source/rpcclient/cmd_lsarpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC pipe client
   4
   5    Copyright (C) Tim Potter              2000
   6    Copyright (C) Rafal Szczesniak        2002
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpcclient.h"
  25
  26
  27 /* useful function to allow entering a name instead of a SID and
  28  * looking it up automatically */
  29 static NTSTATUS name_to_sid(struct cli_state *cli,
  30                             TALLOC_CTX *mem_ctx,
  31                             DOM_SID *sid, const char *name)
  32 {
  33         POLICY_HND pol;
  34         uint32 *sid_types;
  35         NTSTATUS result;
  36         DOM_SID *sids;
  37
  38         /* maybe its a raw SID */
  39         if (strncmp(name, "S-", 2) == 0 &&
  40             string_to_sid(sid, name)) {
  41                 return NT_STATUS_OK;
  42         }
  43
  44         result = cli_lsa_open_policy(cli, mem_ctx, True,
  45                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
  46                                      &pol);
  47         if (!NT_STATUS_IS_OK(result))
  48                 goto done;
  49
  50         result = cli_lsa_lookup_names(cli, mem_ctx, &pol, 1, &name, &sids, &sid_types);
  51         if (!NT_STATUS_IS_OK(result))
  52                 goto done;
  53
  54         cli_lsa_close(cli, mem_ctx, &pol);
  55
  56         *sid = sids[0];
  57
  58 done:
  59         return result;
  60 }
  61
  62
  63 /* Look up domain related information on a remote host */
  64
  65 static NTSTATUS cmd_lsa_query_info_policy(struct cli_state *cli,
  66                                           TALLOC_CTX *mem_ctx, int argc,
  67                                           const char **argv)
  68 {
  69         POLICY_HND pol;
  70         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  71         DOM_SID *dom_sid;
  72         struct uuid *dom_guid;
  73         fstring sid_str;
  74         char *domain_name = NULL;
  75         char *dns_name = NULL;
  76         char *forest_name = NULL;
  77
  78         uint32 info_class = 3;
  79
  80         if (argc > 2) {
  81                 printf("Usage: %s [info_class]\n", argv[0]);
  82                 return NT_STATUS_OK;
  83         }
  84
  85         if (argc == 2)
  86                 info_class = atoi(argv[1]);
  87
  88         /* Lookup info policy */
  89         switch (info_class) {
  90         case 12:
  91                 result = cli_lsa_open_policy2(cli, mem_ctx, True,
  92                                              SEC_RIGHTS_MAXIMUM_ALLOWED,
  93                                              &pol);
  94
  95                 if (!NT_STATUS_IS_OK(result))
  96                         goto done;
  97                 result = cli_lsa_query_info_policy2(cli, mem_ctx, &pol,
  98                                                     info_class, &domain_name,
  99                                                     &dns_name, &forest_name,
 100                                                     &dom_guid, &dom_sid);
 101                 break;
 102         default:
 103                 result = cli_lsa_open_policy(cli, mem_ctx, True,
 104                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 105                                      &pol);
 106
 107                 if (!NT_STATUS_IS_OK(result))
 108                         goto done;
 109                 result = cli_lsa_query_info_policy(cli, mem_ctx, &pol,
 110                                                    info_class, &domain_name,
 111                                                    &dom_sid);
 112         }
 113
 114         if (!NT_STATUS_IS_OK(result))
 115                 goto done;
 116
 117         sid_to_string(sid_str, dom_sid);
 118
 119         if (domain_name)
 120                 printf("domain %s has sid %s\n", domain_name, sid_str);
 121         else
