pascal

[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[]@[SERVICE-INFO-01]
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(268)
  check_ntlm_password: guest authentication for user [] succeeded
[2006/09/18 16:00:44, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319)
  NTLMSSP Sign/Seal - Initialising with flags:
[2006/09/18 16:00:44, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
  Got NTLMSSP neg_flags=0x60088215
[2006/09/18 16:00:44, 3] smbd/password.c:register_vuid(221)
  User name: nobody	Real name: nobody
[2006/09/18 16:00:44, 3] smbd/password.c:register_vuid(240)
  UNIX uid 65534 is UNIX user nobody, and will be vuid 102
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 26 of length 86
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtconX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] lib/access.c:check_access(313)
  check_access: no hostnames in host allow/deny list.
[2006/09/18 16:00:44, 2] lib/access.c:check_access(324)
  Allowed connection from  (192.168.151.38)
[2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(543)
  Connect path is '/var/tmp' for service [IPC$]
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] smbd/vfs.c:vfs_init_default(203)
  Initialising default vfs hooks
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(705)
  service-info-01 (192.168.151.38) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/reply.c:reply_tcon_and_X(326)
  tconX service=IPC$ 
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 27 of length 100
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 28 of length 208
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74a9 nwritten=140
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 29 of length 63
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74a9 min=1024 max=1024 nread=116
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 30 of length 199
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(102) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[]@[SERVICE-INFO-01]
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(102) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(102) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(268)
  check_ntlm_password: guest authentication for user [] succeeded
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74a9 nwritten=131
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 31 of length 248
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=160 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74a9)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_GET_DOM_PWINFO
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 22
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 32 of length 1304
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=1216 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74a9)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CHGPASSWD_USER
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(102) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(102) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 0] smbd/chgpasswd.c:check_oem_password(832)
  check_oem_password: incorrect password length (886305395).
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 38
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 33 of length 45
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 34 of length 43
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBulogoffX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/reply.c:reply_ulogoffX(1108)
  ulogoffX vuid=102
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 35 of length 39
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtdis (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/service.c:close_cnum(887)
  service-info-01 (192.168.151.38) closed connection to service IPC$
[2006/09/18 16:00:44, 3] smbd/connection.c:yield_connection(69)
  Yielding connection to IPC$
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 36 of length 86
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtconX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] lib/access.c:check_access(313)
  check_access: no hostnames in host allow/deny list.
[2006/09/18 16:00:44, 2] lib/access.c:check_access(324)
  Allowed connection from  (192.168.151.38)
[2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(543)
  Connect path is '/var/tmp' for service [IPC$]
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:44, 3] smbd/vfs.c:vfs_init_default(203)
  Initialising default vfs hooks
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(705)
  service-info-01 (192.168.151.38) connect to service IPC$ initially as user plegrand (uid=531, gid=506) (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/reply.c:reply_tcon_and_X(326)
  tconX service=IPC$ 
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 37 of length 100
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 38 of length 208
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74aa nwritten=140
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 39 of length 63
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74aa min=1024 max=1024 nread=116
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 40 of length 272
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user [TOTEM]\[plegrand]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[plegrand]@[SERVICE-INFO-01]
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] libsmb/ntlm_check.c:ntlm_password_check(282)
  ntlm_password_check: NT MD4 password check failed for user plegrand
[2006/09/18 16:00:44, 3] auth/auth_winbind.c:check_winbind_security(80)
  check_winbind_security: Not using winbind, requested domain [TOTEM] was for this SAM.
[2006/09/18 16:00:44, 2] auth/auth.c:check_ntlm_password(312)
  check_ntlm_password:  Authentication for user [plegrand] -> [plegrand] FAILED with error NT_STATUS_WRONG_PASSWORD
[2006/09/18 16:00:44, 1] rpc_server/srv_pipe.c:api_pipe_ntlmssp_verify(414)
  api_pipe_ntlmssp_verify: User [TOTEM]\[plegrand] from machine SERVICE-INFO-01 failed authentication on named pipe samr.
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:process_complete_pdu(752)
  process_complete_pdu: DCE/RPC fault sent on pipe lsass
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74aa nwritten=204
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 41 of length 248
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=160 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74aa)Transaction 42 of length 45
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 43 of length 104
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe lsarpc opening.
