1RPCCLIENT(1)                     User Commands                    RPCCLIENT(1)
2
3
4

NAME

6       rpcclient - tool for executing client side MS-RPC functions
7

SYNOPSIS

9       rpcclient [-A authfile] [-c <command string>] [-d debuglevel]
10        [-l logdir] [-N] [-s <smb config file>] [-U username[%password]]
11        [-W workgroup] [-I destinationIP] {BINDING-STRING|HOST}
12

DESCRIPTION

14       This tool is part of the samba(7) suite.
15
16       rpcclient is a utility initially developed to test MS-RPC functionality
17       in Samba itself. It has undergone several stages of development and
18       stability. Many system administrators have now written scripts around
19       it to manage Windows NT clients from their UNIX workstation.
20

OPTIONS

22       BINDING-STRING|HOST
23           When connecting to a dcerpc service you need to specify a binding
24           string.
25
26           The format is:
27
28           TRANSPORT:host[options]
29
30           where TRANSPORT is either ncacn_np (named pipes) for SMB or
31           ncacn_ip_tcp for DCERPC over TCP/IP.
32
33           "host" is an IP or hostname or netbios name. If the binding string
34           identifies the server side of an endpoint, "host" may be an empty
35           string. See below for more details.
36
37           "options" can include a SMB pipe name if using the ncacn_np
38           transport or a TCP port number if using the ncacn_ip_tcp transport,
39           otherwise they will be auto-determined.
40
41           Examples:
42
43                  ·   ncacn_ip_tcp:samba.example.com[1024]
44
45                  ·   ncacn_ip_tcp:samba.example.com[sign,seal,krb5]
46
47                  ·   ncacn_ip_tcp:samba.example.com[sign,spnego]
48
49                  ·   ncacn_np:samba.example.com
50
51                  ·   ncacn_np:samba.example.com[samr]
52
53                  ·   ncacn_np:samba.example.com[samr,sign,print]
54
55                  ·   ncalrpc:/path/to/unix/socket
56
57                  ·   //SAMBA
58
59           The supported transports are:
60
61                  ·   ncacn_np - Connect using named pipes
62
63                  ·   ncacn_ip_tcp - Connect over TCP/IP
64
65                  ·   ncalrpc - Connect over local RPC (unix sockets)
66
67           The supported options are:
68
69                  ·   sign - Use RPC integrity authentication level
70
71                  ·   seal - Enable RPC privacy (encryption) authentication
72                      level
73
74                  ·   connect - Use RPC connect level authentication (auth,
75                      but no sign or seal)
76
77                  ·   packet - Use RPC packet authentication level
78
79                  ·   spnego - Use SPNEGO instead of NTLMSSP authentication
80
81                  ·   ntlm - Use plain NTLM instead of SPNEGO or NTLMSSP
82
83                  ·   krb5 - Use Kerberos instead of NTLMSSP authentication
84
85                  ·   schannel - Create a schannel connection
86
87                  ·   smb1 - Use SMB1 for named pipes
88
89                  ·   smb2 - Use SMB2/3 for named pipes
90
91                  ·   validate - Enable the NDR validator
92
93                  ·   print - Enable debug output of packets
94
95                  ·   padcheck - Check reply data for non-zero pad bytes
96
97                  ·   bigendian - Use big endian for RPC
98
99                  ·   ndr64 - Use NDR64 for RPC
100
101
102       -c|--command=<command string>
103           Execute semicolon separated commands (listed below)
104
105       -I|--dest-ip IP-address
106           IP address is the address of the server to connect to. It should be
107           specified in standard "a.b.c.d" notation.
108
109           Normally the client would attempt to locate a named SMB/CIFS server
110           by looking it up via the NetBIOS name resolution mechanism
111           described above in the name resolve order parameter above. Using
112           this parameter will force the client to assume that the server is
113           on the machine with the specified IP address and the NetBIOS name
114           component of the resource being connected to will be ignored.
115
116           There is no default for this parameter. If not supplied, it will be
117           determined automatically by the client as described above.
118
119       -p|--port port
120           This number is the TCP port number that will be used when making
121           connections to the server. The standard (well-known) TCP port
122           number for an SMB/CIFS server is 139, which is the default.
123
124       -d|--debuglevel=level
125           level is an integer from 0 to 10. The default value if this
126           parameter is not specified is 0.
127
128           The higher this value, the more detail will be logged to the log
129           files about the activities of the server. At level 0, only critical
130           errors and serious warnings will be logged. Level 1 is a reasonable
131           level for day-to-day running - it generates a small amount of
132           information about operations carried out.
133
134           Levels above 1 will generate considerable amounts of log data, and
135           should only be used when investigating a problem. Levels above 3
136           are designed for use only by developers and generate HUGE amounts
137           of log data, most of which is extremely cryptic.
138
139           Note that specifying this parameter here will override the log
140           level parameter in the smb.conf file.
141
142       -V|--version
143           Prints the program version number.
144
145       -s|--configfile=<configuration file>