 122                 printf("could not query info for level %d\n", info_class);
 123
 124         if (dns_name)
 125                 printf("domain dns name is %s\n", dns_name);
 126         if (forest_name)
 127                 printf("forest name is %s\n", forest_name);
 128
 129         if (info_class == 12) {
 130                 printf("domain GUID is ");
 131                 smb_uuid_string_static(*dom_guid);
 132         }
 133  done:
 134         return result;
 135 }
 136
 137 /* Resolve a list of names to a list of sids */
 138
 139 static NTSTATUS cmd_lsa_lookup_names(struct cli_state *cli,
 140                                      TALLOC_CTX *mem_ctx, int argc,
 141                                      const char **argv)
 142 {
 143         POLICY_HND pol;
 144         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 145         DOM_SID *sids;
 146         uint32 *types;
 147         int i;
 148
 149         if (argc == 1) {
 150                 printf("Usage: %s [name1 [name2 [...]]]\n", argv[0]);
 151                 return NT_STATUS_OK;
 152         }
 153
 154         result = cli_lsa_open_policy(cli, mem_ctx, True,
 155                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 156                                      &pol);
 157
 158         if (!NT_STATUS_IS_OK(result))
 159                 goto done;
 160
 161         result = cli_lsa_lookup_names(cli, mem_ctx, &pol, argc - 1,
 162                                       (const char**)(argv + 1), &sids, &types);
 163
 164         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 165             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 166                 goto done;
 167
 168         result = NT_STATUS_OK;
 169
 170         /* Print results */
 171
 172         for (i = 0; i < (argc - 1); i++) {
 173                 fstring sid_str;
 174                 sid_to_string(sid_str, &sids[i]);
 175                 printf("%s %s (%s: %d)\n", argv[i + 1], sid_str,
 176                        sid_type_lookup(types[i]), types[i]);
 177         }
 178
 179  done:
 180         return result;
 181 }
 182
 183 /* Resolve a list of SIDs to a list of names */
 184
 185 static NTSTATUS cmd_lsa_lookup_sids(struct cli_state *cli, TALLOC_CTX *mem_ctx,
 186                                     int argc, const char **argv)
 187 {
 188         POLICY_HND pol;
 189         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 190         DOM_SID *sids;
 191         char **domains;
 192         char **names;
 193         uint32 *types;
 194         int i;
 195
 196         if (argc == 1) {
 197                 printf("Usage: %s [sid1 [sid2 [...]]]\n", argv[0]);
 198                 return NT_STATUS_OK;
 199         }
 200
 201         result = cli_lsa_open_policy(cli, mem_ctx, True,
 202                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 203                                      &pol);
 204
 205         if (!NT_STATUS_IS_OK(result))
 206                 goto done;
 207
 208         /* Convert arguments to sids */
 209
 210         sids = TALLOC_ARRAY(mem_ctx, DOM_SID, argc - 1);
 211
 212         if (!sids) {
 213                 printf("could not allocate memory for %d sids\n", argc - 1);
 214                 goto done;
 215         }
 216
 217         for (i = 0; i < argc - 1; i++)
 218                 if (!string_to_sid(&sids[i], argv[i + 1])) {
 219                         result = NT_STATUS_INVALID_SID;
 220                         goto done;
 221                 }
 222
 223         /* Lookup the SIDs */
 224
 225         result = cli_lsa_lookup_sids(cli, mem_ctx, &pol, argc - 1, sids,
 226                                      &domains, &names, &types);
 227
 228         if (!NT_STATUS_IS_OK(result) && NT_STATUS_V(result) !=
 229             NT_STATUS_V(STATUS_SOME_UNMAPPED))
 230                 goto done;
 231
 232         result = NT_STATUS_OK;
 233
 234         /* Print results */
