1467(switch_message)
  3386. switch message SMBulogoffX (pid 30658) conn 0x0
  3387. [2013/09/13 10:53:46.507228, 3] smbd/reply.c:2096(reply_ulogoffX)
  3388. ulogoffX vuid=100
  3389. [2013/09/13 10:53:46.507885, 1] smbd/process.c:457(receive_smb_talloc)
  3390. receive_smb_raw_talloc failed for client 192.168.sn.89 read error = NT_STATUS_CONNECTION_RESET.
  3391. [2013/09/13 10:53:46.508052, 3] smbd/server_exit.c:181(exit_server_common)
  3392. Server exit (failed to receive smb request)
  3393. [2013/09/13 10:57:21.362044, 3] param/loadparm.c:9572(lp_load_ex)
  3394. lp_load_ex: refreshing parameters
  3395. [2013/09/13 10:57:21.362145, 3] param/loadparm.c:5192(init_globals)
  3396. Initialising global parameters
  3397. [2013/09/13 10:57:21.362311, 3] ../lib/util/params.c:550(pm_process)
  3398. params.c:pm_process() - Processing configuration file "/etc/samba/smb.conf"
  3399. [2013/09/13 10:57:21.362378, 3] param/loadparm.c:8310(do_section)
  3400. Processing section "[global]"
  3401. [2013/09/13 10:57:21.362480, 3] ../lib/util/params.c:550(pm_process)
  3402. params.c:pm_process() - Processing configuration file "/etc/samba/alias.conf"
  3403. [2013/09/13 10:57:21.362562, 1] param/loadparm.c:7992(lp_do_parameter)
  3404. WARNING: The "enable privileges" option is deprecated
  3405. [2013/09/13 10:57:21.363051, 1] ../lib/util/params.c:350(Parameter)
  3406. params.c:Parameter() - Ignoring badly formed line in configuration file: all combinations of upper and lower case.
  3407. [2013/09/13 10:57:21.363581, 3] ../lib/util/params.c:550(pm_process)
  3408. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/venus.conf"
  3409. [2013/09/13 10:57:21.363700, 3] ../lib/util/params.c:550(pm_process)
  3410. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  3411. [2013/09/13 10:57:21.363757, 3] param/loadparm.c:8310(do_section)
  3412. Processing section "[global]"
  3413. [2013/09/13 10:57:21.363859, 2] param/loadparm.c:8327(do_section)
  3414. Processing section "[homes]"
  3415. [2013/09/13 10:57:21.364003, 2] param/loadparm.c:8327(do_section)
  3416. Processing section "[home]"
  3417. [2013/09/13 10:57:21.364147, 2] param/loadparm.c:8327(do_section)
  3418. Processing section "[Profiles]"
  3419. [2013/09/13 10:57:21.364361, 2] param/loadparm.c:8327(do_section)
  3420. Processing section "[Profile]"
  3421. [2013/09/13 10:57:21.364514, 2] param/loadparm.c:8327(do_section)
  3422. Processing section "[Profiles.V2]"
  3423. [2013/09/13 10:57:21.364697, 2] param/loadparm.c:8327(do_section)
  3424. Processing section "[Profile.v2]"
  3425. [2013/09/13 10:57:21.364880, 2] param/loadparm.c:8327(do_section)
  3426. Processing section "[mgmt]"
  3427. [2013/09/13 10:57:21.365066, 2] param/loadparm.c:8327(do_section)
  3428. Processing section "[accData]"
  3429. [2013/09/13 10:57:21.365244, 2] param/loadparm.c:8327(do_section)
  3430. Processing section "[printers]"
  3431. [2013/09/13 10:57:21.365400, 2] param/loadparm.c:8327(do_section)
  3432. Processing section "[print$]"
  3433. [2013/09/13 10:57:21.365573, 2] param/loadparm.c:8327(do_section)
  3434. Processing section "[installkit]"
  3435. [2013/09/13 10:57:21.365718, 2] param/loadparm.c:8327(do_section)
  3436. Processing section "[public]"
  3437. [2013/09/13 10:57:21.365873, 2] param/loadparm.c:8327(do_section)
  3438. Processing section "[accounts]"
  3439. [2013/09/13 10:57:21.366050, 2] param/loadparm.c:8327(do_section)
  3440. Processing section "[PaDFru_Midlands]"
  3441. [2013/09/13 10:57:21.366170, 1] param/loadparm.c:7992(lp_do_parameter)
  3442. WARNING: The "printer admin" option is deprecated
  3443. [2013/09/13 10:57:21.366503, 2] param/loadparm.c:8327(do_section)
  3444. Processing section "[PaDFru]"
  3445. [2013/09/13 10:57:21.366623, 1] param/loadparm.c:7992(lp_do_parameter)
  3446. WARNING: The "printer admin" option is deprecated
  3447. [2013/09/13 10:57:21.366952, 2] param/loadparm.c:8327(do_section)
  3448. Processing section "[PaDFru_Headed]"
  3449. [2013/09/13 10:57:21.367071, 1] param/loadparm.c:7992(lp_do_parameter)
  3450. WARNING: The "printer admin" option is deprecated
  3451. [2013/09/13 10:57:21.367456, 3] ../lib/util/params.c:550(pm_process)
  3452. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/gmdata.conf"
  3453. [2013/09/13 10:57:21.367519, 2] param/loadparm.c:8327(do_section)
  3454. Processing section "[gm]"
  3455. [2013/09/13 10:57:21.367736, 2] param/loadparm.c:8327(do_section)
  3456. Processing section "[tt]"
  3457. [2013/09/13 10:57:21.367989, 3] ../lib/util/params.c:550(pm_process)
  3458. params.c:pm_process() - Processing configuration file "/etc/samba/alias.d/domaintop.conf"
  3459. [2013/09/13 10:57:21.368049, 3] param/loadparm.c:8310(do_section)
  3460. Processing section "[global]"
  3461. [2013/09/13 10:57:21.368152, 2] param/loadparm.c:8327(do_section)
  3462. Processing section "[homes]"
  3463. [2013/09/13 10:57:21.368252, 2] param/loadparm.c:8327(do_section)
  3464. Processing section "[home]"
  3465. [2013/09/13 10:57:21.368351, 2] param/loadparm.c:8327(do_section)
  3466. Processing section "[Profiles]"
  3467. [2013/09/13 10:57:21.368524, 2] param/loadparm.c:8327(do_section)
  3468. Processing section "[Profile]"
  3469. [2013/09/13 10:57:21.368631, 2] param/loadparm.c:8327(do_section)
  3470. Processing section "[Profiles.V2]"
  3471. [2013/09/13 10:57:21.368767, 2] param/loadparm.c:8327(do_section)
  3472. Processing section "[Profile.v2]"
  3473. [2013/09/13 10:57:21.368904, 2] param/loadparm.c:8327(do_section)
  3474. Processing section "[mgmt]"
  3475. [2013/09/13 10:57:21.369024, 2] param/loadparm.c:8327(do_section)
  3476. Processing section "[accData]"
  3477. [2013/09/13 10:57:21.369155, 2] param/loadparm.c:8327(do_section)
  3478. Processing section "[printers]"
  3479. [2013/09/13 10:57:21.369267, 2] param/loadparm.c:8327(do_section)
  3480. Processing section "[print$]"
  3481. [2013/09/13 10:57:21.369391, 2] param/loadparm.c:8327(do_section)
  3482. Processing section "[installkit]"
  3483. [2013/09/13 10:57:21.369490, 2] param/loadparm.c:8327(do_section)
  3484. Processing section "[public]"
  3485. [2013/09/13 10:57:21.369605, 2] param/loadparm.c:8327(do_section)
  3486. Processing section "[accounts]"
  3487. [2013/09/13 10:57:21.369737, 2] param/loadparm.c:8327(do_section)
  3488. Processing section "[PaDFru_Midlands]"
  3489. [2013/09/13 10:57:21.369813, 1] param/loadparm.c:7992(lp_do_parameter)
  3490. WARNING: The "printer admin" option is deprecated
  3491. [2013/09/13 10:57:21.370141, 2] param/loadparm.c:8327(do_section)
  3492. Processing section "[PaDFru]"
  3493. [2013/09/13 10:57:21.370215, 1] param/loadparm.c:7992(lp_do_parameter)
  3494. WARNING: The "printer admin" option is deprecated
  3495. [2013/09/13 10:57:21.370546, 2] param/loadparm.c:8327(do_section)
  3496. Processing section "[PaDFru_Headed]"