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 44 of length 140
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\lsarpc
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74ab nwritten=72
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 45 of length 63
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74ab min=1024 max=1024 nread=68
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 46 of length 188
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=100 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "lsarpc" (pnum 74ab)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: LSA_OPENPOLICY2
[2006/09/18 16:00:44, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(181)
  lsa_io_sec_qos: length c does not match size 8
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 830
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 47 of length 134
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=46 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "lsarpc" (pnum 74ab)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 512
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 48 of length 100
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 49 of length 140
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74ac nwritten=72
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 50 of length 63
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74ac min=1024 max=1024 nread=68
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 51 of length 172
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=84 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ac)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 52 of length 45
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 53 of length 100
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 54 of length 140
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74ad nwritten=72
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 55 of length 63
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74ad min=1024 max=1024 nread=68
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 56 of length 160
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=72 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CONNECT4
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 754
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 57 of length 164
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=76 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 732
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 58 of length 184
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=96 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_LOOKUP_NAMES
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 48
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 59 of length 140
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=52 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_OPEN_USER
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 1447
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 60 of length 132
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_GET_USRDOM_PWINFO
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 61 of length 236
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=148 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 62 of length 132
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2006/09/18 16:00:44, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 63 of length 132
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2006/09/18 16:00:44, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 64 of length 132
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ad)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2006/09/18 16:00:44, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 65 of length 45
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 66 of length 132
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "lsarpc" (pnum 74ab)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: LSA_CLOSE
[2006/09/18 16:00:44, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 67 of length 45
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 68 of length 240
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBsesssetupX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X(638)
  wct=12 flg2=0xc807
[2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(518)
  Doing spnego session setup
[2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(549)
  NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
[2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_spnego_negotiate(427)
  Got OID 1 3 6 1 4 1 311 2 2 10
[2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_spnego_negotiate(430)
  Got secblob of size 40
[2006/09/18 16:00:44, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
  Got NTLMSSP neg_flags=0xe2088297
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 69 of length 292
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBsesssetupX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X(638)
  wct=12 flg2=0xc807
[2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(518)
  Doing spnego session setup
[2006/09/18 16:00:44, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(549)
  NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
[2006/09/18 16:00:44, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(616)
  Got user=[] domain=[] workstation=[SERVICE-INFO-01] len1=1 len2=0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[]@[SERVICE-INFO-01]
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(268)
  check_ntlm_password: guest authentication for user [] succeeded
[2006/09/18 16:00:44, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319)
  NTLMSSP Sign/Seal - Initialising with flags:
[2006/09/18 16:00:44, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
  Got NTLMSSP neg_flags=0x60088215
[2006/09/18 16:00:44, 3] smbd/password.c:register_vuid(221)
  User name: nobody	Real name: nobody
[2006/09/18 16:00:44, 3] smbd/password.c:register_vuid(240)
  UNIX uid 65534 is UNIX user nobody, and will be vuid 103
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 70 of length 86
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtconX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] lib/access.c:check_access(313)
  check_access: no hostnames in host allow/deny list.
[2006/09/18 16:00:44, 2] lib/access.c:check_access(324)
  Allowed connection from  (192.168.151.38)
[2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(543)
  Connect path is '/var/tmp' for service [IPC$]
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] smbd/vfs.c:vfs_init_default(203)
  Initialising default vfs hooks
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:44, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/service.c:make_connection_snum(705)
  service-info-01 (192.168.151.38) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/reply.c:reply_tcon_and_X(326)
  tconX service=IPC$ 
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 71 of length 100
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 72 of length 208
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74ae nwritten=140
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 73 of length 63
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74ae min=1024 max=1024 nread=116
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 74 of length 199
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(103) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[]@[SERVICE-INFO-01]
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(103) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(103) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:44, 3] auth/auth.c:check_ntlm_password(268)
  check_ntlm_password: guest authentication for user [] succeeded
[2006/09/18 16:00:44, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74ae nwritten=131
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 75 of length 248
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=160 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ae)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_GET_DOM_PWINFO
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 22
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 76 of length 1304
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:44, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=1216 params=0 setup=2
[2006/09/18 16:00:44, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:44, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74ae)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CHGPASSWD_USER
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(103) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3
[2006/09/18 16:00:44, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(103) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:44, 0] smbd/chgpasswd.c:check_oem_password(832)
  check_oem_password: incorrect password length (886305395).
[2006/09/18 16:00:44, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:44, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 38
[2006/09/18 16:00:44, 3] smbd/process.c:process_smb(890)
  Transaction 77 of length 45
[2006/09/18 16:00:44, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 78 of length 43
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBulogoffX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/reply.c:reply_ulogoffX(1108)
  ulogoffX vuid=103
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 79 of length 39
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtdis (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/service.c:close_cnum(887)
  service-info-01 (192.168.151.38) closed connection to service IPC$
[2006/09/18 16:00:46, 3] smbd/connection.c:yield_connection(69)
  Yielding connection to IPC$
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 80 of length 100
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 81 of length 208
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74af nwritten=140
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 82 of length 63
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74af min=1024 max=1024 nread=116
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 83 of length 272
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user [TOTEM]\[plegrand]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[plegrand]@[SERVICE-INFO-01]
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] libsmb/ntlm_check.c:ntlm_password_check(282)
  ntlm_password_check: NT MD4 password check failed for user plegrand
[2006/09/18 16:00:46, 3] auth/auth_winbind.c:check_winbind_security(80)
  check_winbind_security: Not using winbind, requested domain [TOTEM] was for this SAM.