 235
 236         for (i = 0; i < (argc - 1); i++) {
 237                 fstring sid_str;
 238
 239                 sid_to_string(sid_str, &sids[i]);
 240                 printf("%s %s\\%s (%d)\n", sid_str,
 241                        domains[i] ? domains[i] : "*unknown*",
 242                        names[i] ? names[i] : "*unknown*", types[i]);
 243         }
 244
 245  done:
 246         return result;
 247 }
 248
 249 /* Enumerate list of trusted domains */
 250
 251 static NTSTATUS cmd_lsa_enum_trust_dom(struct cli_state *cli,
 252                                        TALLOC_CTX *mem_ctx, int argc,
 253                                        const char **argv)
 254 {
 255         POLICY_HND pol;
 256         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 257         DOM_SID *domain_sids;
 258         char **domain_names;
 259
 260         /* defaults, but may be changed using params */
 261         uint32 enum_ctx = 0;
 262         uint32 num_domains = 0;
 263         int i;
 264
 265         if (argc > 2) {
 266                 printf("Usage: %s [enum context (0)]\n", argv[0]);
 267                 return NT_STATUS_OK;
 268         }
 269
 270         if (argc == 2 && argv[1]) {
 271                 enum_ctx = atoi(argv[2]);
 272         }
 273
 274         result = cli_lsa_open_policy(cli, mem_ctx, True,
 275                                      POLICY_VIEW_LOCAL_INFORMATION,
 276                                      &pol);
 277
 278         if (!NT_STATUS_IS_OK(result))
 279                 goto done;
 280
 281         /* Lookup list of trusted domains */
 282
 283         result = cli_lsa_enum_trust_dom(cli, mem_ctx, &pol, &enum_ctx,
 284                                         &num_domains,
 285                                         &domain_names, &domain_sids);
 286         if (!NT_STATUS_IS_OK(result) &&
 287             !NT_STATUS_EQUAL(result, NT_STATUS_NO_MORE_ENTRIES) &&
 288             !NT_STATUS_EQUAL(result, STATUS_MORE_ENTRIES))
 289             goto done;
 290
 291         /* Print results: list of names and sids returned in this response. */
 292         for (i = 0; i < num_domains; i++) {
 293                 fstring sid_str;
 294
 295                 sid_to_string(sid_str, &domain_sids[i]);
 296                 printf("%s %s\n", domain_names[i] ? domain_names[i] :
 297                        "*unknown*", sid_str);
 298         }
 299
 300  done:
 301         return result;
 302 }
 303
 304 /* Enumerates privileges */
 305
 306 static NTSTATUS cmd_lsa_enum_privilege(struct cli_state *cli,
 307                                        TALLOC_CTX *mem_ctx, int argc,
 308                                        const char **argv)
 309 {
 310         POLICY_HND pol;
 311         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 312
 313         uint32 enum_context=0;
 314         uint32 pref_max_length=0x1000;
 315         uint32 count=0;
 316         char   **privs_name;
 317         uint32 *privs_high;
 318         uint32 *privs_low;
 319         int i;
 320
 321         if (argc > 3) {
 322                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 323                 return NT_STATUS_OK;
 324         }
 325
 326         if (argc>=2)
 327                 enum_context=atoi(argv[1]);
 328
 329         if (argc==3)
 330                 pref_max_length=atoi(argv[2]);
 331
 332         result = cli_lsa_open_policy(cli, mem_ctx, True,
 333                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 334                                      &pol);
 335
 336         if (!NT_STATUS_IS_OK(result))
 337                 goto done;
 338
 339         result = cli_lsa_enum_privilege(cli, mem_ctx, &pol, &enum_context, pref_max_length,
 340                                         &count, &privs_name, &privs_high, &privs_low);
 341
 342         if (!NT_STATUS_IS_OK(result))
 343                 goto done;
 344