146           The file specified contains the configuration details required by
147           the server. The information in this file includes server-specific
148           information such as what printcap file to use, as well as
149           descriptions of all the services that the server is to provide. See
150           smb.conf for more information. The default configuration file name
151           is determined at compile time.
152
153       -l|--log-basename=logdirectory
154           Base directory name for log/debug files. The extension ".progname"
155           will be appended (e.g. log.smbclient, log.smbd, etc...). The log
156           file is never removed by the client.
157
158       --option=<name>=<value>
159           Set the smb.conf(5) option "<name>" to value "<value>" from the
160           command line. This overrides compiled-in defaults and options read
161           from the configuration file.
162
163       -N|--no-pass
164           If specified, this parameter suppresses the normal password prompt
165           from the client to the user. This is useful when accessing a
166           service that does not require a password.
167
168           Unless a password is specified on the command line or this
169           parameter is specified, the client will request a password.
170
171           If a password is specified on the command line and this option is
172           also defined the password on the command line will be silently
173           ignored and no password will be used.
174
175       -k|--kerberos
176           Try to authenticate with kerberos. Only useful in an Active
177           Directory environment.
178
179       -C|--use-ccache
180           Try to use the credentials cached by winbind.
181
182       -A|--authentication-file=filename
183           This option allows you to specify a file from which to read the
184           username and password used in the connection. The format of the
185           file is
186
187               username = <value>
188               password = <value>
189               domain   = <value>
190
191           Make certain that the permissions on the file restrict access from
192           unwanted users.
193
194       -U|--user=username[%password]
195           Sets the SMB username or username and password.
196
197           If %password is not specified, the user will be prompted. The
198           client will first check the USER environment variable, then the
199           LOGNAME variable and if either exists, the string is uppercased. If
200           these environmental variables are not found, the username GUEST is
201           used.
202
203           A third option is to use a credentials file which contains the
204           plaintext of the username and password. This option is mainly
205           provided for scripts where the admin does not wish to pass the
206           credentials on the command line or via environment variables. If
207           this method is used, make certain that the permissions on the file
208           restrict access from unwanted users. See the -A for more details.
209
210           Be cautious about including passwords in scripts. Also, on many
211           systems the command line of a running process may be seen via the
212           ps command. To be safe always allow rpcclient to prompt for a
213           password and type it in directly.
214
215       -S|--signing on|off|required
216           Set the client signing state.
217
218       -P|--machine-pass
219           Use stored machine account password.
220
221       -e|--encrypt
222           This command line parameter requires the remote server support the
223           UNIX extensions or that the SMB3 protocol has been selected.
224           Requests that the connection be encrypted. Negotiates SMB
225           encryption using either SMB3 or POSIX extensions via GSSAPI. Uses
226           the given credentials for the encryption negotiation (either
227           kerberos or NTLMv1/v2 if given domain/username/password triple.
228           Fails the connection if encryption cannot be negotiated.
229
230       --pw-nt-hash
231           The supplied password is the NT hash.
232
233       -n|--netbiosname <primary NetBIOS name>
234           This option allows you to override the NetBIOS name that Samba uses
235           for itself. This is identical to setting the netbios name parameter
236           in the smb.conf file. However, a command line setting will take
237           precedence over settings in smb.conf.
238
239       -i|--scope <scope>
240           This specifies a NetBIOS scope that nmblookup will use to
241           communicate with when generating NetBIOS names. For details on the
242           use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS
243           scopes are very rarely used, only set this parameter if you are the
244           system administrator in charge of all the NetBIOS systems you
245           communicate with.
246
247       -W|--workgroup=domain
248           Set the SMB domain of the username. This overrides the default
249           domain which is the domain defined in smb.conf. If the domain
250           specified is the same as the servers NetBIOS name, it causes the
251           client to log on using the servers local SAM (as opposed to the
252           Domain SAM).
253
254       -O|--socket-options socket options
255           TCP socket options to set on the client socket. See the socket
256           options parameter in the smb.conf manual page for the list of valid
257           options.
258
259       -?|--help
260           Print a summary of command line options.
261
262       --usage
263           Display brief usage message.
264

