NET(8) NET(8) (NAME) net - (SYNOPSIS) net {} [-h|--help] [-d|--debuglevel=DEBUGLEVEL] [--debug-stdout] [--configfile=CONFIGFILE] [--option=name=value] [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full] [-R|--name-resolve=NAME-RESOLVE-ORDER] [-O|--socket-options=SOCKETOPTIONS] [-m|--max-protocol=MAXPROTOCOL] [-n|--netbiosname=NETBIOSNAME] [--netbios-scope=SCOPE] [-W|--workgroup=WORKGROUP] [--realm=REALM] [-U|--user=[DOMAIN/]USERNAME[%PASSWORD]] [-N|--no-pass] [--password=STRING] [--pw-nt-hash] [-A|--authentication-file=FILE] [-P|--machine-pass] [--simple-bind-dn=DN] [--use-kerberos=desired|required|off] [--use-krb5-ccache=CCACHE] [--use-winbind-ccache] [--client-protection=sign|encrypt|off] [-V|--version] [-w|--target-workgroup workgroup] [-I|--ipaddress ip-address] [-p|--port port] [--myname] [-S|--server server] [--long] [-v|--verbose] [-f|--force] [--request-timeout seconds] [-t|--timeout seconds] [--dns-ttl TTL-IN-SECONDS] [-i|--stdin] [--witness-registration=REGISTRATION_UUID] [--witness-net-name=REGEX] [--witness-share-name=REGEX] [--witness-ip-address=REGEX] [--witness-client-computer-name=REGEX] [--witness-apply-to-all] [--witness-new-node=NODEID] [--witness-new-ip=IPADDRESS] [--witness-forced-response=JSON] (DESCRIPTION) samba(7) . net net DOS . . ADS RAP (Win9x/NT3) RPC NT4 Windows 2000 . net . . (OPTIONS) -w|--target-workgroup target-workgroup . IP . -I|--ipaddress ip-address IP . . -p|--port port ( ). . -S|--server server . IP . --long . -v|--verbose . -f|--force net. --request-timeout 30 . -t|--timeout 30 . -i|--stdin net (stdin). -T|--test (dry-run). -F|--flags FLAGS net. -C|--comment COMMENT () net. --myname MYNAME MYNAME net. -c|--container CONTAINER (container) net ads. -M|--maxusers MAXUSERS maxusers net rpc share. -r|--reboot ( ). --force-full-repl "net rpc vampire keytab" keytab . --single-obj-repl "net rpc vampire keytab" keytab . --clean-old-entries "net rpc vampire keytab" keytab . --db "net idmap". --lock "net idmap check". -a|--auto "net idmap check". --repair "net idmap check". --acls ACL "net rpc share migrate". --attrs "net rpc share migrate". --timestamps "net rpc share migrate". -X|--exclude DIRECTORY "net rpc share migrate". --destination SERVERNAME ( localhost ). -L|--local ( "net groupmap set"). -D|--domain ( "net groupmap set"). -N|--ntname NTNAME ntname ( "net groupmap set"). --rid RID rid ( "net groupmap set"). --reg-version REG_VERSION {n|1,2,3} ( "net registry check"). -o|--output FILENAME ( "net registry check"). --wipe ( "net registry check"). --precheck PRECHECK_DB_FILENAME ( "net registry import"). --no-dns-updates DNS "net ads join". --keep-account "net ads leave". --json JSON "net ads info" "net ads lookup". --recursive . --continue . --follow-symlinks . --dns-ttl TTL-IN-SECONDS (TTL) DNS. DNS TTL . TTL . "net ads dns register" "net ads join" . . --witness-registration=REGISTRATION_UUID REGISTRATION_UUID . --witness-net-name=REGEX ' ' . --witness-share-name=REGEX ' ' . . --witness-ip-address=REGEX IP . --witness-client-computer-name=REGEX . . --witness-apply-to-all . --witness-new-node=NODEID NODEID IP . '-1' NODEID IP . --witness-new-ip=IPADDRESS IPADDRESS IP . --witness-forced-response=JSON witness_notifyResponse . -d|--debuglevel=level level 0 10 . 