 345         /* Print results */
 346         printf("found %d privileges\n\n", count);
 347
 348         for (i = 0; i < count; i++) {
 349                 printf("%s \t\t%d:%d (0x%x:0x%x)\n", privs_name[i] ? privs_name[i] : "*unknown*",
 350                        privs_high[i], privs_low[i], privs_high[i], privs_low[i]);
 351         }
 352
 353  done:
 354         return result;
 355 }
 356
 357 /* Get privilege name */
 358
 359 static NTSTATUS cmd_lsa_get_dispname(struct cli_state *cli,
 360                                      TALLOC_CTX *mem_ctx, int argc,
 361                                      const char **argv)
 362 {
 363         POLICY_HND pol;
 364         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 365
 366         uint16 lang_id=0;
 367         uint16 lang_id_sys=0;
 368         uint16 lang_id_desc;
 369         fstring description;
 370
 371         if (argc != 2) {
 372                 printf("Usage: %s privilege name\n", argv[0]);
 373                 return NT_STATUS_OK;
 374         }
 375
 376         result = cli_lsa_open_policy(cli, mem_ctx, True,
 377                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 378                                      &pol);
 379
 380         if (!NT_STATUS_IS_OK(result))
 381                 goto done;
 382
 383         result = cli_lsa_get_dispname(cli, mem_ctx, &pol, argv[1], lang_id, lang_id_sys, description, &lang_id_desc);
 384
 385         if (!NT_STATUS_IS_OK(result))
 386                 goto done;
 387
 388         /* Print results */
 389         printf("%s -> %s (language: 0x%x)\n", argv[1], description, lang_id_desc);
 390
 391  done:
 392         return result;
 393 }
 394
 395 /* Enumerate the LSA SIDS */
 396
 397 static NTSTATUS cmd_lsa_enum_sids(struct cli_state *cli,
 398                                   TALLOC_CTX *mem_ctx, int argc,
 399                                   const char **argv)
 400 {
 401         POLICY_HND pol;
 402         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 403
 404         uint32 enum_context=0;
 405         uint32 pref_max_length=0x1000;
 406         DOM_SID *sids;
 407         uint32 count=0;
 408         int i;
 409
 410         if (argc > 3) {
 411                 printf("Usage: %s [enum context] [max length]\n", argv[0]);
 412                 return NT_STATUS_OK;
 413         }
 414
 415         if (argc>=2)
 416                 enum_context=atoi(argv[1]);
 417
 418         if (argc==3)
 419                 pref_max_length=atoi(argv[2]);
 420
 421         result = cli_lsa_open_policy(cli, mem_ctx, True,
 422                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 423                                      &pol);
 424
 425         if (!NT_STATUS_IS_OK(result))
 426                 goto done;
 427
 428         result = cli_lsa_enum_sids(cli, mem_ctx, &pol, &enum_context, pref_max_length,
 429                                         &count, &sids);
 430
 431         if (!NT_STATUS_IS_OK(result))
 432                 goto done;
 433
 434         /* Print results */
 435         printf("found %d SIDs\n\n", count);
 436
 437         for (i = 0; i < count; i++) {
 438                 fstring sid_str;
 439
 440                 sid_to_string(sid_str, &sids[i]);
 441                 printf("%s\n", sid_str);
 442         }
 443
 444  done:
 445         return result;
 446 }
 447
 448 /* Create a new account */
 449
 450 static NTSTATUS cmd_lsa_create_account(struct cli_state *cli,
 451                                            TALLOC_CTX *mem_ctx, int argc,
 452                                            const char **argv)
 453 {
 454         POLICY_HND dom_pol;
 455         POLICY_HND user_pol;
 456         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 457         uint32 des_access = 0x000f000f;
 458
 459         DOM_SID sid;
 460
 461         if (argc != 2 ) {
 462                 printf("Usage: %s SID\n", argv[0]);