  3497. [2013/09/13 10:57:21.370621, 1] param/loadparm.c:7992(lp_do_parameter)
  3498. WARNING: The "printer admin" option is deprecated
  3499. [2013/09/13 10:57:21.370953, 2] param/loadparm.c:8327(do_section)
  3500. Processing section "[netlogon]"
  3501. [2013/09/13 10:57:21.371108, 1] param/loadparm.c:7992(lp_do_parameter)
  3502. WARNING: The "share modes" option is deprecated
  3503. [2013/09/13 10:57:21.371213, 2] param/loadparm.c:8327(do_section)
  3504. Processing section "[netlogoff]"
  3505. [2013/09/13 10:57:21.371386, 1] param/loadparm.c:7992(lp_do_parameter)
  3506. WARNING: The "share modes" option is deprecated
  3507. [2013/09/13 10:57:21.371478, 2] param/loadparm.c:8327(do_section)
  3508. Processing section "[printers]"
  3509. [2013/09/13 10:57:21.371596, 2] param/loadparm.c:8327(do_section)
  3510. Processing section "[print$]"
  3511. [2013/09/13 10:57:21.371779, 3] param/loadparm.c:6630(lp_add_ipc)
  3512. adding IPC service
  3513. [2013/09/13 10:57:21.371960, 2] lib/interface.c:479(interpret_interface)
  3514. interpret_interface: Adding interface 192.168.sn.21/24
  3515. [2013/09/13 10:57:21.372026, 2] lib/interface.c:341(add_interface)
  3516. added interface 192.168.sn.21/ ip=192.168.sn.21 bcast=192.168.sn.255 netmask=255.255.255.0
  3517. [2013/09/13 10:57:21.372141, 3] auth/auth.c:219(check_ntlm_password)
  3518. check_ntlm_password: Checking password for unmapped user [DOMAIN]\[geek]@[CRW7C] with the new password interface
  3519. [2013/09/13 10:57:21.372202, 3] auth/auth.c:222(check_ntlm_password)
  3520. check_ntlm_password: mapped user is: [DOMAIN]\[geek]@[CRW7C]
  3521. [2013/09/13 10:57:21.372476, 2] lib/smbldap.c:1018(smbldap_open_connection)
  3522. smbldap_open_connection: connection opened
  3523. [2013/09/13 10:57:21.373421, 3] lib/smbldap.c:1948(smbldap_check_root_dse)
  3524. smbldap_check_root_dse: Expected one rootDSE, got 0
  3525. [2013/09/13 10:57:21.373459, 3] lib/smbldap.c:1240(smbldap_connect_system)
  3526. ldap_connect_system: successful connection to the LDAP server
  3527. [2013/09/13 10:57:21.373807, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  3528. init_sam_from_ldap: Entry found for user: geek
  3529. [2013/09/13 10:57:21.375953, 3] auth/auth.c:268(check_ntlm_password)
  3530. check_ntlm_password: sam authentication for user [geek] succeeded
  3531. [2013/09/13 10:57:21.376000, 2] auth/auth.c:309(check_ntlm_password)
  3532. check_ntlm_password: authentication for user [geek] -> [geek] -> [geek] succeeded
  3533. [2013/09/13 10:57:21.377516, 3] groupdb/mapping.c:772(pdb_create_builtin_alias)
  3534. pdb_create_builtin_alias: Could not get a gid out of winbind
  3535. [2013/09/13 10:57:21.377554, 2] auth/token_util.c:479(finalize_local_nt_token)
  3536. WARNING: Failed to create BUILTIN\Users group! Can Winbind allocate gids?
  3537. [2013/09/13 10:57:21.379000, 3] ../libcli/auth/ntlmssp_sign.c:535(ntlmssp_sign_init)
  3538. NTLMSSP Sign/Seal - Initialising with flags:
  3539. [2013/09/13 10:57:21.379036, 3] ../libcli/auth/ntlmssp.c:34(debug_ntlmssp_flags)
  3540. Got NTLMSSP neg_flags=0xe2088215
  3541. [2013/09/13 10:57:21.379079, 3] smbd/password.c:298(register_existing_vuid)
  3542. register_existing_vuid: User name: geek Real name: Current Geek
  3543. [2013/09/13 10:57:21.379107, 3] smbd/password.c:308(register_existing_vuid)
  3544. register_existing_vuid: UNIX uid 1012 is UNIX user geek, and will be vuid 100
  3545. [2013/09/13 10:57:21.428832, 3] smbd/password.c:238(register_homes_share)
  3546. Adding homes service for user 'geek' using home directory: '/home/geek'
  3547. [2013/09/13 10:57:21.428967, 3] param/loadparm.c:6582(lp_add_home)
  3548. adding home's share [geek] for user 'geek' at '/home/%u'
  3549. [2013/09/13 10:57:21.430340, 3] smbd/process.c:1662(process_smb)
  3550. Transaction 3 of length 80 (0 toread)
  3551. [2013/09/13 10:57:21.430440, 3] smbd/process.c:1467(switch_message)
  3552. switch message SMBtconX (pid 31803) conn 0x0
  3553. [2013/09/13 10:57:21.430605, 3] lib/access.c:338(allow_access)
  3554. Allowed connection from 192.168.sn.89 (192.168.sn.89)
  3555. [2013/09/13 10:57:21.430700, 3] smbd/service.c:872(make_connection_snum)
  3556. Connect path is '/tmp' for service [IPC$]
  3557. [2013/09/13 10:57:21.430797, 3] smbd/vfs.c:102(vfs_init_default)
  3558. Initialising default vfs hooks
  3559. [2013/09/13 10:57:21.430877, 3] smbd/vfs.c:128(vfs_init_custom)
  3560. Initialising custom vfs hooks from [/[Default VFS]/]
  3561. [2013/09/13 10:57:21.431101, 3] smbd/service.c:1114(make_connection_snum)
  3562. crw7c (192.168.sn.89) connect to service IPC$ initially as user geek (uid=1012, gid=512) (pid 31803)
  3563. [2013/09/13 10:57:21.431177, 3] smbd/reply.c:871(reply_tcon_and_X)
  3564. tconX service=IPC$
  3565. [2013/09/13 10:57:21.469708, 3] smbd/process.c:1662(process_smb)
  3566. Transaction 4 of length 104 (0 toread)
  3567. [2013/09/13 10:57:21.469804, 3] smbd/process.c:1467(switch_message)
  3568. switch message SMBntcreateX (pid 31803) conn 0x88cef60
  3569. [2013/09/13 10:57:21.470746, 3] smbd/process.c:1662(process_smb)
  3570. Transaction 5 of length 76 (0 toread)
  3571. [2013/09/13 10:57:21.470826, 3] smbd/process.c:1467(switch_message)
  3572. switch message SMBtrans2 (pid 31803) conn 0x88cef60
  3573. [2013/09/13 10:57:21.471665, 3] smbd/process.c:1662(process_smb)
  3574. Transaction 6 of length 184 (0 toread)
  3575. [2013/09/13 10:57:21.471731, 3] smbd/process.c:1467(switch_message)
  3576. switch message SMBwriteX (pid 31803) conn 0x88cef60
  3577. [2013/09/13 10:57:21.471835, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  3578. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  3579. [2013/09/13 10:57:21.471898, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  3580. check_bind_req for \lsarpc
  3581. [2013/09/13 10:57:21.471954, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  3582. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  3583. [2013/09/13 10:57:21.472049, 3] smbd/pipes.c:361(pipe_write_andx_done)
  3584. writeX-IPC nwritten=116
  3585. [2013/09/13 10:57:21.472765, 3] smbd/process.c:1662(process_smb)
  3586. Transaction 7 of length 63 (0 toread)
  3587. [2013/09/13 10:57:21.472829, 3] smbd/process.c:1467(switch_message)
  3588. switch message SMBreadX (pid 31803) conn 0x88cef60
  3589. [2013/09/13 10:57:21.472891, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3590. free_pipe_context: destroying talloc pool of size 23
  3591. [2013/09/13 10:57:21.472962, 3] smbd/pipes.c:485(pipe_read_andx_done)
  3592. readX-IPC min=1024 max=1024 nread=68
  3593. [2013/09/13 10:57:21.473728, 3] smbd/process.c:1662(process_smb)
  3594. Transaction 8 of length 168 (0 toread)
  3595. [2013/09/13 10:57:21.473810, 3] smbd/process.c:1467(switch_message)
  3596. switch message SMBtrans (pid 31803) conn 0x88cef60
