1WBINFO(1)                        User Commands                       WBINFO(1)
2
3
4

NAME

6       wbinfo - Query information from winbind daemon
7

SYNOPSIS

9       wbinfo [-a user%password] [--all-domains] [--allocate-gid]
10        [--allocate-uid] [-c] [--ccache-save] [--change-user-password]
11        [-D domain] [--dc-info domain] [--domain domain]
12        [--dsgetdcname domain] [-g] [--getdcname domain] [--get-auth-user]
13        [-G gid] [--gid-info gid] [--group-info group] [--help|-?] [-i user]
14        [-I ip] [-K user%password] [--krb5ccname cctype] [--lanman] [--logoff]
15        [--logoff-uid uid] [--logoff-user username] [--lookup-sids] [-m]
16        [-n name] [-N netbios-name] [--ntlmv1] [--ntlmv2] [--online-status]
17        [--own-domain] [-p] [-P|--ping-dc] [--pam-logon user%password]
18        [-r user] [-R|--lookup-rids] [--remove-gid-mapping gid,sid]
19        [--remove-uid-mapping uid,sid] [-s sid] [--separator] [--sequence]
20        [--set-auth-user user%password] [--set-gid-mapping gid,sid]
21        [--set-uid-mapping uid,sid] [-S sid] [--sid-aliases sid]
22        [--sid-to-fullname sid] [--sids-to-unix-ids sidlist] [-t] [-u]
23        [--uid-info uid] [--usage] [--user-domgroups sid] [--user-sidinfo sid]
24        [--user-sids sid] [-U uid] [-V] [--verbose] [-Y sid]
25

DESCRIPTION

27       This tool is part of the samba(7) suite.
28
29       The wbinfo program queries and returns information created and used by
30       the winbindd(8) daemon.
31
32       The winbindd(8) daemon must be configured and running for the wbinfo
33       program to be able to return information.
34