1 . . 0 . 1 - . 1 . 3 . log level /etc/samba/smb.conf . --debug-stdout STDOUT . STDERR . --configfile= . client smb encrypt . /etc/samba/smb.conf . . --option== smb.conf(5) "" "" . . --option=name=value . -l|--log-basename=logdirectory /. ".progname" ( log.smbclient log.smbd ). . --leak-report talloc . --leak-report-full talloc . -V|--version . -R|--name-resolve=NAME-RESOLVE-ORDER IP . . --name-resolve=NAME-RESOLVE-ORDER . : "lmhosts" "host" "wins" "bcast". : o lmhosts: IP lmhosts . lmhosts NetBIOS ( lmhosts(5) ) . o host: IP /etc/hosts NIS DNS . IRIX Solaris /etc/nsswitch.conf . NetBIOS 0x20 () . o wins: IP wins server. WINS . o bcast: (broadcast) interfaces. . /etc/samba/smb.conf (name resolve order) . lmhosts, host, wins, bcast . name resolve order /etc/samba/smb.conf . -O|--socket-options=SOCKETOPTIONS TCP . socket options /etc/samba/smb.conf . -m|--max-protocol=MAXPROTOCOL ( ) . client max protocol /etc/samba/smb.conf . -n|--netbiosname=NETBIOSNAME NetBIOS . netbios name /etc/samba/smb.conf . /etc/samba/smb.conf . --netbios-scope=SCOPE (scope) nmblookup NetBIOS . NetBIOS rfc1001.txt rfc1002.txt . NetBIOS NetBIOS . -W|--workgroup=WORKGROUP SMB . smb.conf . NetBIOS SAM ( SAM ) . workgroup /etc/samba/smb.conf . -r|--realm=REALM (realm) . realm /etc/samba/smb.conf . -U|--user=[DOMAIN\]USERNAME[%PASSWORD] SMB. %PASSWORD . USER ( % ) LOGNAME ( ) . Kerberos . . . . -A . . kinit . ( ps ) (race) . -N|--no-pass . . . . --password . . kinit . --password PASSWD PASSWD_FD (FD) . PASSWD_FILE ( ) . . ! ( ps ) . --pw-nt-hash NT . -A|--authentication-file=filename . : username = password = domain = ! -P|--machine-pass . --simple-bind-dn=DN DN (bind) . --use-kerberos=desired|required|off Kerberos . Kerberos IP DNS . Kerberos (ccache) . ccache -U|--user Kerberos (kinit) . Kerberos --use-krb5-ccache . client use kerberos /etc/samba/smb.conf . --use-krb5-ccache=CCACHE Kerberos . --use-kerberos=required . --use-winbind-ccache winbind. --client-protection=sign|encrypt|off . client protection /etc/samba/smb.conf . : --option=clientsmbencrypt=OPTION --option=clientipcsigning=OPTION --option=clientsigning=OPTION. (COMMANDS) CHANGESECRETPW Active Directory . . (-f) . . stdin (pipe) . . . TIME NET TIME . TIME NET TIME . -S . TIME SYSTEM /bin/date . -S . TIME SET /bin/date . -S . TIME ZONE GMT . -S . [RPC|ADS] JOIN [TYPE] [--no-dns-updates] [-U username[%password]] [dnshostname=FQDN] [createupn=UPN] [createcomputer=OU] [machinepass=PASS] [osName=string osVer=string] [options] . [TYPE] MEMBER . ( server manager ) . [TYPE] PDC BDC MEMBER . [FQDN] ( ADS) dnsHostName . netbiosname.dnsdomain . [UPN] ( ADS) principalname . host/netbiosname@REALM . [OU] ( ADS) (OU) . OU RDN '/' . '\' ldap (escape) . [PASS] ( ADS) . [osName=string osVer=String] ( ADS) operatingSystem operatingSystemVersion . . [RPC] OLDJOIN [options] . OLDJOIN - server manager . [RPC|ADS] USER [RPC|ADS] USER . [RPC|ADS] USER DELETE target . [RPC|ADS] USER INFO target . [RPC|ADS] USER RENAME oldname newname . [RPC|ADS] USER ADD name [password] [-F user flags] [-C comment] . [RPC|ADS] GROUP [RPC|ADS] GROUP [misc options] [targets] . [RPC|ADS] GROUP DELETE name [misc. options] . [RPC|ADS] GROUP ADD name [-C comment] . [ADS] LOOKUP . [RAP|RPC] SHARE [RAP|RPC] SHARE [misc. options] [targets] ( ) . [RAP|RPC] SHARE ADD name=serverpath [-C comment] [-M maxusers] [targets] ( ). Maxusers . SHARE DELETE sharename . [RPC|RAP] FILE [RPC|RAP] FILE . [RPC|RAP] FILE CLOSE fileid fileid . [RPC|RAP] FILE INFO fileid fileid . : file-id . [RAP|RPC] FILE USER user user . net rap file user . SESSION RAP SESSION SESSION SMB/CIFS . RAP SESSION DELETE|CLOSE CLIENT_NAME . RAP SESSION INFO CLIENT_NAME ..SS "RAP SERVER DOMAIN" . . RAP DOMAIN . RAP PRINTQ RAP PRINTQ INFO QUEUE_NAME . QUEUE_NAME . RAP PRINTQ DELETE JOBID . RAP VALIDATE user [password] . . . RAP GROUPMEMBER RAP GROUPMEMBER LIST GROUP . RAP GROUPMEMBER DELETE GROUP USER . RAP GROUPMEMBER ADD GROUP USER . RAP ADMIN command command . OS/2 . . RAP SERVICE RAP SERVICE START NAME [arguments...] . . . RAP SERVICE STOP . . RAP PASSWORD USER OLDPASS NEWPASS USER OLDPASS NEWPASS. LOOKUP LOOKUP HOST HOSTNAME [TYPE] IP ( NetBIOS). 0x20 ( ) . LOOKUP LDAP [DOMAIN] IP LDAP DOMAIN . . LOOKUP KDC [REALM] IP KDC REALM . . LOOKUP DC [DOMAIN] IP DOMAIN . . LOOKUP MASTER DOMAIN IP DOMAIN . . LOOKUP NAME [NAME] sid NAME . LOOKUP SID [SID] SID . LOOKUP DSGETDCNAME [NAME] [FLAGS] [SITENAME] NAME . CACHE 'gencache' . 'NET CACHE' . : s - m - h - d - w - CACHE ADD key data time-out + . CACHE DEL key . CACHE SET key data time-out . CACHE SEARCH PATTERN . CACHE LIST . CACHE FLUSH . GETLOCALSID [DOMAIN] SID SID . SETLOCALSID S-1-5-21-x-y-z SID SID . GETDOMAINSID SID SID . SETDOMAINSID SID . GROUPMAP SID . : o unixgroup - o ntgroup - NT ( SID ) o rid - o sid - SID "S-1-..." o type - 'domain' 'local' 'builtin' o comment - GROUPMAP ADD : net groupmap add {rid=int|sid=string} unixgroup=string \ [type={domain|local}] [ntgroup=string] [comment=string] GROUPMAP DELETE . . net groupmap delete {ntgroup=string|sid=SID} GROUPMAP MODIFY . net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] \ [comment=string] [type={domain|local}] GROUPMAP LIST . net groupmap list [verbose] [ntgroup=string] [sid=SID] MAXRID RID ( 'passdb backend' ). RPC INFO sid . [RPC|ADS] TESTJOIN . [RPC|ADS] CHANGETRUSTPW . RPC TRUSTDOM RPC TRUSTDOM ADD DOMAIN DOMAIN. DOMAIN$ 'I' ( ) . . () . . localhost smbpasswd -a -i DOMAIN . . RPC TRUSTDOM DEL DOMAIN DOMAIN. localhost smbpasswd -x DOMAIN$ . RPC TRUSTDOM ESTABLISH DOMAIN . PDC . . () . . winbind idmap . RPC TRUSTDOM REVOKE DOMAIN . RPC TRUSTDOM LIST . RPC TRUST RPC TRUST CREATE lsaCreateTrustedDomainEx2. . : otherserver otheruser otherdomainsid SID other_netbios_domain NetBIOS () otherdomain DNS () trustpw : srv1.dom1.dom dom2 net rpc trust create \ otherdomainsid=S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx \ other_netbios_domain=dom2 \ otherdomain=dom2.dom \ trustpw=12345678 \ -S srv1.dom1.dom dom1 dom2 net rpc trust create \ otherserver=srv2.dom2.test \ otheruser=dom2adm \ -S srv1.dom1.dom RPC TRUST DELETE lsaDeleteTrustedDomain. . : otherserver otheruser otherdomainsid SID : srv1.dom1.dom dom2 net rpc trust delete \ otherdomainsid=S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx \ -S srv1.dom1.dom dom1 dom2 net rpc trust delete \ otherserver=srv2.dom2.test \ otheruser=dom2adm \ -S srv1.dom1.dom RPC RIGHTS ( privileges ) . : list grant