  3597. [2013/09/13 10:57:21.473880, 3] smbd/ipc.c:560(handle_trans)
  3598. trans <\PIPE\> data=80 params=0 setup=2
  3599. [2013/09/13 10:57:21.473942, 3] smbd/ipc.c:511(named_pipe)
  3600. named pipe command on <> name
  3601. [2013/09/13 10:57:21.473999, 3] smbd/ipc.c:475(api_fd_reply)
  3602. Got API command 0x26 on pipe "lsarpc" (pnum 2dba)
  3603. [2013/09/13 10:57:21.474071, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3604. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  3605. [2013/09/13 10:57:21.474201, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3606. free_pipe_context: destroying talloc pool of size 1075
  3607. [2013/09/13 10:57:21.474909, 3] smbd/process.c:1662(process_smb)
  3608. Transaction 9 of length 134 (0 toread)
  3609. [2013/09/13 10:57:21.474978, 3] smbd/process.c:1467(switch_message)
  3610. switch message SMBtrans (pid 31803) conn 0x88cef60
  3611. [2013/09/13 10:57:21.475037, 3] smbd/ipc.c:560(handle_trans)
  3612. trans <\PIPE\> data=46 params=0 setup=2
  3613. [2013/09/13 10:57:21.475093, 3] smbd/ipc.c:511(named_pipe)
  3614. named pipe command on <> name
  3615. [2013/09/13 10:57:21.475144, 3] smbd/ipc.c:475(api_fd_reply)
  3616. Got API command 0x26 on pipe "lsarpc" (pnum 2dba)
  3617. [2013/09/13 10:57:21.475207, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3618. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  3619. [2013/09/13 10:57:21.475295, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3620. free_pipe_context: destroying talloc pool of size 27
  3621. [2013/09/13 10:57:21.476357, 3] smbd/process.c:1662(process_smb)
  3622. Transaction 10 of length 134 (0 toread)
  3623. [2013/09/13 10:57:21.476421, 3] smbd/process.c:1467(switch_message)
  3624. switch message SMBtrans (pid 31803) conn 0x88cef60
  3625. [2013/09/13 10:57:21.476480, 3] smbd/ipc.c:560(handle_trans)
  3626. trans <\PIPE\> data=46 params=0 setup=2
  3627. [2013/09/13 10:57:21.476541, 3] smbd/ipc.c:511(named_pipe)
  3628. named pipe command on <> name
  3629. [2013/09/13 10:57:21.476592, 3] smbd/ipc.c:475(api_fd_reply)
  3630. Got API command 0x26 on pipe "lsarpc" (pnum 2dba)
  3631. [2013/09/13 10:57:21.476655, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3632. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  3633. [2013/09/13 10:57:21.476763, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3634. free_pipe_context: destroying talloc pool of size 135
  3635. [2013/09/13 10:57:21.477513, 3] smbd/process.c:1662(process_smb)
  3636. Transaction 11 of length 132 (0 toread)
  3637. [2013/09/13 10:57:21.477578, 3] smbd/process.c:1467(switch_message)
  3638. switch message SMBtrans (pid 31803) conn 0x88cef60
  3639. [2013/09/13 10:57:21.477651, 3] smbd/ipc.c:560(handle_trans)
  3640. trans <\PIPE\> data=44 params=0 setup=2
  3641. [2013/09/13 10:57:21.477708, 3] smbd/ipc.c:511(named_pipe)
  3642. named pipe command on <> name
  3643. [2013/09/13 10:57:21.477759, 3] smbd/ipc.c:475(api_fd_reply)
  3644. Got API command 0x26 on pipe "lsarpc" (pnum 2dba)
  3645. [2013/09/13 10:57:21.477822, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3646. api_rpcTNP: rpc command: LSA_CLOSE
  3647. [2013/09/13 10:57:21.477882, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3648. Closed policy
  3649. [2013/09/13 10:57:21.477963, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3650. free_pipe_context: destroying talloc pool of size 23
  3651. [2013/09/13 10:57:21.478693, 3] smbd/process.c:1662(process_smb)
  3652. Transaction 12 of length 45 (0 toread)
  3653. [2013/09/13 10:57:21.478758, 3] smbd/process.c:1467(switch_message)
  3654. switch message SMBclose (pid 31803) conn 0x88cef60
  3655. [2013/09/13 10:57:21.478817, 3] smbd/reply.c:4848(reply_close)
  3656. close fd=-1 fnum=11706 (numopen=1)
  3657. [2013/09/13 10:57:21.855781, 3] smbd/process.c:1662(process_smb)
  3658. Transaction 13 of length 104 (0 toread)
  3659. [2013/09/13 10:57:21.855868, 3] smbd/process.c:1467(switch_message)
  3660. switch message SMBntcreateX (pid 31803) conn 0x88cef60
  3661. [2013/09/13 10:57:21.856662, 3] smbd/process.c:1662(process_smb)
  3662. Transaction 14 of length 76 (0 toread)
  3663. [2013/09/13 10:57:21.856733, 3] smbd/process.c:1467(switch_message)
  3664. switch message SMBtrans2 (pid 31803) conn 0x88cef60
  3665. [2013/09/13 10:57:21.857557, 3] smbd/process.c:1662(process_smb)
  3666. Transaction 15 of length 184 (0 toread)
  3667. [2013/09/13 10:57:21.857621, 3] smbd/process.c:1467(switch_message)
  3668. switch message SMBwriteX (pid 31803) conn 0x88cef60
  3669. [2013/09/13 10:57:21.857692, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  3670. api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  3671. [2013/09/13 10:57:21.857748, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  3672. check_bind_req for \lsarpc
  3673. [2013/09/13 10:57:21.857802, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  3674. check_bind_req: \PIPE\lsarpc -> \PIPE\lsarpc
  3675. [2013/09/13 10:57:21.857881, 3] smbd/pipes.c:361(pipe_write_andx_done)
  3676. writeX-IPC nwritten=116
  3677. [2013/09/13 10:57:21.858595, 3] smbd/process.c:1662(process_smb)
  3678. Transaction 16 of length 63 (0 toread)
  3679. [2013/09/13 10:57:21.858659, 3] smbd/process.c:1467(switch_message)
  3680. switch message SMBreadX (pid 31803) conn 0x88cef60
  3681. [2013/09/13 10:57:21.858719, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3682. free_pipe_context: destroying talloc pool of size 23
  3683. [2013/09/13 10:57:21.858783, 3] smbd/pipes.c:485(pipe_read_andx_done)
  3684. readX-IPC min=1024 max=1024 nread=68
  3685. [2013/09/13 10:57:21.859526, 3] smbd/process.c:1662(process_smb)
  3686. Transaction 17 of length 168 (0 toread)
  3687. [2013/09/13 10:57:21.859591, 3] smbd/process.c:1467(switch_message)
  3688. switch message SMBtrans (pid 31803) conn 0x88cef60
  3689. [2013/09/13 10:57:21.859650, 3] smbd/ipc.c:560(handle_trans)
  3690. trans <\PIPE\> data=80 params=0 setup=2
  3691. [2013/09/13 10:57:21.859707, 3] smbd/ipc.c:511(named_pipe)
  3692. named pipe command on <> name
  3693. [2013/09/13 10:57:21.859759, 3] smbd/ipc.c:475(api_fd_reply)
  3694. Got API command 0x26 on pipe "lsarpc" (pnum 2dbb)
  3695. [2013/09/13 10:57:21.859824, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3696. api_rpcTNP: rpc command: LSA_OPENPOLICY2
  3697. [2013/09/13 10:57:21.859921, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3698. free_pipe_context: destroying talloc pool of size 1075
  3699. [2013/09/13 10:57:21.860863, 3] smbd/process.c:1662(process_smb)
  3700. Transaction 18 of length 134 (0 toread)
  3701. [2013/09/13 10:57:21.860943, 3] smbd/process.c:1467(switch_message)
  3702. switch message SMBtrans (pid 31803) conn 0x88cef60
  3703. [2013/09/13 10:57:21.861005, 3] smbd/ipc.c:560(handle_trans)
  3704. trans <\PIPE\> data=46 params=0 setup=2