OPTIONS

36       -a|--authenticate username%password
37           Attempt to authenticate a user via winbindd(8). This checks both
38           authentication methods and reports its results.
39
40               Note
41               Do not be tempted to use this functionality for authentication
42               in third-party applications. Instead use ntlm_auth(1).
43
44       --allocate-gid
45           Get a new GID out of idmap
46
47       --allocate-uid
48           Get a new UID out of idmap
49
50       --all-domains
51           List all domains (trusted and own domain).
52
53       -c|--change-secret
54           Change the trust account password. May be used in conjunction with
55           domain in order to change interdomain trust account passwords.
56
57       --change-secret-at domain-controller
58           Change the trust account password at a specific domain controller.
59           Fails if the specificied domain controller cannot be contacted.
60
61       --ccache-save username%password
62           Store user and password for ccache.
63
64       --change-user-password username
65           Change the password of a user. The old and new password will be
66           prompted.
67
68       --dc-info domain
69           Displays information about the current domain controller for a
70           domain.
71
72       --domain name
73           This parameter sets the domain on which any specified operations
74           will performed. If special domain name '.' is used to represent the
75           current domain to which winbindd(8) belongs. A '*' as the domain
76           name means to enumerate over all domains (NOTE: This can take a
77           long time and use a lot of memory).
78
79       -D|--domain-info domain
80           Show most of the info we have about the specified domain.
81
82       --dsgetdcname domain
83           Find a DC for a domain.
84
85       --gid-info gid
86           Get group info from gid.
87
88       --group-info group
89           Get group info from group name.
90
91       -g|--domain-groups
92           This option will list all groups available in the Windows NT domain
93           for which the samba(7) daemon is operating in. Groups in all
94           trusted domains can be listed with the --domain='*' option. Note
95           that this operation does not assign group ids to any groups that
96           have not already been seen by winbindd(8).
97
98       --get-auth-user
99           Print username and password used by winbindd(8) during session
100           setup to a domain controller. Username and password can be set
101           using --set-auth-user. Only available for root.
102
103       --getdcname domain
104           Get the DC name for the specified domain.
105
106       -G|--gid-to-sid gid
107           Try to convert a UNIX group id to a Windows NT SID. If the gid
108           specified does not refer to one within the idmap gid range then the
109           operation will fail.
110
111       -?
112           Print brief help overview.
113
114       -i|--user-info user
115           Get user info.
116
117       -I|--WINS-by-ip ip
118           The -I option queries winbindd(8) to send a node status request to
119           get the NetBIOS name associated with the IP address specified by
120           the ip parameter.
121
122       -K|--krb5auth username%password
123           Attempt to authenticate a user via Kerberos.
124
125       --krb5ccname KRB5CCNAME
126           Allows one to request a specific kerberos credential cache type
127           used for authentication.
128
129       --lanman
130           Use lanman cryptography for user authentication.
131
132       --logoff
133           Logoff a user.
134
135       --logoff-uid UID
136           Define user uid used during logoff request.
137
138       --logoff-user USERNAME
139           Define username used during logoff request.
140
141       --lookup-sids SID1,SID2...
142           Looks up SIDs. SIDs must be specified as ASCII strings in the
143           traditional Microsoft format. For example,
144           S-1-5-21-1455342024-3071081365-2475485837-500.
145
146       -m|--trusted-domains
147           Produce a list of domains trusted by the Windows NT server
148           winbindd(8) contacts when resolving names. This list does not
149           include the Windows NT domain the server is a Primary Domain
150           Controller for.
151
152       -n|--name-to-sid name
153           The -n option queries winbindd(8) for the SID associated with the
154           name specified. Domain names can be specified before the user name
155           by using the winbind separator character. For example
156           CWDOM1/Administrator refers to the Administrator user in the domain
157           CWDOM1. If no domain is specified then the domain used is the one
158           specified in the smb.conf(5) workgroup parameter.
159
160       -N|--WINS-by-name name
161           The -N option queries winbindd(8) to query the WINS server for the
162           IP address associated with the NetBIOS name specified by the name
163           parameter.
164
165       --ntlmv1
166           Use NTLMv1 cryptography for user authentication.
167
168       --ntlmv2
169           Use NTLMv2 cryptography for user authentication. NTLMv2 is the
170           default method, this option is only maintained for compatibility.
171
172       --online-status domain
173           Display whether winbind currently maintains an active connection or
174           not. An optional domain argument limits the output to the online
175           status of a given domain.
176
177       --own-domain
178           List own domain.
179
180       --pam-logon username%password
181           Attempt to authenticate a user in the same way pam_winbind would
182           do.
183
184       -p|--ping
185           Check whether winbindd(8) is still alive. Prints out either
186           'succeeded' or 'failed'.
187
188       -P|--ping-dc
189           Issue a no-effect command to our DC. This checks if our secure
190           channel connection to our domain controller is still alive. It has
191           much less impact than wbinfo -t.
192
193       -r|--user-groups username
194           Try to obtain the list of UNIX group ids to which the user belongs.
195           This only works for users defined on a Domain Controller.
196
197           There are two scenaries:
198
199                   1. User authenticated: When the user has been
200                      authenticated, the access token for the user is cached.
201                      The correct group memberships are then returned from the
202                      cached user token (which can be outdated).
203
204                   2. User *NOT* authenticated: The information is queries
205                      from the domain controller using the machine account
206                      credentials which have limited permissions. The result
207                      is normally incomplete and can be also incorrect.
208
209
210       -R|--lookup-rids rid1, rid2, rid3...
211           Converts RIDs to names. Uses a comma separated list of rids.
212
213       --remove-gid-mapping GID,SID
214           Removes an existing GID to SID mapping from the database.
215
216       --remove-uid-mapping UID,SID
217           Removes an existing UID to SID mapping from the database.
218
219       -s|--sid-to-name sid
220           Use -s to resolve a SID to a name. This is the inverse of the -n
221           option above. SIDs must be specified as ASCII strings in the
222           traditional Microsoft format. For example,
223           S-1-5-21-1455342024-3071081365-2475485837-500.
224
225       --separator
226           Get the active winbind separator.
227
228       --sequence
229           This command has been deprecated. Please use the --online-status
230           option instead.
231
232       --set-auth-user username%password
233           Store username and password used by winbindd(8) during session
234           setup to a domain controller. This enables winbindd to operate in a
235           Windows 2000 domain with Restrict Anonymous turned on (a.k.a.
236           Permissions compatible with Windows 2000 servers only).
237
238       --set-gid-mapping GID,SID
239           Create a GID to SID mapping in the database.
240
241       --set-uid-mapping UID,SID
242           Create a UID to SID mapping in the database.
243
244       -S|--sid-to-uid sid
245           Convert a SID to a UNIX user id. If the SID does not correspond to
246           a UNIX user mapped by winbindd(8) then the operation will fail.
247
248       --sid-aliases sid
249           Get SID aliases for a given SID.
250
251       --sid-to-fullname sid
252           Converts a SID to a full username (DOMAIN\username).
253
254       --sids-to-unix-ids sid1,sid2,sid3...
255           Resolve SIDs to Unix IDs. SIDs must be specified as ASCII strings
256           in the traditional Microsoft format. For example,
257           S-1-5-21-1455342024-3071081365-2475485837-500.
258
259       -t|--check-secret
260           Verify that the workstation trust account created when the Samba
261           server is added to the Windows NT domain is working. May be used in
262           conjunction with domain in order to verify interdomain trust
263           accounts.
264
265       -u|--domain-users
266           This option will list all users available in the Windows NT domain
267           for which the winbindd(8) daemon is operating in. Users in all
268           trusted domains can be listed with the --domain='*' option. Note
269           that this operation does not assign user ids to any users that have
270           not already been seen by winbindd(8) .
271
272       --uid-info uid
273           Get user info for the user connected to user id UID.
274
275       --usage
276           Print brief help overview.
277
278       --user-domgroups sid
279           Get user domain groups.
280
281       --user-sidinfo sid
282           Get user info by sid.
283
284       --user-sids sid
285           Get user group SIDs for user.
286
287       -U|--uid-to-sid uid
288           Try to convert a UNIX user id to a Windows NT SID. If the uid
289           specified does not refer to one within the idmap range then the
290           operation will fail.
291
292       --verbose
293           Print additional information about the query results.
294
295       -Y|--sid-to-gid sid
296           Convert a SID to a UNIX group id. If the SID does not correspond to
297           a UNIX group mapped by winbindd(8) then the operation will fail.
298
299       -V|--version
300           Prints the program version number.
301
302       -?|--help
303           Print a summary of command line options.
304
305       --usage
306           Display brief usage message.
307

EXIT STATUS

309       The wbinfo program returns 0 if the operation succeeded, or 1 if the
310       operation failed. If the winbindd(8) daemon is not working wbinfo will
311       always return failure.
312

VERSION

314       This man page is part of version 4.18.9 of the Samba suite.
315

SEE ALSO

317       winbindd(8) and ntlm_auth(1)
318

AUTHOR

320       The original Samba software and related utilities were created by
321       Andrew Tridgell. Samba is now developed by the Samba Team as an Open
322       Source project similar to the way the Linux kernel is developed.
323
324       wbinfo and winbindd were written by Tim Potter.
325
326       The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The
327       conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander
328       Bokovoy.
329
330
331
332Samba 4.18.9                      11/30/2023                         WBINFO(1)
Impressum