rpcclient is a utility for developers that combines the commands found in
regedit, samedit and others. To
find out more about the commands found in rpcclient refer to the
samedit(8), regedit(1) and
other manual pages. These commands together perform the tasks seen by the
Windows NT Server Tools.
OPTIONS
-d debuglevel
Sets the debuglevel to an integer between 0 and 100. Debug level 0 is the
lowest and 100 being the highest. To submit a bug report to the Samba-TNG Team,
use debug level 100 (see BUGS.txt).
-S <server>
NetBIOS name of server to connect to (\\. or . for localhost). The server can
be any SMB/CIFS server. The name is resolved using the "name resolve order ="
line.
-p portnumber
Connects to the specified TCP port.
-n <netbiosname>
NetBIOS name of the local machine. This option is only needed if your Samba-TNG
client cannot find it automatically. Samba-TNG should use the uppercase of the
machine's hostname.
-N
Tells rpcclient not to ask for a password. rpcclient will prompt the
user by default.
-U <username>[%pass]
Sets the SMB username or username and password. If %pass is not specified, The
user will be prompted. The client will first check the USER environment
variable, then the LOGNAME variable and if either exist, the string is
uppercased. Anything in these variables following a % sign will be treated as
the password. If these environmental variables are not found, the username
GUEST is used.
-W <domain>
Sets the SMB domain. Note that this is very different from the DNS domain name.
This overrides the default domain which is the domain of the server specified
with the bt(-S) option. If the domain specified is the same as the server's
NetBIOS name, it causes the client to log on using the server's local SAM
(as opposed to the Domain SAM).
-A <filename>
Sets the name of the file with authentication credentials.
Removes members from the group specified by grouprid.
samgroupmem <group>
Does a SAM query on group members.
createuser <username> [-i] [-s] [-p <password>]
Creates an account in the NT domain. To create a machine trust account, append
a '$' sign.
-i
Inter-Domain trust
-s
Server Trust (BDC)
-p <password>
Password to assign to the account
deluser <username>
Removes an account from the domain.
enumusers
SAM database query command that shows all users in the current domain.
samuser <username> [-a | -u | -g]
Does a query on a username in the SAM database. The option that follows the
username can be used to show user aliases -a, user account details
-u (default) or user groups -g.
Where username is the account name (append a '$' sign for a machine
account). The values for acb_bits can be determined by adding wanted
values from the following:
N User password not required
D User account disabled
H Home directory required
T Temporary duplicate account
U Normal user account
M MNS logon user account
W Workstation trust account
S Server trust account
L Account locked
X User password does not expire
I Interdomain trust account
P Password is locked and cannot be
changed remotely
-p <password>
change password to 'password'
-s acb_bits
set ACB bits
-c acb_bits
clear ACB bits
-H LM#:NT#
set the LM- and NT-hash directly. Use with caution!
Lists the short (internal) names of all the privileges/rights known by the
current server. With the -i, it will also show the long textual representation
(currently in German).
lsaenumsids
Shows the SIDs that have privileges assigned to them.
SAMEDIT Commands for Developers
devel trustinfo <domainsid>
Show LSA info about trusts (experimental).
devel domtrust <domainname>
NT Inter-Domain test.
devel samsync
SAM synchronization test (experimental).
devel lookupdomain <domainname>
Returns the SID string for the specified domainname.
Lists the NetBIOS transports configured on the server. This shows, among other
things, the server's 48-bit MAC (Ethernet) addresses: look in the "address
name" field of each transport. You can use ARP to get this information, but
that only works within a broadcast domain.
In the case of multiple network interfaces, you can correlate a NetBIOS
transport with a specific IP number if the server is NT 5 (Win2k/XP):
The "transport name" field in the srvtransports output will end with a GUID
- for example, {3A1AC65C-F1D4-4ADD-B288-082DF3118F95}.
Use registry key enum to retrieve the list of values in
HKLM\System\CurrentControlSet\Services\{3A1AC65C-F1D4-4ADD-B288-082DF3118F95}\Parameters\Tcpip,
which will include IPAddress and DhcpIPAddress. (Unlike the
srvtransports call, registry key enum cannot be made anonymously.)