  3705. [2013/09/13 10:57:21.861063, 3] smbd/ipc.c:511(named_pipe)
  3706. named pipe command on <> name
  3707. [2013/09/13 10:57:21.861115, 3] smbd/ipc.c:475(api_fd_reply)
  3708. Got API command 0x26 on pipe "lsarpc" (pnum 2dbb)
  3709. [2013/09/13 10:57:21.861180, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3710. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY2
  3711. [2013/09/13 10:57:21.861280, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3712. free_pipe_context: destroying talloc pool of size 27
  3713. [2013/09/13 10:57:21.862421, 3] smbd/process.c:1662(process_smb)
  3714. Transaction 19 of length 134 (0 toread)
  3715. [2013/09/13 10:57:21.862492, 3] smbd/process.c:1467(switch_message)
  3716. switch message SMBtrans (pid 31803) conn 0x88cef60
  3717. [2013/09/13 10:57:21.862551, 3] smbd/ipc.c:560(handle_trans)
  3718. trans <\PIPE\> data=46 params=0 setup=2
  3719. [2013/09/13 10:57:21.862608, 3] smbd/ipc.c:511(named_pipe)
  3720. named pipe command on <> name
  3721. [2013/09/13 10:57:21.862658, 3] smbd/ipc.c:475(api_fd_reply)
  3722. Got API command 0x26 on pipe "lsarpc" (pnum 2dbb)
  3723. [2013/09/13 10:57:21.862722, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3724. api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
  3725. [2013/09/13 10:57:21.862808, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3726. free_pipe_context: destroying talloc pool of size 135
  3727. [2013/09/13 10:57:21.863751, 3] smbd/process.c:1662(process_smb)
  3728. Transaction 20 of length 132 (0 toread)
  3729. [2013/09/13 10:57:21.863816, 3] smbd/process.c:1467(switch_message)
  3730. switch message SMBtrans (pid 31803) conn 0x88cef60
  3731. [2013/09/13 10:57:21.863874, 3] smbd/ipc.c:560(handle_trans)
  3732. trans <\PIPE\> data=44 params=0 setup=2
  3733. [2013/09/13 10:57:21.863929, 3] smbd/ipc.c:511(named_pipe)
  3734. named pipe command on <> name
  3735. [2013/09/13 10:57:21.863980, 3] smbd/ipc.c:475(api_fd_reply)
  3736. Got API command 0x26 on pipe "lsarpc" (pnum 2dbb)
  3737. [2013/09/13 10:57:21.864043, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3738. api_rpcTNP: rpc command: LSA_CLOSE
  3739. [2013/09/13 10:57:21.864099, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3740. Closed policy
  3741. [2013/09/13 10:57:21.864174, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3742. free_pipe_context: destroying talloc pool of size 23
  3743. [2013/09/13 10:57:21.864950, 3] smbd/process.c:1662(process_smb)
  3744. Transaction 21 of length 45 (0 toread)
  3745. [2013/09/13 10:57:21.865014, 3] smbd/process.c:1467(switch_message)
  3746. switch message SMBclose (pid 31803) conn 0x88cef60
  3747. [2013/09/13 10:57:21.865069, 3] smbd/reply.c:4848(reply_close)
  3748. close fd=-1 fnum=11707 (numopen=1)
  3749. [2013/09/13 10:57:21.869315, 3] smbd/process.c:1662(process_smb)
  3750. Transaction 22 of length 100 (0 toread)
  3751. [2013/09/13 10:57:21.869395, 3] smbd/process.c:1467(switch_message)
  3752. switch message SMBntcreateX (pid 31803) conn 0x88cef60
  3753. [2013/09/13 10:57:21.870160, 3] smbd/process.c:1662(process_smb)
  3754. Transaction 23 of length 76 (0 toread)
  3755. [2013/09/13 10:57:21.870228, 3] smbd/process.c:1467(switch_message)
  3756. switch message SMBtrans2 (pid 31803) conn 0x88cef60
  3757. [2013/09/13 10:57:21.871035, 3] smbd/process.c:1662(process_smb)
  3758. Transaction 24 of length 184 (0 toread)
  3759. [2013/09/13 10:57:21.871100, 3] smbd/process.c:1467(switch_message)
  3760. switch message SMBwriteX (pid 31803) conn 0x88cef60
  3761. [2013/09/13 10:57:21.871166, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  3762. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  3763. [2013/09/13 10:57:21.871222, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  3764. check_bind_req for \samr
  3765. [2013/09/13 10:57:21.871275, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  3766. check_bind_req: \PIPE\samr -> \PIPE\samr
  3767. [2013/09/13 10:57:21.871352, 3] smbd/pipes.c:361(pipe_write_andx_done)
  3768. writeX-IPC nwritten=116
  3769. [2013/09/13 10:57:21.872071, 3] smbd/process.c:1662(process_smb)
  3770. Transaction 25 of length 63 (0 toread)
  3771. [2013/09/13 10:57:21.872153, 3] smbd/process.c:1467(switch_message)
  3772. switch message SMBreadX (pid 31803) conn 0x88cef60
  3773. [2013/09/13 10:57:21.872217, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3774. free_pipe_context: destroying talloc pool of size 21
  3775. [2013/09/13 10:57:21.872282, 3] smbd/pipes.c:485(pipe_read_andx_done)
  3776. readX-IPC min=1024 max=1024 nread=68
  3777. [2013/09/13 10:57:21.873026, 3] smbd/process.c:1662(process_smb)
  3778. Transaction 26 of length 160 (0 toread)
  3779. [2013/09/13 10:57:21.873107, 3] smbd/process.c:1467(switch_message)
  3780. switch message SMBtrans (pid 31803) conn 0x88cef60
  3781. [2013/09/13 10:57:21.873170, 3] smbd/ipc.c:560(handle_trans)
  3782. trans <\PIPE\> data=72 params=0 setup=2
  3783. [2013/09/13 10:57:21.873242, 3] smbd/ipc.c:511(named_pipe)
  3784. named pipe command on <> name
  3785. [2013/09/13 10:57:21.873295, 3] smbd/ipc.c:475(api_fd_reply)
  3786. Got API command 0x26 on pipe "samr" (pnum 2dbc)
  3787. [2013/09/13 10:57:21.873360, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3788. api_rpcTNP: rpc command: SAMR_CONNECT5
  3789. [2013/09/13 10:57:21.873475, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3790. free_pipe_context: destroying talloc pool of size 1005
  3791. [2013/09/13 10:57:21.874157, 3] smbd/process.c:1662(process_smb)
  3792. Transaction 27 of length 140 (0 toread)
  3793. [2013/09/13 10:57:21.874222, 3] smbd/process.c:1467(switch_message)
  3794. switch message SMBtrans (pid 31803) conn 0x88cef60
  3795. [2013/09/13 10:57:21.874281, 3] smbd/ipc.c:560(handle_trans)
  3796. trans <\PIPE\> data=52 params=0 setup=2
  3797. [2013/09/13 10:57:21.874337, 3] smbd/ipc.c:511(named_pipe)
  3798. named pipe command on <> name
  3799. [2013/09/13 10:57:21.874388, 3] smbd/ipc.c:475(api_fd_reply)
  3800. Got API command 0x26 on pipe "samr" (pnum 2dbc)
  3801. [2013/09/13 10:57:21.874451, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3802. api_rpcTNP: rpc command: SAMR_ENUMDOMAINS
  3803. [2013/09/13 10:57:21.874568, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3804. free_pipe_context: destroying talloc pool of size 53
  3805. [2013/09/13 10:57:21.875231, 3] smbd/process.c:1662(process_smb)
  3806. Transaction 28 of length 158 (0 toread)
  3807. [2013/09/13 10:57:21.875295, 3] smbd/process.c:1467(switch_message)
  3808. switch message SMBtrans (pid 31803) conn 0x88cef60
  3809. [2013/09/13 10:57:21.875354, 3] smbd/ipc.c:560(handle_trans)
  3810. trans <\PIPE\> data=70 params=0 setup=2
  3811. [2013/09/13 10:57:21.875409, 3] smbd/ipc.c:511(named_pipe)
  3812. named pipe command on <> name