[2006/09/18 16:00:46, 2] auth/auth.c:check_ntlm_password(312)
  check_ntlm_password:  Authentication for user [plegrand] -> [plegrand] FAILED with error NT_STATUS_WRONG_PASSWORD
[2006/09/18 16:00:46, 1] rpc_server/srv_pipe.c:api_pipe_ntlmssp_verify(414)
  api_pipe_ntlmssp_verify: User [TOTEM]\[plegrand] from machine SERVICE-INFO-01 failed authentication on named pipe samr.
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:process_complete_pdu(752)
  process_complete_pdu: DCE/RPC fault sent on pipe lsass
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74af nwritten=204
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 84 of length 248
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=160 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74af)Transaction 85 of length 45
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 86 of length 104
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe lsarpc opening.
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 87 of length 140
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\lsarpc
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b0 nwritten=72
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 88 of length 63
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74b0 min=1024 max=1024 nread=68
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 89 of length 188
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=100 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "lsarpc" (pnum 74b0)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: LSA_OPENPOLICY2
[2006/09/18 16:00:46, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(181)
  lsa_io_sec_qos: length c does not match size 8
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 830
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 90 of length 134
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=46 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "lsarpc" (pnum 74b0)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 512
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 91 of length 100
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 92 of length 140
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b1 nwritten=72
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 93 of length 63
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74b1 min=1024 max=1024 nread=68
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 94 of length 172
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=84 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b1)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 95 of length 45
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 96 of length 100
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 97 of length 140
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b2 nwritten=72
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 98 of length 63
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74b2 min=1024 max=1024 nread=68
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 99 of length 160
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=72 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CONNECT4
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 754
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 100 of length 164
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=76 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 732
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 101 of length 184
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=96 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_LOOKUP_NAMES
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 48
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 102 of length 140
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=52 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_OPEN_USER
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 1447
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 103 of length 132
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_GET_USRDOM_PWINFO
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 104 of length 236
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=148 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 105 of length 132
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2006/09/18 16:00:46, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 106 of length 132
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2006/09/18 16:00:46, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 107 of length 132
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b2)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CLOSE_HND
[2006/09/18 16:00:46, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 108 of length 45
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 109 of length 132
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=44 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "lsarpc" (pnum 74b0)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: LSA_CLOSE
[2006/09/18 16:00:46, 3] rpc_server/srv_lsa_hnd.c:close_policy_hnd(200)
  Closed policy
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 110 of length 45
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 111 of length 240
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBsesssetupX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X(638)
  wct=12 flg2=0xc807
[2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(518)
  Doing spnego session setup
[2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(549)
  NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
[2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_spnego_negotiate(427)
  Got OID 1 3 6 1 4 1 311 2 2 10
[2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_spnego_negotiate(430)
  Got secblob of size 40
[2006/09/18 16:00:46, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
  Got NTLMSSP neg_flags=0xe2088297
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 112 of length 292
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBsesssetupX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X(638)
  wct=12 flg2=0xc807
[2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(518)
  Doing spnego session setup
[2006/09/18 16:00:46, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(549)
  NativeOS=[Windows 2002 Service Pack 2 2600] NativeLanMan=[Windows 2002 5.1] PrimaryDomain=[]
[2006/09/18 16:00:46, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(616)
  Got user=[] domain=[] workstation=[SERVICE-INFO-01] len1=1 len2=0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[]@[SERVICE-INFO-01]
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:46, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(268)
  check_ntlm_password: guest authentication for user [] succeeded
[2006/09/18 16:00:46, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(319)
  NTLMSSP Sign/Seal - Initialising with flags:
[2006/09/18 16:00:46, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
  Got NTLMSSP neg_flags=0x60088215
[2006/09/18 16:00:46, 3] smbd/password.c:register_vuid(221)
  User name: nobody	Real name: nobody
[2006/09/18 16:00:46, 3] smbd/password.c:register_vuid(240)
  UNIX uid 65534 is UNIX user nobody, and will be vuid 104
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 113 of length 86
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtconX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] lib/access.c:check_access(313)
  check_access: no hostnames in host allow/deny list.
