samedit (8)

samedit (8)

Samba-TNG

4 Sep 2005

NAME

samedit - Security Access Manager editor

SYNOPSIS

samedit [-d debuglevel] [-S <server>] [-p portnumber] [-n <netbiosname>] [-N] [-U <username>] [-W <domain>] [-A <filename>] [-c `command string`] [-i <scope>] [-O <socketoptions>] [-s smb.conf] [-l <logbasename>] [-E] [-m maxprotocol] [-h]

DESCRIPTION

samedit is used for editing the Security Access Manager (SAM) database. The SAM database is the portion of the NT registry that holds the user and machine account information and passwords. samedit can also do a number of tests and queries on the SAM database.

OPTIONS

-d debuglevel
Sets the debuglevel to an integer between 0 and 100. Debug level 0 is the lowest and 100 being the highest. To submit a bug report to the Samba-TNG Team, use debug level 100 (see BUGS.txt).

-S <server>
NetBIOS name of server to connect to (\\. or . for localhost). The server can be any SMB/CIFS server. The name is resolved using the "name resolve order =" line.

-p portnumber
Connects to the specified TCP port.

-n <netbiosname>
NetBIOS name of the local machine. This option is only needed if your Samba-TNG client cannot find it automatically. Samba-TNG should use the uppercase of the machine's hostname.

-N
Tells samedit not to ask for a password. samedit will prompt the user by default.

-U <username>[%pass]
Sets the SMB username or username and password. If %pass is not specified, The user will be prompted. The client will first check the USER environment variable, then the LOGNAME variable and if either exist, the string is uppercased. Anything in these variables following a % sign will be treated as the password. If these environmental variables are not found, the username GUEST is used.

-W <domain>
Sets the SMB domain. Note that this is very different from the DNS domain name. This overrides the default domain which is the domain of the server specified with the bt(-S) option. If the domain specified is the same as the server's NetBIOS name, it causes the client to log on using the server's local SAM (as opposed to the Domain SAM).

-A <filename>
Sets the name of the file with authentication credentials.

-c 'command string'
Execute semicolon separated commands (listed below).

-i <scope>
Defines the NetBIOS scope. For more information on NetBIOS scopes, see rfc1001 and rfc1002. NetBIOS scopes are rarely used.

-O <socketoptions>
These socket options are the same as in smb.conf (under the bt(socket options =) section).

-s smb.conf
Specifies the location of the smb.conf file.

-l <logbasename>
File name for log/debug files. .client will be appended. The log file is never removed by the client.

-E
Causes samedit to write messages to stderr instead of stdout.

-m maxprotocol
Is ignored in Samba-TNG. It is included only for backwards compatibility.

-h
Prints the help information (usage) for samedit.

COMMANDS

ntlogin, domlist, enumdomains, dominfo, lookupnames samquerysec, ntpass, creategroup, delgroup, enumgroups, samgroup, addgroupmem, delgroupmem, samgroupmem, createuser, deluser, enumusers, samuser, samuserset, samuserset2, createalias, delalias, enumaliases, samalias, addaliasmem, delaliasmem, samaliasmem, enumprivs, lsaenumsids

samedit comes with some commands for developers which might be useful to advanced users too. Use 'help devel' inside rpcclient to see the currently available subcommands and be prepared for incompatible changes.
devel trustinfo, devel domtrust, devel samsync, devel lookupdomain, devel lookuprids, devel samlookupnames, devel dispinfo, devel samtest, devel unjoin

ntlogin [DOMAIN\]<username> [<password>] [-d <trust-domain>] [-p <trust-pw>] [-i]
Tests whether username can do an interactive login. If username's password is not specified on the command line, it will be asked for.
-d <trust-domain> the domain of the workstation that tries the nt style login.
-p <trust-pw> the plaintext trust-password for this login test. It will be queried from the local machine, if you don't give it.
-i will try an inter-domain login instead of a workstation member login.

domlist
Lists trusted domains.

enumdomains
Lists the domains in the SAM.

dominfo
Domain info query.

lookupnames <domainname> [<domainname> ...]
Returns the SID string for the specified domainname/s.

samquerysec <username>
Queries SAM security object for the specified username.

ntpass [<username>]
Let's users change their password.

creategroup <group> [<description>]
Creates a domainwide (global) group in the domain.

delgroup <group>
Removes a group from the domain.

enumgroups
SAM group query which shows all groups in the current domain.

samgroup <group>
Does a SAM query on a group account.

addgroupmem <group> [<member1>] [<member2>] ...
Adds a user to the group specified by group.