  3813. [2013/09/13 10:57:21.875459, 3] smbd/ipc.c:475(api_fd_reply)
  3814. Got API command 0x26 on pipe "samr" (pnum 2dbc)
  3815. [2013/09/13 10:57:21.875525, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3816. api_rpcTNP: rpc command: SAMR_LOOKUPDOMAIN
  3817. [2013/09/13 10:57:21.875604, 2] rpc_server/samr/srv_samr_nt.c:4071(_samr_LookupDomain)
  3818. Returning domain sid for domain DOMAIN -> S-1-5-21-OURSID-3360254768
  3819. [2013/09/13 10:57:21.875691, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3820. free_pipe_context: destroying talloc pool of size 89
  3821. [2013/09/13 10:57:21.876508, 3] smbd/process.c:1662(process_smb)
  3822. Transaction 29 of length 164 (0 toread)
  3823. [2013/09/13 10:57:21.876573, 3] smbd/process.c:1467(switch_message)
  3824. switch message SMBtrans (pid 31803) conn 0x88cef60
  3825. [2013/09/13 10:57:21.876631, 3] smbd/ipc.c:560(handle_trans)
  3826. trans <\PIPE\> data=76 params=0 setup=2
  3827. [2013/09/13 10:57:21.876687, 3] smbd/ipc.c:511(named_pipe)
  3828. named pipe command on <> name
  3829. [2013/09/13 10:57:21.876737, 3] smbd/ipc.c:475(api_fd_reply)
  3830. Got API command 0x26 on pipe "samr" (pnum 2dbc)
  3831. [2013/09/13 10:57:21.876800, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3832. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  3833. [2013/09/13 10:57:21.876894, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3834. free_pipe_context: destroying talloc pool of size 1005
  3835. [2013/09/13 10:57:21.877608, 3] smbd/process.c:1662(process_smb)
  3836. Transaction 30 of length 172 (0 toread)
  3837. [2013/09/13 10:57:21.877672, 3] smbd/process.c:1467(switch_message)
  3838. switch message SMBtrans (pid 31803) conn 0x88cef60
  3839. [2013/09/13 10:57:21.877731, 3] smbd/ipc.c:560(handle_trans)
  3840. trans <\PIPE\> data=84 params=0 setup=2
  3841. [2013/09/13 10:57:21.877787, 3] smbd/ipc.c:511(named_pipe)
  3842. named pipe command on <> name
  3843. [2013/09/13 10:57:21.877837, 3] smbd/ipc.c:475(api_fd_reply)
  3844. Got API command 0x26 on pipe "samr" (pnum 2dbc)
  3845. [2013/09/13 10:57:21.877901, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3846. api_rpcTNP: rpc command: SAMR_CREATEUSER2
  3847. [2013/09/13 10:57:21.878797, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  3848. init_sam_from_ldap: Entry found for user: crw7c$
  3849. [2013/09/13 10:57:21.880619, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3850. free_pipe_context: destroying talloc pool of size 21
  3851. [2013/09/13 10:57:21.881345, 3] smbd/process.c:1662(process_smb)
  3852. Transaction 31 of length 132 (0 toread)
  3853. [2013/09/13 10:57:21.881412, 3] smbd/process.c:1467(switch_message)
  3854. switch message SMBtrans (pid 31803) conn 0x88cef60
  3855. [2013/09/13 10:57:21.881491, 3] smbd/ipc.c:560(handle_trans)
  3856. trans <\PIPE\> data=44 params=0 setup=2
  3857. [2013/09/13 10:57:21.881549, 3] smbd/ipc.c:511(named_pipe)
  3858. named pipe command on <> name
  3859. [2013/09/13 10:57:21.881600, 3] smbd/ipc.c:475(api_fd_reply)
  3860. Got API command 0x26 on pipe "samr" (pnum 2dbc)
  3861. [2013/09/13 10:57:21.881664, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3862. api_rpcTNP: rpc command: SAMR_CLOSE
  3863. [2013/09/13 10:57:21.881731, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3864. Closed policy
  3865. [2013/09/13 10:57:21.881806, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3866. free_pipe_context: destroying talloc pool of size 21
  3867. [2013/09/13 10:57:21.882470, 3] smbd/process.c:1662(process_smb)
  3868. Transaction 32 of length 132 (0 toread)
  3869. [2013/09/13 10:57:21.882535, 3] smbd/process.c:1467(switch_message)
  3870. switch message SMBtrans (pid 31803) conn 0x88cef60
  3871. [2013/09/13 10:57:21.882593, 3] smbd/ipc.c:560(handle_trans)
  3872. trans <\PIPE\> data=44 params=0 setup=2
  3873. [2013/09/13 10:57:21.882648, 3] smbd/ipc.c:511(named_pipe)
  3874. named pipe command on <> name
  3875. [2013/09/13 10:57:21.882698, 3] smbd/ipc.c:475(api_fd_reply)
  3876. Got API command 0x26 on pipe "samr" (pnum 2dbc)
  3877. [2013/09/13 10:57:21.882761, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3878. api_rpcTNP: rpc command: SAMR_CLOSE
  3879. [2013/09/13 10:57:21.882816, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  3880. Closed policy
  3881. [2013/09/13 10:57:21.882890, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3882. free_pipe_context: destroying talloc pool of size 21
  3883. [2013/09/13 10:57:21.883619, 3] smbd/process.c:1662(process_smb)
  3884. Transaction 33 of length 45 (0 toread)
  3885. [2013/09/13 10:57:21.883683, 3] smbd/process.c:1467(switch_message)
  3886. switch message SMBclose (pid 31803) conn 0x88cef60
  3887. [2013/09/13 10:57:21.883737, 3] smbd/reply.c:4848(reply_close)
  3888. close fd=-1 fnum=11708 (numopen=1)
  3889. [2013/09/13 10:57:21.884916, 3] smbd/process.c:1662(process_smb)
  3890. Transaction 34 of length 100 (0 toread)
  3891. [2013/09/13 10:57:21.884997, 3] smbd/process.c:1467(switch_message)
  3892. switch message SMBntcreateX (pid 31803) conn 0x88cef60
  3893. [2013/09/13 10:57:21.885723, 3] smbd/process.c:1662(process_smb)
  3894. Transaction 35 of length 76 (0 toread)
  3895. [2013/09/13 10:57:21.885794, 3] smbd/process.c:1467(switch_message)
  3896. switch message SMBtrans2 (pid 31803) conn 0x88cef60
  3897. [2013/09/13 10:57:21.886810, 3] smbd/process.c:1662(process_smb)
  3898. Transaction 36 of length 184 (0 toread)
  3899. [2013/09/13 10:57:21.886875, 3] smbd/process.c:1467(switch_message)
  3900. switch message SMBwriteX (pid 31803) conn 0x88cef60
  3901. [2013/09/13 10:57:21.886942, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  3902. api_pipe_bind_req: \PIPE\samr -> \PIPE\samr
  3903. [2013/09/13 10:57:21.886997, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  3904. check_bind_req for \samr
  3905. [2013/09/13 10:57:21.887051, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  3906. check_bind_req: \PIPE\samr -> \PIPE\samr
  3907. [2013/09/13 10:57:21.887126, 3] smbd/pipes.c:361(pipe_write_andx_done)
  3908. writeX-IPC nwritten=116
  3909. [2013/09/13 10:57:21.887955, 3] smbd/process.c:1662(process_smb)
  3910. Transaction 37 of length 63 (0 toread)
  3911. [2013/09/13 10:57:21.888019, 3] smbd/process.c:1467(switch_message)
  3912. switch message SMBreadX (pid 31803) conn 0x88cef60
  3913. [2013/09/13 10:57:21.888077, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3914. free_pipe_context: destroying talloc pool of size 21
  3915. [2013/09/13 10:57:21.888140, 3] smbd/pipes.c:485(pipe_read_andx_done)
  3916. readX-IPC min=1024 max=1024 nread=68
  3917. [2013/09/13 10:57:21.889027, 3] smbd/process.c:1662(process_smb)
  3918. Transaction 38 of length 160 (0 toread)
  3919. [2013/09/13 10:57:21.889108, 3] smbd/process.c:1467(switch_message)