 463                 return NT_STATUS_OK;
 464         }
 465
 466         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 467         if (!NT_STATUS_IS_OK(result))
 468                 goto done;
 469
 470         result = cli_lsa_open_policy2(cli, mem_ctx, True,
 471                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 472                                      &dom_pol);
 473
 474         if (!NT_STATUS_IS_OK(result))
 475                 goto done;
 476
 477         result = cli_lsa_create_account(cli, mem_ctx, &dom_pol, &sid, des_access, &user_pol);
 478
 479         if (!NT_STATUS_IS_OK(result))
 480                 goto done;
 481
 482         printf("Account for SID %s successfully created\n\n", argv[1]);
 483         result = NT_STATUS_OK;
 484
 485  done:
 486         return result;
 487 }
 488
 489
 490 /* Enumerate the privileges of an SID */
 491
 492 static NTSTATUS cmd_lsa_enum_privsaccounts(struct cli_state *cli,
 493                                            TALLOC_CTX *mem_ctx, int argc,
 494                                            const char **argv)
 495 {
 496         POLICY_HND dom_pol;
 497         POLICY_HND user_pol;
 498         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 499         uint32 access_desired = 0x000f000f;
 500
 501         DOM_SID sid;
 502         uint32 count=0;
 503         LUID_ATTR *set;
 504         int i;
 505
 506         if (argc != 2 ) {
 507                 printf("Usage: %s SID\n", argv[0]);
 508                 return NT_STATUS_OK;
 509         }
 510
 511         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 512         if (!NT_STATUS_IS_OK(result))
 513                 goto done;
 514
 515         result = cli_lsa_open_policy2(cli, mem_ctx, True,
 516                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 517                                      &dom_pol);
 518
 519         if (!NT_STATUS_IS_OK(result))
 520                 goto done;
 521
 522         result = cli_lsa_open_account(cli, mem_ctx, &dom_pol, &sid, access_desired, &user_pol);
 523
 524         if (!NT_STATUS_IS_OK(result))
 525                 goto done;
 526
 527         result = cli_lsa_enum_privsaccount(cli, mem_ctx, &user_pol, &count, &set);
 528
 529         if (!NT_STATUS_IS_OK(result))
 530                 goto done;
 531
 532         /* Print results */
 533         printf("found %d privileges for SID %s\n\n", count, argv[1]);
 534         printf("high\tlow\tattribute\n");
 535
 536         for (i = 0; i < count; i++) {
 537                 printf("%u\t%u\t%u\n", set[i].luid.high, set[i].luid.low, set[i].attr);
 538         }
 539
 540  done:
 541         return result;
 542 }
 543
 544
 545 /* Enumerate the privileges of an SID via LsaEnumerateAccountRights */
 546
 547 static NTSTATUS cmd_lsa_enum_acct_rights(struct cli_state *cli,
 548                                          TALLOC_CTX *mem_ctx, int argc,
 549                                          const char **argv)
 550 {
 551         POLICY_HND dom_pol;
 552         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 553
 554         DOM_SID sid;
 555         uint32 count;
 556         char **rights;
 557
 558         int i;
 559
 560         if (argc != 2 ) {
 561                 printf("Usage: %s SID\n", argv[0]);
 562                 return NT_STATUS_OK;
 563         }
 564
 565         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 566         if (!NT_STATUS_IS_OK(result))
 567                 goto done;
 568
 569         result = cli_lsa_open_policy2(cli, mem_ctx, True,
 570                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 571                                      &dom_pol);
 572
 573         if (!NT_STATUS_IS_OK(result))
 574                 goto done;
 575
 576         result = cli_lsa_enum_account_rights(cli, mem_ctx, &dom_pol, &sid, &count, &rights);
 577