COMMANDS

266   LSARPC
267       lsaquery
268           Query info policy
269
270       lookupsids
271           Resolve a list of SIDs to usernames.
272
273       lookupnames
274           Resolve a list of usernames to SIDs.
275
276       enumtrust
277           Enumerate trusted domains
278
279       enumprivs
280           Enumerate privileges
281
282       getdispname
283           Get the privilege name
284
285       lsaenumsid
286           Enumerate the LSA SIDS
287
288       lsaenumprivsaccount
289           Enumerate the privileges of an SID
290
291       lsaenumacctrights
292           Enumerate the rights of an SID
293
294       lsaenumacctwithright
295           Enumerate accounts with a right
296
297       lsaaddacctrights
298           Add rights to an account
299
300       lsaremoveacctrights
301           Remove rights from an account
302
303       lsalookupprivvalue
304           Get a privilege value given its name
305
306       lsaquerysecobj
307           Query LSA security object
308
309   LSARPC-DS
310       dsroledominfo
311           Get Primary Domain Information
312
313       DFS
314
315       dfsexist
316           Query DFS support
317
318       dfsadd
319           Add a DFS share
320
321       dfsremove
322           Remove a DFS share
323
324       dfsgetinfo
325           Query DFS share info
326
327       dfsenum
328           Enumerate dfs shares
329
330   REG
331       shutdown
332           Remote Shutdown
333
334       abortshutdown
335           Abort Shutdown
336
337   SRVSVC
338       srvinfo
339           Server query info
340
341       netshareenum
342           Enumerate shares
343
344       netshareenumall
345           Enumerate all shares
346
347       netsharegetinfo
348           Get Share Info
349
350       netsharesetinfo
351           Set Share Info
352
353       netsharesetdfsflags
354           Set DFS flags
355
356       netfileenum
357           Enumerate open files
358
359       netremotetod
360           Fetch remote time of day
361
362       netnamevalidate
363           Validate sharename
364
365       netfilegetsec
366           Get File security
367
368       netsessdel
369           Delete Session
370
371       netsessenum
372           Enumerate Sessions
373
374       netdiskenum
375           Enumerate Disks
376
377       netconnenum
378           Enumerate Connections
379
380       netshareadd
381           Add share
382
383       netsharedel
384           Delete share
385
386   SAMR
387       queryuser
388           Query user info
389
390       querygroup
391           Query group info
392
393       queryusergroups
394           Query user groups
395
396       querygroupmem
397           Query group membership
398
399       queryaliasmem
400           Query alias membership
401
402       querydispinfo
403           Query display info
404
405       querydominfo
406           Query domain info
407
408       enumdomusers
409           Enumerate domain users
410
411       enumdomgroups
412           Enumerate domain groups
413
414       enumalsgroups
415           Enumerate alias groups
416
417       createdomuser
418           Create domain user
419
420       samlookupnames
421           Look up names
422
423       samlookuprids
424           Look up names
425
426       deletedomuser
427           Delete domain user
428
429       samquerysecobj
430           Query SAMR security object
431
432       getdompwinfo
433           Retrieve domain password info
434
435       lookupdomain
436           Look up domain
437
438   SPOOLSS
439       adddriver <arch> <config> [<version>]
440           Execute an AddPrinterDriver() RPC to install the printer driver
441           information on the server. Note that the driver files should
442           already exist in the directory returned by getdriverdir. Possible
443           values for arch are the same as those for the getdriverdir command.
444           The config parameter is defined as follows:
445
446               Long Driver Name:\
447               Driver File Name:\
448               Data File Name:\
449               Config File Name:\
450               Help File Name:\
451               Language Monitor Name:\
452               Default Data Type:\
453               Comma Separated list of Files
454
455           Any empty fields should be enter as the string "NULL".
456
457           Samba does not need to support the concept of Print Monitors since
458           these only apply to local printers whose driver can make use of a
459           bi-directional link for communication. This field should be "NULL".
460           On a remote NT print server, the Print Monitor for a driver must
461           already be installed prior to adding the driver or else the RPC
462           will fail.
463
464           The version parameter lets you specify the printer driver version
465           number. If omitted, the default driver version for the specified
466           architecture will be used. This option can be used to upload
467           Windows 2000 (version 3) printer drivers.
468
469       addprinter <printername> <sharename> <drivername> <port>
470           Add a printer on the remote server. This printer will be
471           automatically shared. Be aware that the printer driver must already
472           be installed on the server (see adddriver) and the portmust be a
473           valid port name (see enumports.
474
475       deldriver <driver>
476           Delete the specified printer driver for all architectures. This
477           does not delete the actual driver files from the server, only the
478           entry from the server's list of drivers.
479
480       deldriverex <driver> [architecture] [version] [flags]
481           Delete the specified printer driver and optionally files associated