  3920. switch message SMBtrans (pid 31803) conn 0x88cef60
  3921. [2013/09/13 10:57:21.889170, 3] smbd/ipc.c:560(handle_trans)
  3922. trans <\PIPE\> data=72 params=0 setup=2
  3923. [2013/09/13 10:57:21.889227, 3] smbd/ipc.c:511(named_pipe)
  3924. named pipe command on <> name
  3925. [2013/09/13 10:57:21.889278, 3] smbd/ipc.c:475(api_fd_reply)
  3926. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  3927. [2013/09/13 10:57:21.889358, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3928. api_rpcTNP: rpc command: SAMR_CONNECT5
  3929. [2013/09/13 10:57:21.889451, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3930. free_pipe_context: destroying talloc pool of size 1005
  3931. [2013/09/13 10:57:21.890242, 3] smbd/process.c:1662(process_smb)
  3932. Transaction 39 of length 164 (0 toread)
  3933. [2013/09/13 10:57:21.890324, 3] smbd/process.c:1467(switch_message)
  3934. switch message SMBtrans (pid 31803) conn 0x88cef60
  3935. [2013/09/13 10:57:21.890387, 3] smbd/ipc.c:560(handle_trans)
  3936. trans <\PIPE\> data=76 params=0 setup=2
  3937. [2013/09/13 10:57:21.890445, 3] smbd/ipc.c:511(named_pipe)
  3938. named pipe command on <> name
  3939. [2013/09/13 10:57:21.890500, 3] smbd/ipc.c:475(api_fd_reply)
  3940. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  3941. [2013/09/13 10:57:21.890566, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3942. api_rpcTNP: rpc command: SAMR_OPENDOMAIN
  3943. [2013/09/13 10:57:21.890655, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3944. free_pipe_context: destroying talloc pool of size 1005
  3945. [2013/09/13 10:57:21.891560, 3] smbd/process.c:1662(process_smb)
  3946. Transaction 40 of length 180 (0 toread)
  3947. [2013/09/13 10:57:21.891639, 3] smbd/process.c:1467(switch_message)
  3948. switch message SMBtrans (pid 31803) conn 0x88cef60
  3949. [2013/09/13 10:57:21.891701, 3] smbd/ipc.c:560(handle_trans)
  3950. trans <\PIPE\> data=92 params=0 setup=2
  3951. [2013/09/13 10:57:21.891758, 3] smbd/ipc.c:511(named_pipe)
  3952. named pipe command on <> name
  3953. [2013/09/13 10:57:21.891810, 3] smbd/ipc.c:475(api_fd_reply)
  3954. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  3955. [2013/09/13 10:57:21.891874, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3956. api_rpcTNP: rpc command: SAMR_LOOKUPNAMES
  3957. [2013/09/13 10:57:21.892551, 2] passdb/pdb_ldap.c:553(init_sam_from_ldap)
  3958. init_sam_from_ldap: Entry found for user: crw7c$
  3959. [2013/09/13 10:57:21.894317, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3960. free_pipe_context: destroying talloc pool of size 33
  3961. [2013/09/13 10:57:21.895095, 3] smbd/process.c:1662(process_smb)
  3962. Transaction 41 of length 140 (0 toread)
  3963. [2013/09/13 10:57:21.895163, 3] smbd/process.c:1467(switch_message)
  3964. switch message SMBtrans (pid 31803) conn 0x88cef60
  3965. [2013/09/13 10:57:21.895222, 3] smbd/ipc.c:560(handle_trans)
  3966. trans <\PIPE\> data=52 params=0 setup=2
  3967. [2013/09/13 10:57:21.895278, 3] smbd/ipc.c:511(named_pipe)
  3968. named pipe command on <> name
  3969. [2013/09/13 10:57:21.895329, 3] smbd/ipc.c:475(api_fd_reply)
  3970. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  3971. [2013/09/13 10:57:21.895393, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3972. api_rpcTNP: rpc command: SAMR_OPENUSER
  3973. [2013/09/13 10:57:21.895624, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3974. free_pipe_context: destroying talloc pool of size 1237
  3975. [2013/09/13 10:57:21.896290, 3] smbd/process.c:1662(process_smb)
  3976. Transaction 42 of length 134 (0 toread)
  3977. [2013/09/13 10:57:21.896355, 3] smbd/process.c:1467(switch_message)
  3978. switch message SMBtrans (pid 31803) conn 0x88cef60
  3979. [2013/09/13 10:57:21.896413, 3] smbd/ipc.c:560(handle_trans)
  3980. trans <\PIPE\> data=46 params=0 setup=2
  3981. [2013/09/13 10:57:21.896469, 3] smbd/ipc.c:511(named_pipe)
  3982. named pipe command on <> name
  3983. [2013/09/13 10:57:21.896526, 3] smbd/ipc.c:475(api_fd_reply)
  3984. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  3985. [2013/09/13 10:57:21.896590, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  3986. api_rpcTNP: rpc command: SAMR_QUERYUSERINFO
  3987. [2013/09/13 10:57:21.896779, 3] rpc_server/samr/srv_samr_nt.c:3011(_samr_QueryUserInfo)
  3988. User:[crw7c$]
  3989. [2013/09/13 10:57:21.896879, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  3990. free_pipe_context: destroying talloc pool of size 749
  3991. [2013/09/13 10:57:21.897533, 3] smbd/process.c:1662(process_smb)
  3992. Transaction 43 of length 132 (0 toread)
  3993. [2013/09/13 10:57:21.897598, 3] smbd/process.c:1467(switch_message)
  3994. switch message SMBtrans (pid 31803) conn 0x88cef60
  3995. [2013/09/13 10:57:21.897656, 3] smbd/ipc.c:560(handle_trans)
  3996. trans <\PIPE\> data=44 params=0 setup=2
  3997. [2013/09/13 10:57:21.897711, 3] smbd/ipc.c:511(named_pipe)
  3998. named pipe command on <> name
  3999. [2013/09/13 10:57:21.897775, 3] smbd/ipc.c:475(api_fd_reply)
  4000. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  4001. [2013/09/13 10:57:21.897841, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  4002. api_rpcTNP: rpc command: SAMR_GETUSERPWINFO
  4003. [2013/09/13 10:57:21.898657, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4004. free_pipe_context: destroying talloc pool of size 21
  4005. [2013/09/13 10:57:21.899696, 3] smbd/process.c:1662(process_smb)
  4006. Transaction 44 of length 669 (0 toread)
  4007. [2013/09/13 10:57:21.899762, 3] smbd/process.c:1467(switch_message)
  4008. switch message SMBtrans (pid 31803) conn 0x88cef60
  4009. [2013/09/13 10:57:21.899822, 3] smbd/ipc.c:560(handle_trans)
  4010. trans <\PIPE\> data=581 params=0 setup=2
  4011. [2013/09/13 10:57:21.899878, 3] smbd/ipc.c:511(named_pipe)
  4012. named pipe command on <> name
  4013. [2013/09/13 10:57:21.899928, 3] smbd/ipc.c:475(api_fd_reply)
  4014. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  4015. [2013/09/13 10:57:21.899994, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  4016. api_rpcTNP: rpc command: SAMR_SETUSERINFO2
  4017. [2013/09/13 10:57:21.900919, 2] passdb/pdb_ldap.c:1180(init_ldap_from_sam)
  4018. init_ldap_from_sam: Setting entry for user: crw7c$
  4019. [2013/09/13 10:57:22.019189, 2] passdb/pdb_ldap.c:2042(ldapsam_update_sam_account)
  4020. ldapsam_update_sam_account: successfully modified uid = crw7c$ in the LDAP database
  4021. [2013/09/13 10:57:22.019364, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4022. free_pipe_context: destroying talloc pool of size 21
  4023. [2013/09/13 10:57:22.020539, 3] smbd/process.c:1662(process_smb)
  4024. Transaction 45 of length 132 (0 toread)
  4025. [2013/09/13 10:57:22.020634, 3] smbd/process.c:1467(switch_message)
  4026. switch message SMBtrans (pid 31803) conn 0x88cef60