delgroupmem <grouprid> [<memberrid1>] [<memberrid2>] ...
Removes members from the group specified by grouprid.

samgroupmem <group>
Does a SAM query on group members.

createuser <username> [-i] [-s] [-p <password>]
Creates an account in the NT domain. To create a machine trust account, append a '$' sign.
-i Inter-Domain trust
-s Server Trust (BDC)
-p <password> Password to assign to the account

deluser <username>
Removes an account from the domain.

enumusers
SAM database query command that shows all users in the current domain.

samuser <username> [-a | -u | -g]
Does a query on a username in the SAM database. The option that follows the username can be used to show user aliases -a, user account details -u (default) or user groups -g.

samuserset <username> [-p <password> [-F <fullname>] [-H <homedir>] [-D <homedrive>] [-P <profilepath>] [-L <loginscript>]]
Where username is the account name (append a '$' sign for a machine account).
-p <password> Change password to 'password'
-F <fullname> Change full name to 'fullname'
-H <homedir> Change home directory to 'homedir'
-D <homedrive> Change home directory drive to 'homedrive'
-P <profilepath> Set profile path to 'profilepath'
-L <loginscript> Set login script to 'loginscript'

samuserset2 <username> [-p <password>] [-s acb_bits] [-c acb_bits] [-H LM#:NT#]
Where username is the account name (append a '$' sign for a machine account). The values for acb_bits can be determined by adding wanted values from the following:

	N  User password not required
	D  User account disabled
	H  Home directory required
	T  Temporary duplicate account
	U  Normal user account
	M  MNS logon user account
	W  Workstation trust account
	S  Server trust account
	L  Account locked
	X  User password does not expire
	I  Interdomain trust account
	P  Password is locked and cannot be
	   changed remotely

-p <password> change password to 'password'
-s acb_bits set ACB bits
-c acb_bits clear ACB bits
-H LM#:NT# set the LM- and NT-hash directly. Use with caution!

Example:
samedit -S . -U root -c 'samuserset2 test_user -c D'

Hints:

  1. samuserset2 without any option prints out all implemented acb_bits.
  2. Example to read out the acb_bits from ldap:
    ldapsearch -D 'cn=root,dc=samba-tng,dc=org' 'ntuid=Administrator' acctFlags -W

createalias <aliasname> [<description>]
Creates a domain alias.

delalias <aliasname>
Removes an alias from the domain.

enumaliases
SAM alias query which shows all aliases in the SAM.

samalias <aliasname>
Does a SAM query on an alias account.

addaliasmem <aliasname> [<member1>] [<member2>] ...
Adds a Domain Alias member.

delaliasmem <aliasrid> [<membersid1>] [<membersid2>] ...
Removes a Domain Alias member.

samaliasmem [DOMAIN\]<aliasname>
Does a SAM query on alias members.

enumprivs [-i]
Lists the short (internal) names of all the privileges/rights known by the current server. With the -i, it will also show the long textual representation (currently in German).

lsaenumsids
Shows the SIDs that have privileges assigned to them.

SAMEDIT Commands for Developers

devel trustinfo <domainsid>
Show LSA info about trusts (experimental).

devel domtrust <domainname>
NT Inter-Domain test.

devel samsync
SAM synchronization test (experimental).

devel lookupdomain <domainname>
Returns the SID string for the specified domainname.

devel samlookuprids [-d <domainname>] <rid> [<rid> ...]
Returns a value associated with a specified RID in the specified NT domain.

devel samlookupnames [-d <domainname>] <name> [<name> ...]
Returns a RID associated with the specified name(s) in the specified NT domain.

devel dispinfo
SAM query display info.

devel samtest
Encrypted RPC-based SAM test (experimental).

devel unjoin
Let the workstation leave its domain (experimental).

set [OPTIONS...]
Runs samedit within itself (thus allowing command line options to be changed).

use [\\server] [-U <username>%pass] [-W <domain>] [-d] [-f]
or

use -u
Equivalent of the net use command in Windows NT. Can be used to connect to remote services.

help, ?
Shows all commands or help on a specific command.

quit, exit, bye
Exits the utility.

SEE ALSO

regedit(1), rpcclient(8), samba(7)

AUTHOR

The original Samba software and related utilities were created by Andrew Tridgell.

Samba-TNG is now developed by the Samba-TNG Team as an independent Open Source project. Take a look at the Samba-TNG Forum for more informations.

This manual page originally was written by Luke Kenneth Casson Leighton and was adapted 2000 by Matthew Geddes.

2005 the manpage was adapted to the current version of the Samba-TNG project.