482           with the driver. You can limit this action to a specific
483           architecture and a specific version. If no architecture is given,
484           all driver files of that driver will be deleted.  flags correspond
485           to numeric DPD_* values, i.e. a value of 3 requests
486           (DPD_DELETE_UNUSED_FILES | DPD_DELETE_SPECIFIC_VERSION).
487
488       enumdata
489           Enumerate all printer setting data stored on the server. On Windows
490           NT clients, these values are stored in the registry, while Samba
491           servers store them in the printers TDB. This command corresponds to
492           the MS Platform SDK GetPrinterData() function (* This command is
493           currently unimplemented).
494
495       enumdataex
496           Enumerate printer data for a key
497
498       enumjobs <printer>
499           List the jobs and status of a given printer. This command
500           corresponds to the MS Platform SDK EnumJobs() function
501
502       enumkey
503           Enumerate printer keys
504
505       enumports [level]
506           Executes an EnumPorts() call using the specified info level.
507           Currently only info levels 1 and 2 are supported.
508
509       enumdrivers [level]
510           Execute an EnumPrinterDrivers() call. This lists the various
511           installed printer drivers for all architectures. Refer to the MS
512           Platform SDK documentation for more details of the various flags
513           and calling options. Currently supported info levels are 1, 2, and
514           3.
515
516       enumprinters [level]
517           Execute an EnumPrinters() call. This lists the various installed
518           and share printers. Refer to the MS Platform SDK documentation for
519           more details of the various flags and calling options. Currently
520           supported info levels are 1, 2 and 5.
521
522       getdata <printername> <valuename;>
523           Retrieve the data for a given printer setting. See the enumdata
524           command for more information. This command corresponds to the
525           GetPrinterData() MS Platform SDK function.
526
527       getdataex
528           Get printer driver data with keyname
529
530       getdriver <printername>
531           Retrieve the printer driver information (such as driver file,
532           config file, dependent files, etc...) for the given printer. This
533           command corresponds to the GetPrinterDriver() MS Platform SDK
534           function. Currently info level 1, 2, and 3 are supported.
535
536       getdriverdir <arch>
537           Execute a GetPrinterDriverDirectory() RPC to retrieve the SMB share
538           name and subdirectory for storing printer driver files for a given
539           architecture. Possible values for arch are "Windows 4.0" (for
540           Windows 95/98), "Windows NT x86", "Windows NT PowerPC", "Windows
541           Alpha_AXP", and "Windows NT R4000".
542
543       getprinter <printername>
544           Retrieve the current printer information. This command corresponds
545           to the GetPrinter() MS Platform SDK function.
546
547       getprintprocdir
548           Get print processor directory
549
550       openprinter <printername>
551           Execute an OpenPrinterEx() and ClosePrinter() RPC against a given
552           printer.
553
554       setdriver <printername> <drivername>
555           Execute a SetPrinter() command to update the printer driver
556           associated with an installed printer. The printer driver must
557           already be correctly installed on the print server.
558
559           See also the enumprinters and enumdrivers commands for obtaining a
560           list of of installed printers and drivers.
561
562       addform
563           Add form
564
565       setform
566           Set form
567
568       getform
569           Get form
570
571       deleteform
572           Delete form
573
574       enumforms
575           Enumerate form
576
577       setprinter
578           Set printer comment
579
580       setprinterdata
581           Set REG_SZ printer data
582
583       setprintername <printername> <newprintername>
584           Set printer name
585
586       rffpcnex
587           Rffpcnex test
588
589   NETLOGON
590       logonctrl2
591           Logon Control 2
592
593       logonctrl
594           Logon Control
595
596       samsync
597           Sam Synchronisation
598
599       samdeltas
600           Query Sam Deltas
601
602       samlogon
603           Sam Logon
604
605   FSRVP
606       fss_is_path_sup <share>
607           Check whether a share supports shadow-copy requests
608
609       fss_get_sup_version
610           Get supported FSRVP version from server
611
612       fss_create_expose <context> <[ro|rw]> <share1> [share2] ... [shareN]
613           Request shadow-copy creation and exposure as a new share
614
615       fss_delete <base_share> <shadow_copy_set_id> <shadow_copy_id>
616           Request shadow-copy share deletion
617
618       fss_has_shadow_copy <base_share>
619           Check for an associated share shadow-copy
620
621       fss_get_mapping <base_share> <shadow_copy_set_id> <shadow_copy_id>
622           Get shadow-copy share mapping information
623
624       fss_recovery_complete <shadow_copy_set_id>
625           Flag read-write shadow-copy as recovery complete, allowing further
626           shadow-copy requests
627
628   GENERAL COMMANDS
629       debuglevel
630           Set the current debug level used to log information.
631
632       help (?)
633           Print a listing of all known commands or extended help on a
634           particular command.
635
636       quit (exit)
637           Exit rpcclient.
638

