From 1bd858a649fb5fb33f8207ca462db9601e28687d Mon Sep 17 00:00:00 2001 From: Volker Lendecke Date: Tue, 3 Feb 2009 14:41:49 +0100 Subject: [PATCH] s3: Fix 'net rpc join' for users with the SeMachineAccountPrivilege. This used to be commit fda8abac in master. (cherry picked from commit 5994c90ff8754b64a3a6658e28bd94f6a91a441b) --- source/libnet/libnet_join.c | 7 +++++-- source/utils/net_rpc_join.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/source/libnet/libnet_join.c b/source/libnet/libnet_join.c index b8d903cc9a2..488996c44f9 100644 --- a/source/libnet/libnet_join.c +++ b/source/libnet/libnet_join.c @@ -790,7 +790,8 @@ static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx, status = rpccli_samr_Connect2(pipe_hnd, mem_ctx, pipe_hnd->desthost, - SEC_RIGHTS_MAXIMUM_ALLOWED, + SAMR_ACCESS_ENUM_DOMAINS + | SAMR_ACCESS_OPEN_DOMAIN, &sam_pol); if (!NT_STATUS_IS_OK(status)) { goto done; @@ -798,7 +799,9 @@ static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx, status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx, &sam_pol, - SEC_RIGHTS_MAXIMUM_ALLOWED, + SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 + | SAMR_DOMAIN_ACCESS_CREATE_USER + | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, r->out.domain_sid, &domain_pol); if (!NT_STATUS_IS_OK(status)) { diff --git a/source/utils/net_rpc_join.c b/source/utils/net_rpc_join.c index d8641bfb230..dfab65c7b82 100644 --- a/source/utils/net_rpc_join.c +++ b/source/utils/net_rpc_join.c @@ -243,14 +243,17 @@ int net_rpc_join_newstyle(struct net_context *c, int argc, const char **argv) CHECK_RPC_ERR(rpccli_samr_Connect2(pipe_hnd, mem_ctx, pipe_hnd->desthost, - SEC_RIGHTS_MAXIMUM_ALLOWED, + SAMR_ACCESS_ENUM_DOMAINS + | SAMR_ACCESS_OPEN_DOMAIN, &sam_pol), "could not connect to SAM database"); CHECK_RPC_ERR(rpccli_samr_OpenDomain(pipe_hnd, mem_ctx, &sam_pol, - SEC_RIGHTS_MAXIMUM_ALLOWED, + SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1 + | SAMR_DOMAIN_ACCESS_CREATE_USER + | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT, domain_sid, &domain_pol), "could not open domain"); -- 2.11.4.GIT