 578         if (!NT_STATUS_IS_OK(result))
 579                 goto done;
 580
 581         printf("found %d privileges for SID %s\n", count, sid_string_static(&sid));
 582
 583         for (i = 0; i < count; i++) {
 584                 printf("\t%s\n", rights[i]);
 585         }
 586
 587  done:
 588         return result;
 589 }
 590
 591
 592 /* add some privileges to a SID via LsaAddAccountRights */
 593
 594 static NTSTATUS cmd_lsa_add_acct_rights(struct cli_state *cli,
 595                                         TALLOC_CTX *mem_ctx, int argc,
 596                                         const char **argv)
 597 {
 598         POLICY_HND dom_pol;
 599         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 600
 601         DOM_SID sid;
 602
 603         if (argc < 3 ) {
 604                 printf("Usage: %s SID [rights...]\n", argv[0]);
 605                 return NT_STATUS_OK;
 606         }
 607
 608         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 609         if (!NT_STATUS_IS_OK(result))
 610                 goto done;
 611
 612         result = cli_lsa_open_policy2(cli, mem_ctx, True,
 613                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 614                                      &dom_pol);
 615
 616         if (!NT_STATUS_IS_OK(result))
 617                 goto done;
 618
 619         result = cli_lsa_add_account_rights(cli, mem_ctx, &dom_pol, sid,
 620                                             argc-2, argv+2);
 621
 622         if (!NT_STATUS_IS_OK(result))
 623                 goto done;
 624
 625  done:
 626         return result;
 627 }
 628
 629
 630 /* remove some privileges to a SID via LsaRemoveAccountRights */
 631
 632 static NTSTATUS cmd_lsa_remove_acct_rights(struct cli_state *cli,
 633                                         TALLOC_CTX *mem_ctx, int argc,
 634                                         const char **argv)
 635 {
 636         POLICY_HND dom_pol;
 637         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 638
 639         DOM_SID sid;
 640
 641         if (argc < 3 ) {
 642                 printf("Usage: %s SID [rights...]\n", argv[0]);
 643                 return NT_STATUS_OK;
 644         }
 645
 646         result = name_to_sid(cli, mem_ctx, &sid, argv[1]);
 647         if (!NT_STATUS_IS_OK(result))
 648                 goto done;
 649
 650         result = cli_lsa_open_policy2(cli, mem_ctx, True,
 651                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 652                                      &dom_pol);
 653
 654         if (!NT_STATUS_IS_OK(result))
 655                 goto done;
 656
 657         result = cli_lsa_remove_account_rights(cli, mem_ctx, &dom_pol, sid,
 658                                                False, argc-2, argv+2);
 659
 660         if (!NT_STATUS_IS_OK(result))
 661                 goto done;
 662
 663  done:
 664         return result;
 665 }
 666
 667
 668 /* Get a privilege value given its name */
 669
 670 static NTSTATUS cmd_lsa_lookupprivvalue(struct cli_state *cli,
 671                                         TALLOC_CTX *mem_ctx, int argc,
 672                                         const char **argv)
 673 {
 674         POLICY_HND pol;
 675         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 676         LUID luid;
 677
 678         if (argc != 2 ) {
 679                 printf("Usage: %s name\n", argv[0]);
 680                 return NT_STATUS_OK;
 681         }
 682
 683         result = cli_lsa_open_policy2(cli, mem_ctx, True,
 684                                      SEC_RIGHTS_MAXIMUM_ALLOWED,
 685                                      &pol);
 686
 687         if (!NT_STATUS_IS_OK(result))
 688                 goto done;
 689
 690         result = cli_lsa_lookupprivvalue(cli, mem_ctx, &pol, argv[1], &luid);
 691
 692         if (!NT_STATUS_IS_OK(result))
 693                 goto done;
 694
 695         /* Print results */