BUGS

640       rpcclient is designed as a developer testing tool and may not be robust
641       in certain areas (such as command line parsing). It has been known to
642       generate a core dump upon failures when invalid parameters where passed
643       to the interpreter.
644
645       From Luke Leighton's original rpcclient man page:
646
647       WARNING!  The MSRPC over SMB code has been developed from examining
648       Network traces. No documentation is available from the original
649       creators (Microsoft) on how MSRPC over SMB works, or how the individual
650       MSRPC services work. Microsoft's implementation of these services has
651       been demonstrated (and reported) to be... a bit flaky in places.
652
653       The development of Samba's implementation is also a bit rough, and as
654       more of the services are understood, it can even result in versions of
655       smbd(8) and rpcclient(1) that are incompatible for some commands or
656       services. Additionally, the developers are sending reports to
657       Microsoft, and problems found or reported to Microsoft are fixed in
658       Service Packs, which may result in incompatibilities.
659

VERSION

661       This man page is part of version 4.13.7 of the Samba suite.
662

AUTHOR

664       The original Samba software and related utilities were created by
665       Andrew Tridgell. Samba is now developed by the Samba Team as an Open
666       Source project similar to the way the Linux kernel is developed.
667
668       The original rpcclient man page was written by Matthew Geddes, Luke
669       Kenneth Casson Leighton, and rewritten by Gerald Carter. The conversion
670       to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to
671       DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy.
672
673
674
675Samba 4.13.7                      03/25/2021                      RPCCLIENT(1)
Impressum