revoke. Samba-HOWTO-Collection . RPC ABORTSHUTDOWN . RPC SHUTDOWN [-t timeout] [-r] [-f] [-C message] . -r . -f . -t timeout . . -C message . RPC SAMDUMP sam . PDC BDC . RPC VAMPIRE . PDC BDC . vampire Active Directory NT4 . RPC VAMPIRE KEYTAB SAM keytab Kerberos. RPC VAMPIRE LDIF SAM LDIF . RPC GETSID SID secrets.tdb . ADS GPO ADS GPO APPLY GPO . . ADS GPO GETGPO [GPO] GPO . ADS GPO LINKADD [LINKDN] [GPODN] (container) GPO. LINKDN GPO. GPODN GPO . DN . RFC 4514 . ADS GPO LINKGET [CONTAINER] gPLink . ADS GPO LIST GPO . . ADS GPO LISTALL GPO DC. ADS GPO REFRESH [USERNAME] [MACHINENAME] GPO . USERNAME GPO . MACHINENAME GPO . ADS DNS ADS DNS REGISTER [FQDN [IP [IP.....]]] dns Active Directory. FQDN dns hostname . IP IP . ADS DNS UNREGISTER dns FQDN Active Directory. ADS LEAVE [--keep-account] . ADS STATUS ADS. . NET ADS TESTJOIN . ADS PRINTER ADS PRINTER INFO [PRINTER] [SERVER] PRINTER SERVER. "*" . ADS PRINTER PUBLISH PRINTER ADS. ADS PRINTER REMOVE PRINTER ADS. ADS SEARCH EXPRESSION ATTRIBUTES... LDAP ADS . LDAP LDAP . : net ads search '(objectCategory=group)' sAMAccountName ADS DN DN (attributes) LDAP ADS . DN DN LDAP LDAP . : net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName ADS KEYTAB CREATE 4.21.0 keytab sync machine password to keytab . keytab secrets.tdb kerberos method = secrets only kerberos method = secrets and keytab. smb.conf kerberos method = secrets only sync machine password to keytab ( ) keytab . keytab : SPN AD $COMPUTER host/dns_hostname kerberos method = secrets and keytab sync machine password to keytab . 4.20 : $COMPUTER 'host' SPN AD. keytab : sync machine password to keytab = /etc/krb5.keytab:spn_prefixes=host:account_name:sync_spns:sync_kvno:machine_password AD . (Removed!) ADS KEYTAB ADD (principal | machine | serviceclass | windows SPN) 4.21.0 . sync machine password to keytab . net ads keytab add wurst/brot@REALM smb.conf : sync machine password to keytab = /path/to/keytab1:spns=wurst/brot@REALM:machine_password : net ads keytab create : keytab : kerberos principal Kerberos ( '@') keytab . machinename ( '$' ) Kerberos 'machinename@realm' keytab . serviceclass ( 'cifs' 'html' ) Kerberos 'serviceclass/fully_qualified_dns_name@realm' 'serviceclass/netbios_name@realm' keytab . Windows SPN SPN 'serviceclass/host:port' Kerberos 'serviceclass/host@realm' keytab . AD . 'net ads keytab ad_update_ads' . ADS KEYTAB LIST [keytab] keytab . keytab keytab KRB5 . (Removed!) ADS KEYTAB DELETE (principal | machine | serviceclass | windows SPN) 4.21.0 . sync machine password to keytab . net ads keytab delete wurst/brot@REALM sync machine password to keytab "wurst/brot@REALM" : net ads keytab create (Removed!) ADS KEYTAB ADD_UPDATE_ADS (principal | machine | serviceclass | windows SPN) 4.21.0 . sync machine password to keytab . net ads keytab add_update_ads wurst/brot@REALM smb.conf : sync machine password to keytab = /path/to/keytab2:sync_spns:machine_password : net ads setspn add wurst/brot@REALM net ads keytab create : keytab ( net ads keytab add ). keytab SPN . SPN() AD : serviceclass ( 'cifs' 'html' ) SPN 'param/full_qualified_dns' 'param/netbios_name' AD . Windows SPN SPN 'serviceclass/host:port' AD . ADS SETSPN LIST [machine] SPN AD 'machine'. 