 696
 697         printf("%u:%u (0x%x:0x%x)\n", luid.high, luid.low, luid.high, luid.low);
 698
 699  done:
 700         return result;
 701 }
 702
 703 /* Query LSA security object */
 704
 705 static NTSTATUS cmd_lsa_query_secobj(struct cli_state *cli,
 706                                      TALLOC_CTX *mem_ctx, int argc,
 707                                      const char **argv)
 708 {
 709         POLICY_HND pol;
 710         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 711         SEC_DESC_BUF *sdb;
 712         uint32 sec_info = 0x00000004; /* ??? */
 713
 714         if (argc != 1 ) {
 715                 printf("Usage: %s\n", argv[0]);
 716                 return NT_STATUS_OK;
 717         }
 718
 719         result = cli_lsa_open_policy2(cli, mem_ctx, True,
 720                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
 721                                       &pol);
 722
 723         if (!NT_STATUS_IS_OK(result))
 724                 goto done;
 725
 726         result = cli_lsa_query_secobj(cli, mem_ctx, &pol, sec_info, &sdb);
 727
 728         if (!NT_STATUS_IS_OK(result))
 729                 goto done;
 730
 731         /* Print results */
 732
 733         display_sec_desc(sdb->sec);
 734
 735  done:
 736         return result;
 737 }
 738
 739
 740 /* List of commands exported by this module */
 741
 742 struct cmd_set lsarpc_commands[] = {
 743
 744         { "LSARPC" },
 745
 746         { "lsaquery",            RPC_RTYPE_NTSTATUS, cmd_lsa_query_info_policy,  NULL, PI_LSARPC, "Query info policy",                    "" },
 747         { "lookupsids",          RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_sids,        NULL, PI_LSARPC, "Convert SIDs to names",                "" },
 748         { "lookupnames",         RPC_RTYPE_NTSTATUS, cmd_lsa_lookup_names,       NULL, PI_LSARPC, "Convert names to SIDs",                "" },
 749         { "enumtrust",           RPC_RTYPE_NTSTATUS, cmd_lsa_enum_trust_dom,     NULL, PI_LSARPC, "Enumerate trusted domains",            "Usage: [preferred max number] [enum context (0)]" },
 750         { "enumprivs",           RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privilege,     NULL, PI_LSARPC, "Enumerate privileges",                 "" },
 751         { "getdispname",         RPC_RTYPE_NTSTATUS, cmd_lsa_get_dispname,       NULL, PI_LSARPC, "Get the privilege name",               "" },
 752         { "lsaenumsid",          RPC_RTYPE_NTSTATUS, cmd_lsa_enum_sids,          NULL, PI_LSARPC, "Enumerate the LSA SIDS",               "" },
 753         { "lsacreateaccount",    RPC_RTYPE_NTSTATUS, cmd_lsa_create_account,     NULL, PI_LSARPC, "Create a new lsa account",   "" },
 754         { "lsaenumprivsaccount", RPC_RTYPE_NTSTATUS, cmd_lsa_enum_privsaccounts, NULL, PI_LSARPC, "Enumerate the privileges of an SID",   "" },
 755         { "lsaenumacctrights",   RPC_RTYPE_NTSTATUS, cmd_lsa_enum_acct_rights,   NULL, PI_LSARPC, "Enumerate the rights of an SID",   "" },
 756 #if 0
 757         { "lsaaddpriv",          RPC_RTYPE_NTSTATUS, cmd_lsa_add_priv,           NULL, PI_LSARPC, "Assign a privilege to a SID", "" },
 758         { "lsadelpriv",          RPC_RTYPE_NTSTATUS, cmd_lsa_del_priv,           NULL, PI_LSARPC, "Revoke a privilege from a SID", "" },
 759 #endif
 760         { "lsaaddacctrights",    RPC_RTYPE_NTSTATUS, cmd_lsa_add_acct_rights,    NULL, PI_LSARPC, "Add rights to an account",   "" },
 761         { "lsaremoveacctrights", RPC_RTYPE_NTSTATUS, cmd_lsa_remove_acct_rights, NULL, PI_LSARPC, "Remove rights from an account",   "" },
 762         { "lsalookupprivvalue",  RPC_RTYPE_NTSTATUS, cmd_lsa_lookupprivvalue,    NULL, PI_LSARPC, "Get a privilege value given its name", "" },
 763         { "lsaquerysecobj",      RPC_RTYPE_NTSTATUS, cmd_lsa_query_secobj,       NULL, PI_LSARPC, "Query LSA security object", "" },
 764
 765         { NULL }
 766 };
 767