  4027. [2013/09/13 10:57:22.020700, 3] smbd/ipc.c:560(handle_trans)
  4028. trans <\PIPE\> data=44 params=0 setup=2
  4029. [2013/09/13 10:57:22.020759, 3] smbd/ipc.c:511(named_pipe)
  4030. named pipe command on <> name
  4031. [2013/09/13 10:57:22.020811, 3] smbd/ipc.c:475(api_fd_reply)
  4032. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  4033. [2013/09/13 10:57:22.020880, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  4034. api_rpcTNP: rpc command: SAMR_CLOSE
  4035. [2013/09/13 10:57:22.020938, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  4036. Closed policy
  4037. [2013/09/13 10:57:22.021016, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4038. free_pipe_context: destroying talloc pool of size 21
  4039. [2013/09/13 10:57:22.021688, 3] smbd/process.c:1662(process_smb)
  4040. Transaction 46 of length 132 (0 toread)
  4041. [2013/09/13 10:57:22.021768, 3] smbd/process.c:1467(switch_message)
  4042. switch message SMBtrans (pid 31803) conn 0x88cef60
  4043. [2013/09/13 10:57:22.021831, 3] smbd/ipc.c:560(handle_trans)
  4044. trans <\PIPE\> data=44 params=0 setup=2
  4045. [2013/09/13 10:57:22.021889, 3] smbd/ipc.c:511(named_pipe)
  4046. named pipe command on <> name
  4047. [2013/09/13 10:57:22.021941, 3] smbd/ipc.c:475(api_fd_reply)
  4048. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  4049. [2013/09/13 10:57:22.0.sn., 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  4050. api_rpcTNP: rpc command: SAMR_CLOSE
  4051. [2013/09/13 10:57:22.022061, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  4052. Closed policy
  4053. [2013/09/13 10:57:22.022138, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4054. free_pipe_context: destroying talloc pool of size 21
  4055. [2013/09/13 10:57:22.022867, 3] smbd/process.c:1662(process_smb)
  4056. Transaction 47 of length 132 (0 toread)
  4057. [2013/09/13 10:57:22.022933, 3] smbd/process.c:1467(switch_message)
  4058. switch message SMBtrans (pid 31803) conn 0x88cef60
  4059. [2013/09/13 10:57:22.022991, 3] smbd/ipc.c:560(handle_trans)
  4060. trans <\PIPE\> data=44 params=0 setup=2
  4061. [2013/09/13 10:57:22.023046, 3] smbd/ipc.c:511(named_pipe)
  4062. named pipe command on <> name
  4063. [2013/09/13 10:57:22.023097, 3] smbd/ipc.c:475(api_fd_reply)
  4064. Got API command 0x26 on pipe "samr" (pnum 2dbd)
  4065. [2013/09/13 10:57:22.023159, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  4066. api_rpcTNP: rpc command: SAMR_CLOSE
  4067. [2013/09/13 10:57:22.023214, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  4068. Closed policy
  4069. [2013/09/13 10:57:22.023288, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4070. free_pipe_context: destroying talloc pool of size 21
  4071. [2013/09/13 10:57:22.023980, 3] smbd/process.c:1662(process_smb)
  4072. Transaction 48 of length 45 (0 toread)
  4073. [2013/09/13 10:57:22.024045, 3] smbd/process.c:1467(switch_message)
  4074. switch message SMBclose (pid 31803) conn 0x88cef60
  4075. [2013/09/13 10:57:22.024101, 3] smbd/reply.c:4848(reply_close)
  4076. close fd=-1 fnum=11709 (numopen=1)
  4077. [2013/09/13 10:57:22.033020, 3] smbd/process.c:1662(process_smb)
  4078. Transaction 49 of length 108 (0 toread)
  4079. [2013/09/13 10:57:22.033101, 3] smbd/process.c:1467(switch_message)
  4080. switch message SMBntcreateX (pid 31803) conn 0x88cef60
  4081. [2013/09/13 10:57:22.033907, 3] smbd/process.c:1662(process_smb)
  4082. Transaction 50 of length 76 (0 toread)
  4083. [2013/09/13 10:57:22.033975, 3] smbd/process.c:1467(switch_message)
  4084. switch message SMBtrans2 (pid 31803) conn 0x88cef60
  4085. [2013/09/13 10:57:22.034880, 3] smbd/process.c:1662(process_smb)
  4086. Transaction 51 of length 184 (0 toread)
  4087. [2013/09/13 10:57:22.034946, 3] smbd/process.c:1467(switch_message)
  4088. switch message SMBwriteX (pid 31803) conn 0x88cef60
  4089. [2013/09/13 10:57:22.035014, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  4090. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  4091. [2013/09/13 10:57:22.035070, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  4092. check_bind_req for \netlogon
  4093. [2013/09/13 10:57:22.035125, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  4094. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  4095. [2013/09/13 10:57:22.035202, 3] smbd/pipes.c:361(pipe_write_andx_done)
  4096. writeX-IPC nwritten=116
  4097. [2013/09/13 10:57:22.035950, 3] smbd/process.c:1662(process_smb)
  4098. Transaction 52 of length 63 (0 toread)
  4099. [2013/09/13 10:57:22.036014, 3] smbd/process.c:1467(switch_message)
  4100. switch message SMBreadX (pid 31803) conn 0x88cef60
  4101. [2013/09/13 10:57:22.036072, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4102. free_pipe_context: destroying talloc pool of size 25
  4103. [2013/09/13 10:57:22.036136, 3] smbd/pipes.c:485(pipe_read_andx_done)
  4104. readX-IPC min=1024 max=1024 nread=72
  4105. [2013/09/13 10:57:22.036945, 3] smbd/process.c:1662(process_smb)
  4106. Transaction 53 of length 148 (0 toread)
  4107. [2013/09/13 10:57:22.037027, 3] smbd/process.c:1467(switch_message)
  4108. switch message SMBtrans (pid 31803) conn 0x88cef60
  4109. [2013/09/13 10:57:22.037089, 3] smbd/ipc.c:560(handle_trans)
  4110. trans <\PIPE\> data=60 params=0 setup=2
  4111. [2013/09/13 10:57:22.037147, 3] smbd/ipc.c:511(named_pipe)
  4112. named pipe command on <> name
  4113. [2013/09/13 10:57:22.037199, 3] smbd/ipc.c:475(api_fd_reply)
  4114. Got API command 0x26 on pipe "NETLOGON" (pnum 2dbe)
  4115. [2013/09/13 10:57:22.037264, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  4116. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  4117. [2013/09/13 10:57:22.037364, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4118. free_pipe_context: destroying talloc pool of size 29
  4119. [2013/09/13 10:57:22.038055, 3] smbd/process.c:1662(process_smb)
  4120. Transaction 54 of length 45 (0 toread)
  4121. [2013/09/13 10:57:22.038122, 3] smbd/process.c:1467(switch_message)
  4122. switch message SMBclose (pid 31803) conn 0x88cef60
  4123. [2013/09/13 10:57:22.038177, 3] smbd/reply.c:4848(reply_close)
  4124. close fd=-1 fnum=11710 (numopen=1)
  4125. [2013/09/13 10:57:22.039273, 3] smbd/process.c:1662(process_smb)
  4126. Transaction 55 of length 108 (0 toread)
  4127. [2013/09/13 10:57:22.039338, 3] smbd/process.c:1467(switch_message)
  4128. switch message SMBntcreateX (pid 31803) conn 0x88cef60
  4129. [2013/09/13 10:57:22.040078, 3] smbd/process.c:1662(process_smb)
  4130. Transaction 56 of length 76 (0 toread)
  4131. [2013/09/13 10:57:22.040145, 3] smbd/process.c:1467(switch_message)
  4132. switch message SMBtrans2 (pid 31803) conn 0x88cef60
  4133. [2013/09/13 10:57:22.041036, 3] smbd/process.c:1662(process_smb)
  4134. Transaction 57 of length 184 (0 toread)