'machine' . : net ads setspn list --machine-pass ADS SETSPN ADD [machine] SPN SPN AD 'machine'. 'machine' . : net ads setspn add computername host/computername.example.com -U Administrator%Passw0rd ADS SETSPN DELETE [machine] SPN SPN AD 'machine'. 'machine' . : net ads setspn delete computername host/computername.example.com -U Administrator%Passw0rd ADS WORKGROUP (realm) . ADS ENCTYPES "msDS-SupportedEncryptionTypes" AD. Kerberos . : 0x00000001 DES-CBC-CRC 0x00000002 DES-CBC-MD5 0x00000004 RC4-HMAC 0x00000008 AES128-CTS-HMAC-SHA1-96 0x00000010 AES256-CTS-HMAC-SHA1-96 0x00000020 AES256-CTS-HMAC-SHA1-96-SK 0x00080000 RESOURCE-SID-COMPRESSION-DISABLED ADS ENCTYPES LIST "msDS-SupportedEncryptionTypes" . '$' . : net ads enctypes list Computername$ --machine-pass ADS ENCTYPES SET [enctypes] "msDS-SupportedEncryptionTypes" LDAP ACCOUNTNAME . 28 RC4-HMAC AES128-CTS-HMAC-SHA1-96 AES256-CTS-HMAC-SHA1-96 . : net ads enctypes set Computername$ 24 --machine-pass ADS ENCTYPES DELETE "msDS-SupportedEncryptionTypes" LDAP ACCOUNTNAME. : net ads enctypes delete Computername$ --machine-pass ADS KERBEROS Kerberos KDC . ADS KERBEROS KINIT kinit . (TGT) ( ): o --use-krb5-ccache o KRB5CCNAME o default_ccache_name krb5.conf : (FILE:/tmp/krb5cache) net ads kerberos kinit -P --use-krb5-ccache=/tmp/krb5cache (MEMORY:net) net ads kerberos kinit -P --use-krb5-ccache=MEMORY:net ADS KERBEROS RENEW (TGT) . : net ads kerberos renew ADS KERBEROS PAC Kerberos PAC KDC . : net ads kerberos pac dump - PAC (stdout). net ads kerneros pac save - PAC . Kerberos Service for User (S4U2SELF) impersonate=STRING . : o user@MY.REALM . o user@MY.REALM@MY.REALM Kerberos Service for User (S4U2SELF) (Enterprise Principals) . o user@UPN.SUFFIX@MY.REALM upn . o user@WORKGROUP@MY.REALM NetBIOS. Samba AD . net . local_service=STRING . ADS KERBEROS PAC DUMP [impersonate=string] [local_service=string] [pac_buffer_type=int] Kerberos PAC KDC . PAC stdout . pac_buffer . pac_buffer_type=INT : 1 PAC_TYPE_LOGON_INFO 2 PAC_TYPE_CREDENTIAL_INFO 6 PAC_TYPE_SRV_CHECKSUM 7 PAC_TYPE_KDC_CHECKSUM 10 PAC_TYPE_LOGON_NAME 11 PAC_TYPE_CONSTRAINED_DELEGATION 12 PAC_TYPE_UPN_DNS_INFO 13 PAC_TYPE_CLIENT_CLAIMS_INFO 14 PAC_TYPE_DEVICE_INFO 15 PAC_TYPE_DEVICE_CLAIMS_INFO 16 PAC_TYPE_TICKET_CHECKSUM 17 PAC_TYPE_ATTRIBUTES_INFO 18 PAC_TYPE_REQUESTER_SID 19 PAC_TYPE_FULL_CHECKSUM : net ads kerberos pac dump -P impersonate=anyuser@MY.REALM.COM ADS KERBEROS PAC SAVE [impersonate=string] [local_service=string] [filename=string] Kerberos PAC KDC . PAC . PAC filename=STRING . : net ads kerberos pac save -U user%password filename=/tmp/pacstore SAM CREATEBUILTINGROUP () BUILTIN. BUILTIN . : Administrators Users Guests Power Users Account Operators Server Operators Print Operators Backup Operators Replicator RAS Servers Pre-Windows 2000 compatible Access. Winbindd idmap . gid winbindd . SAM CREATELOCALGROUP LOCAL ( Alias ). Winbindd idmap . gid winbindd . SAM DELETELOCALGROUP LOCAL ( Alias ). SAM MAPUNIXGROUP . SAM UNMAPUNIXGROUP . SAM ADDMEM . SID . SAM DELMEM . . SAM LISTMEM . . SAM LIST [verbose] . verbose rid . SAM RIGHTS LIST . SAM RIGHTS GRANT . SAM RIGHTS REVOKE . SAM SHOW DOMAIN\\NAME SID . SAM SET HOMEDIR . SAM SET PROFILEPATH . SAM SET COMMENT . SAM SET FULLNAME . SAM SET LOGONSCRIPT