RPCCLIENT(1) User Commands RPCCLIENT(1) (NAME) rpcclient - MS-RPC (SYNOPSIS) rpcclient [-c|--command=COMMANDS] [-I|--dest-ip=IP] [-p|--port=PORT] [-?|--help] [--usage] [-d|--debuglevel=DEBUGLEVEL] [--debug-stdout] [--configfile=CONFIGFILE] [--option=name=value] [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full] [-R|--name-resolve=NAME-RESOLVE-ORDER] [-O|--socket-options=SOCKETOPTIONS] [-m|--max-protocol=MAXPROTOCOL] [-n|--netbiosname=NETBIOSNAME] [--netbios-scope=SCOPE] [-W|--workgroup=WORKGROUP] [--realm=REALM] [-U|--user=[DOMAIN/]USERNAME[%PASSWORD]] [-N|--no-pass] [--password=STRING] [--pw-nt-hash] [-A|--authentication-file=FILE] [-P|--machine-pass] [--simple-bind-dn=DN] [--use-kerberos=desired|required|off] [--use-krb5-ccache=CCACHE] [--use-winbind-ccache] [--client-protection=sign|encrypt|off] [-V|--version] {BINDING-STRING|HOST} (DESCRIPTION) samba(7) . rpcclient MS-RPC Samba . . Windows NT UNIX . (OPTIONS) BINDING-STRING|HOST dcerpc binding string . : TRANSPORT:host[options] TRANSPORT ncacn_np ( named pipes) SMB ncacn_ip_tcp DCERPC TCP/IP. <> IP netbios . binding string (endpoint) <> . . <> ncacn_np SMB ncacn_ip_tcp TCP . : o ncacn_ip_tcp:samba.example.com[1024] o ncacn_ip_tcp:samba.example.com[sign,seal,krb5] o ncacn_ip_tcp:samba.example.com[sign,spnego] o ncacn_np:samba.example.com o ncacn_np:samba.example.com[samr] o ncacn_np:samba.example.com[samr,sign,print] o ncalrpc:/path/to/unix/socket o //SAMBA : o ncacn_np - (named pipes) o ncacn_ip_tcp - TCP/IP o ncalrpc - RPC ( ) : o sign - RPC o seal - () RPC o connect - RPC ( sign seal) o packet - (packet) RPC o spnego - SPNEGO NTLMSSP o ntlm - NTLM SPNEGO NTLMSSP o krb5 - Kerberos NTLMSSP o schannel - schannel o smb1 - SMB1 (named pipes) o smb2 - SMB2/3 (named pipes) o validate - NDR o print - o padcheck - (pad) o bigendian - big endian RPC o ndr64 - NDR64 RPC -c|--command= - ( ) -I|--dest-ip IP-address IP address . "a.b.c.d" . SMB/CIFS NetBIOS name resolve order . IP NetBIOS . . . -p|--port port TCP . (well-known) TCP SMB/CIFS 139 . -?|--help . --usage . -d|--debuglevel=level level 0 10 . 1 . (log) . 0 . 1 - . 1 . 3 . log level /etc/samba/smb.conf (override) . --debug-stdout (debug) STDOUT . STDERR . --configfile= . client smb encrypt . /etc/samba/smb.conf . . --option== "" smb.conf(5) "" . . (space) --option=name=value . -l|--log-basename=logdirectory / (log/debug). ".progname" ( log.smbclient log.smbd ). . --leak-report talloc . --leak-report-full talloc . -V|--version . -R|--name-resolve=NAME-RESOLVE-ORDER IP (resolve) . . --name-resolve=NAME-RESOLVE-ORDER . : "lmhosts" "host" "wins" "bcast". : o lmhosts: IP lmhosts Samba. lmhosts (name type) NetBIOS ( lmhosts(5) ) . o host: IP /etc/hosts NIS DNS . ( IRIX Solaris /etc/nsswitch.conf ). NetBIOS 0x20 () . o wins: IP wins server. WINS . o bcast: (broadcast) interfaces . . /etc/samba/smb.conf (name resolve order) . lmhosts host wins bcast . name resolve order /etc/samba/smb.conf . -O|--socket-options=SOCKETOPTIONS TCP . socket options /etc/samba/smb.conf . -m|--max-protocol=MAXPROTOCOL ( ) ..sp client max protocol /etc/samba/smb.conf . -n|--netbiosname=NETBIOSNAME NetBIOS Samba . netbios name /etc/samba/smb.conf . /etc/samba/smb.conf . --netbios-scope=SCOPE (scope) NetBIOS nmblookup NetBIOS . NetBIOS rfc1001.txt rfc1002.txt . NetBIOS NetBIOS . -W|--workgroup=WORKGROUP SMB . smb.conf . NetBIOS SAM ( SAM ) . workgroup /etc/samba/smb.conf . -r|--realm=REALM (realm) . realm /etc/samba/smb.conf . -U|--user=[DOMAIN\]USERNAME[%PASSWORD] SMB . %PASSWORD . USER ( % ) LOGNAME ( ) . (Credentials cache) . (credentials file) . . . -A . . Samba kinit . Samba ( ps ) (race condition) . -N|--no-pass . . . . --password . . Samba kinit . --password PASSWD PASSWD_FD (FD) . PASSWD_FILE ( ) . . ! Samba ( ps ) . --pw-nt-hash NT . -A|--authentication-file=filename . : username = password = domain = ! -P|--machine-pass . --simple-bind-dn=DN DN (simple bind). --use-kerberos=desired|required|off Samba Kerberos . IP DNS . Samba (ccache) Kerberos . ccache -U|--user (kinit) . --use-krb5-ccache . client use kerberos /etc/samba/smb.conf . --use-krb5-ccache=CCACHE Kerberos . --use-kerberos=required . --use-winbind-ccache winbind. --client-protection=sign|encrypt|off . client protection /etc/samba/smb.conf . : --option=clientsmbencrypt=OPTION, --option=clientipcsigning=OPTION, --option=clientsigning=OPTION. LSARPC lsaquery (info policy) lookupsids SID lookupsids3 SID lookupsids_level SID lookupnames SID lookupnames4 SID lookupnames_level SID enumtrust enumprivs (Privileges) getdispname lsaenumsid SID LSA lsacreateaccount LSA lsaenumprivsaccount SID lsaenumacctrights (Rights) SID lsaaddpriv SID lsadelpriv SID lsaaddacctrights lsaremoveacctrights lsalookupprivvalue lsaquerysecobj LSA lsaquerytrustdominfo LSA ( SID) lsaquerytrustdominfobyname LSA ( ) Windows 2k lsaquerytrustdominfobysid LSA ( SID) lsasettrustdominfo LSA getusername createsecret (Secret) deletesecret (Secret) querysecret (Secret) setsecret (Secret) retrieveprivatedata (Private Data) storeprivatedata (Private Data) createtrustdom deletetrustdom dsroledominfo DFS dfsversion DFS dfsadd DFS dfsremove DFS dfsgetinfo DFS dfsenum DFS dfsenumex DFS SHUTDOWN shutdowninit : shutdown [-m message] shutdownabort : shutdownabort SRVSVC srvinfo netshareenum netshareenumall netsharegetinfo netsharesetinfo netsharesetdfsflags DFS netfileenum netremotetod netnamevalidate netfilegetsec netsessdel netsessenum netdiskenum netconnenum netshareadd netsharedel queryuser querygroup queryusergroups queryuseraliases querygroupmem queryaliasmem queryaliasinfo deletealias querydispinfo querydispinfo2 querydispinfo3 querydominfo enumdomusers enumdomgroups enumalsgroups enumdomains createdomuser createdomgroup createdomalias samlookupnames samlookuprids deletedomgroup deletedomuser samquerysecobj SAMR getdompwinfo getusrdompwinfo lookupdomain chgpasswd chgpasswd2 chgpasswd3 ( RC4) chgpasswd4 ( AES) getdispinfoidx setuserinfo setuserinfo2 adddriver [] RPC AddPrinterDriver() . getdriverdir . arch getdriverdir . config : Long Driver Name:\ Driver File Name:\ Data File Name:\ Config File Name:\ Help File Name:\ Language Monitor Name:\ Default Data Type:\ Comma Separated list of Files "NULL" . (Samba) Print Monitor . "NULL" . NT (Print Monitor) RPC . version . . Windows 2000 ( ) . addprinter . . ( adddriver ) port ( enumports ). deldriver . . deldriverex [architecture] [version] [flags] . . . flags *DPD_ (DPD_DELETE_UNUSED_FILES | DPD_DELETE_SPECIFIC_VERSION) . enumdata . Windows NT Samba TDB . GetPrinterData() MS Platform SDK (* ). enumdataex (key). enumkey . enumjobs . EnumJobs() MS Platform SDK . getjob . setjob . enumports [level] EnumPorts() (info level) . . enumdrivers [level] EnumPrinterDrivers() . . MS Platform SDK . . enumprinters [level] EnumPrinters() . . MS Platform SDK . . getdata . enumdata . GetPrinterData() MS Platform SDK . getdataex (keyname). getdriver ( ) . GetPrinterDriver() MS Platform SDK . . getdriverdir GetPrinterDriverDirectory() RPC SMB . arch "Windows 4.0" ( Windows 95/98) "Windows NT x86" "Windows NT PowerPC" "Windows Alpha_AXP" "Windows NT R4000". getdriverpackagepath . getprinter . GetPrinter() MS Platform SDK . openprinter OpenPrinterEx() ClosePrinter() RPC . openprinter_ex (handle) . setdriver SetPrinter() . . enumprinters enumdrivers . getprintprocdir (print processor). addform . setform . getform . deleteform . enumforms setprinter setprinterdata REG_SZ setprintername rffpcnex Rffpcnex printercmp enumprocs enumprocdatatypes enummonitors createprinteric Printer IC playgdiscriptonprinteric Printer IC getcoreprinterdrivers CorePrinterDriver enumpermachineconnections addpermachineconnection delpermachineconnection NETLOGON logonctrl2 getanydcname DC getdcname PDC dsr_getdcname DC dsr_getdcnameex DC dsr_getdcnameex2 DC dsr_getsitename sitename dsr_getforesttrustinfo logonctrl samlogon Sam change_trust_pw gettrustrid rid dsr_enumtrustdom dsenumdomtrusts AD deregisterdnsrecords DNS netrenumtrusteddomains netrenumtrusteddomainsex getdcsitecoverage Site-Coverage DC capabilities logongetdomaininfo LogonGetDomainInfo fss_is_path_sup shadow-copy fss_get_sup_version FSRVP fss_create_expose shadow-copy fss_delete shadow-copy fss_has_shadow_copy shadow-copy fss_get_mapping shadow-copy fss_recovery_complete - CLUSAPI clusapi_open_cluster clusapi_get_cluster_name clusapi_get_cluster_version clusapi_get_quorum_resource (quorum) clusapi_create_enum (enum) clusapi_create_enumex enumex clusapi_open_resource clusapi_online_resource clusapi_offline_resource clusapi_get_resource_state clusapi_get_cluster_version2 clusapi_pause_node clusapi_resume_node dscracknames (Crack Name) dsgetdcinfo dsgetncchanges NC dswriteaccountspn SPN ECHO echoaddone echodata (Echo) sinkdata (Sink) sourcedata (Source) EPMAPPER epmmap (Binding) epmlookup (Bindings) EVENTLOG eventlog_readlog (Eventlog) eventlog_numrecord eventlog_oldestrecord eventlog_reportevent eventlog_reporteventsource eventlog_registerevsource eventlog_backuplog eventlog_loginfo winspool_AsyncOpenPrinter winspool_AsyncCorePrinterDriverInstalled (Core Printer Driver) NTSVCS ntsvcs_getversion NTSVCS ntsvcs_validatedevinst NTSVCS ntsvcs_hwprofflags NTSVCS ntsvcs_hwprofinfo NTSVCS ntsvcs_getdevregprop NTSVCS ntsvcs_getdevlistsize NTSVCS ntsvcs_getdevlist NTSVCS MDSSVC fetch_properties fetch_attributes CNID WINREG winreg_enumkey querymultiplevalues querymultiplevalues2 WITNESS GetInterfaceList witness Register NetName IPAddress UnRegister AsyncNotify RegisterEx NetName ShareName IPAddress wkssvc_wkstagetinfo WKSSVC wkssvc_getjoininformation (Join) WKSSVC wkssvc_messagebuffersend WKSSVC wkssvc_enumeratecomputernames WKSSVC wkssvc_enumerateusers WKSSVC (GENERAL OPTIONS) help ? debuglevel debug list (pipe) exit quit sign RPC seal RPC () packet RPC (packet) schannel RPC 'schannel'. RPC 'schannel'. . schannelsign RPC ( ) 'schannel'. . timeout ( ) RPC transport ncacn RPC none RPC rpcclient ( ) . core dump . rpcclient Luke Leighton: ! MSRPC over SMB . (Microsoft) MSRPC over SMB MSRPC . ( ) Microsoft ... . Samba smbd(8) rpcclient(1) . Microsoft Microsoft Service Pack . (VERSION) 4.24.6 Samba . (AUTHORS) Samba Andrew Tridgell . Samba Samba Team Linux . rpcclient Matthew Geddes Luke Kenneth Casson Leighton Gerald Carter . DocBook Samba 2.2 Gerald Carter . DocBook XML 4.2 Samba 3.0 Alexander Bokovoy . Samba 4.24.6 08/16/2026 RPCCLIENT(1)