  4135. [2013/09/13 10:57:22.041100, 3] smbd/process.c:1467(switch_message)
  4136. switch message SMBwriteX (pid 31803) conn 0x88cef60
  4137. [2013/09/13 10:57:22.041167, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  4138. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  4139. [2013/09/13 10:57:22.041223, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  4140. check_bind_req for \netlogon
  4141. [2013/09/13 10:57:22.041276, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  4142. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  4143. [2013/09/13 10:57:22.041370, 3] smbd/pipes.c:361(pipe_write_andx_done)
  4144. writeX-IPC nwritten=116
  4145. [2013/09/13 10:57:22.042121, 3] smbd/process.c:1662(process_smb)
  4146. Transaction 58 of length 63 (0 toread)
  4147. [2013/09/13 10:57:22.042204, 3] smbd/process.c:1467(switch_message)
  4148. switch message SMBreadX (pid 31803) conn 0x88cef60
  4149. [2013/09/13 10:57:22.042267, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4150. free_pipe_context: destroying talloc pool of size 25
  4151. [2013/09/13 10:57:22.042333, 3] smbd/pipes.c:485(pipe_read_andx_done)
  4152. readX-IPC min=1024 max=1024 nread=72
  4153. [2013/09/13 10:57:22.043540, 3] smbd/process.c:1662(process_smb)
  4154. Transaction 59 of length 148 (0 toread)
  4155. [2013/09/13 10:57:22.043620, 3] smbd/process.c:1467(switch_message)
  4156. switch message SMBtrans (pid 31803) conn 0x88cef60
  4157. [2013/09/13 10:57:22.043683, 3] smbd/ipc.c:560(handle_trans)
  4158. trans <\PIPE\> data=60 params=0 setup=2
  4159. [2013/09/13 10:57:22.043741, 3] smbd/ipc.c:511(named_pipe)
  4160. named pipe command on <> name
  4161. [2013/09/13 10:57:22.043792, 3] smbd/ipc.c:475(api_fd_reply)
  4162. Got API command 0x26 on pipe "NETLOGON" (pnum 2dbf)
  4163. [2013/09/13 10:57:22.043857, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  4164. api_rpcTNP: rpc command: NETR_DSRENUMERATEDOMAINTRUSTS
  4165. [2013/09/13 10:57:22.043938, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4166. free_pipe_context: destroying talloc pool of size 29
  4167. [2013/09/13 10:57:22.044735, 3] smbd/process.c:1662(process_smb)
  4168. Transaction 60 of length 45 (0 toread)
  4169. [2013/09/13 10:57:22.044816, 3] smbd/process.c:1467(switch_message)
  4170. switch message SMBclose (pid 31803) conn 0x88cef60
  4171. [2013/09/13 10:57:22.044875, 3] smbd/reply.c:4848(reply_close)
  4172. close fd=-1 fnum=11711 (numopen=1)
  4173. [2013/09/13 10:57:22.045926, 3] smbd/process.c:1662(process_smb)
  4174. Transaction 61 of length 108 (0 toread)
  4175. [2013/09/13 10:57:22.045993, 3] smbd/process.c:1467(switch_message)
  4176. switch message SMBntcreateX (pid 31803) conn 0x88cef60
  4177. [2013/09/13 10:57:22.046647, 3] smbd/process.c:1662(process_smb)
  4178. Transaction 62 of length 76 (0 toread)
  4179. [2013/09/13 10:57:22.046714, 3] smbd/process.c:1467(switch_message)
  4180. switch message SMBtrans2 (pid 31803) conn 0x88cef60
  4181. [2013/09/13 10:57:22.047497, 3] smbd/process.c:1662(process_smb)
  4182. Transaction 63 of length 184 (0 toread)
  4183. [2013/09/13 10:57:22.047562, 3] smbd/process.c:1467(switch_message)
  4184. switch message SMBwriteX (pid 31803) conn 0x88cef60
  4185. [2013/09/13 10:57:22.047629, 3] rpc_server/srv_pipe.c:889(api_pipe_bind_req)
  4186. api_pipe_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  4187. [2013/09/13 10:57:22.047685, 3] rpc_server/srv_pipe.c:339(check_bind_req)
  4188. check_bind_req for \netlogon
  4189. [2013/09/13 10:57:22.047739, 3] rpc_server/srv_pipe.c:346(check_bind_req)
  4190. check_bind_req: \PIPE\netlogon -> \PIPE\netlogon
  4191. [2013/09/13 10:57:22.047816, 3] smbd/pipes.c:361(pipe_write_andx_done)
  4192. writeX-IPC nwritten=116
  4193. [2013/09/13 10:57:22.048553, 3] smbd/process.c:1662(process_smb)
  4194. Transaction 64 of length 63 (0 toread)
  4195. [2013/09/13 10:57:22.048635, 3] smbd/process.c:1467(switch_message)
  4196. switch message SMBreadX (pid 31803) conn 0x88cef60
  4197. [2013/09/13 10:57:22.048697, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4198. free_pipe_context: destroying talloc pool of size 25
  4199. [2013/09/13 10:57:22.048763, 3] smbd/pipes.c:485(pipe_read_andx_done)
  4200. readX-IPC min=1024 max=1024 nread=72
  4201. [2013/09/13 10:57:22.049579, 3] smbd/process.c:1662(process_smb)
  4202. Transaction 65 of length 144 (0 toread)
  4203. [2013/09/13 10:57:22.049659, 3] smbd/process.c:1467(switch_message)
  4204. switch message SMBtrans (pid 31803) conn 0x88cef60
  4205. [2013/09/13 10:57:22.049722, 3] smbd/ipc.c:560(handle_trans)
  4206. trans <\PIPE\> data=56 params=0 setup=2
  4207. [2013/09/13 10:57:22.049779, 3] smbd/ipc.c:511(named_pipe)
  4208. named pipe command on <> name
  4209. [2013/09/13 10:57:22.049831, 3] smbd/ipc.c:475(api_fd_reply)
  4210. Got API command 0x26 on pipe "NETLOGON" (pnum 2dc0)
  4211. [2013/09/13 10:57:22.049896, 3] rpc_server/srv_pipe.c:1626(api_rpcTNP)
  4212. api_rpcTNP: rpc command: NETR_NETRENUMERATETRUSTEDDOMAINS
  4213. [2013/09/13 10:57:22.050575, 3] rpc_server/rpc_handles.c:281(close_policy_hnd)
  4214. Closed policy
  4215. [2013/09/13 10:57:22.050692, 3] rpc_server/srv_pipe_hnd.c:121(free_pipe_context)
  4216. free_pipe_context: destroying talloc pool of size 1498
  4217. [2013/09/13 10:57:22.051631, 3] smbd/process.c:1662(process_smb)
  4218. Transaction 66 of length 45 (0 toread)
  4219. [2013/09/13 10:57:22.051698, 3] smbd/process.c:1467(switch_message)
  4220. switch message SMBclose (pid 31803) conn 0x88cef60
  4221. [2013/09/13 10:57:22.051754, 3] smbd/reply.c:4848(reply_close)
  4222. close fd=-1 fnum=11712 (numopen=1)
  4223. [2013/09/13 10:57:34.501867, 3] smbd/process.c:1662(process_smb)
  4224. Transaction 67 of length 39 (0 toread)
  4225. [2013/09/13 10:57:34.501984, 3] smbd/process.c:1467(switch_message)
  4226. switch message SMBtdis (pid 31803) conn 0x88cef60
  4227. [2013/09/13 10:57:34.502064, 3] smbd/service.c:1378(close_cnum)
  4228. crw7c (192.168.sn.89) closed connection to service IPC$
  4229. [2013/09/13 10:57:34.502130, 3] smbd/connection.c:35(yield_connection)
  4230. Yielding connection to IPC$
  4231. [2013/09/13 10:57:34.502834, 3] smbd/process.c:1662(process_smb)
  4232. Transaction 68 of length 43 (0 toread)
  4233. [2013/09/13 10:57:34.502902, 3] smbd/process.c:1467(switch_message)
  4234. switch message SMBulogoffX (pid 31803) conn 0x0
  4235. [2013/09/13 10:57:34.502995, 3] smbd/reply.c:2096(reply_ulogoffX)
  4236. ulogoffX vuid=100
  4237. [2013/09/13 10:57:34.503633, 1] smbd/process.c:457(receive_smb_talloc)
  4238. receive_smb_raw_talloc failed for client 192.168.sn.89 read error = NT_STATUS_CONNECTION_RESET.
  4239. [2013/09/13 10:57:34.503800, 3] smbd/server_exit.c:181(exit_server_common)
  4240. Server exit (failed to receive smb request)
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!