[2006/09/18 16:00:46, 2] lib/access.c:check_access(324)
  Allowed connection from  (192.168.151.38)
[2006/09/18 16:00:46, 3] smbd/service.c:make_connection_snum(543)
  Connect path is '/var/tmp' for service [IPC$]
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:46, 3] smbd/vfs.c:vfs_init_default(203)
  Initialising default vfs hooks
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:46, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-501
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-514
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-32-546
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/service.c:make_connection_snum(705)
  service-info-01 (192.168.151.38) connect to service IPC$ initially as user nobody (uid=65534, gid=65534) (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/reply.c:reply_tcon_and_X(326)
  tconX service=IPC$ 
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 114 of length 100
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 115 of length 208
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b3 nwritten=140
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 116 of length 63
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74b3 min=1024 max=1024 nread=116
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 117 of length 199
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(104) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user []\[]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[]@[SERVICE-INFO-01]
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(104) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(104) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:46, 3] passdb/lookup_sid.c:fetch_sid_from_gid_cache(235)
  fetch sid from gid cache 65534 -> S-1-5-21-3001284405-1458979528-22331195-132069
[2006/09/18 16:00:46, 3] auth/auth.c:check_ntlm_password(268)
  check_ntlm_password: guest authentication for user [] succeeded
[2006/09/18 16:00:46, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b3 nwritten=131
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 118 of length 248
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=160 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b3)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_GET_DOM_PWINFO
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 22
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 119 of length 1304
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:46, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=1216 params=0 setup=2
[2006/09/18 16:00:46, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:46, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b3)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CHGPASSWD_USER
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(65534, 65534) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(104) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 3
[2006/09/18 16:00:46, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(104) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 3
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:46, 0] smbd/chgpasswd.c:check_oem_password(832)
  check_oem_password: incorrect password length (886305395).
[2006/09/18 16:00:46, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (65534, 65534) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:46, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 38
[2006/09/18 16:00:46, 3] smbd/process.c:process_smb(890)
  Transaction 120 of length 45
[2006/09/18 16:00:46, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 121 of length 43
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBulogoffX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] smbd/reply.c:reply_ulogoffX(1108)
  ulogoffX vuid=104
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 122 of length 39
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBtdis (pid 12833)
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] smbd/service.c:close_cnum(887)
  service-info-01 (192.168.151.38) closed connection to service IPC$
[2006/09/18 16:00:47, 3] smbd/connection.c:yield_connection(69)
  Yielding connection to IPC$
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 123 of length 100
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 124 of length 208
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b4 nwritten=140
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 125 of length 63
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74b4 min=1024 max=1024 nread=116
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 126 of length 272
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:47, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] auth/auth.c:check_ntlm_password(219)
  check_ntlm_password:  Checking password for unmapped user [TOTEM]\[plegrand]@[SERVICE-INFO-01] with the new password interface
[2006/09/18 16:00:47, 3] auth/auth.c:check_ntlm_password(222)
  check_ntlm_password:  mapped user is: [TOTEM]\[plegrand]@[SERVICE-INFO-01]
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:47, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 2
[2006/09/18 16:00:47, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 1
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 2
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 1
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (531, 506) - sec_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] libsmb/ntlm_check.c:ntlm_password_check(282)
  ntlm_password_check: NT MD4 password check failed for user plegrand
[2006/09/18 16:00:47, 3] auth/auth_winbind.c:check_winbind_security(80)
  check_winbind_security: Not using winbind, requested domain [TOTEM] was for this SAM.
[2006/09/18 16:00:47, 2] auth/auth.c:check_ntlm_password(312)
  check_ntlm_password:  Authentication for user [plegrand] -> [plegrand] FAILED with error NT_STATUS_WRONG_PASSWORD
[2006/09/18 16:00:47, 1] rpc_server/srv_pipe.c:api_pipe_ntlmssp_verify(414)
  api_pipe_ntlmssp_verify: User [TOTEM]\[plegrand] from machine SERVICE-INFO-01 failed authentication on named pipe samr.
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:process_complete_pdu(752)
  process_complete_pdu: DCE/RPC fault sent on pipe lsass
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b4 nwritten=204
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 127 of length 248
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=160 params=0 setup=2
[2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b4)Transaction 128 of length 45
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 129 of length 104
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe lsarpc opening.
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 130 of length 140
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\lsarpc -> \PIPE\lsass
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\lsarpc
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b5 nwritten=72
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 131 of length 63
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74b5 min=1024 max=1024 nread=68
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 132 of length 188
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=100 params=0 setup=2
[2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "lsarpc" (pnum 74b5)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: LSA_OPENPOLICY2
[2006/09/18 16:00:47, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(181)
  lsa_io_sec_qos: length c does not match size 8
[2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 830
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 133 of length 134
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=46 params=0 setup=2
[2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "lsarpc" (pnum 74b5)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: LSA_QUERYINFOPOLICY
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 512
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 134 of length 100
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 135 of length 140
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b6 nwritten=72
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 136 of length 63
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74b6 min=1024 max=1024 nread=68
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 137 of length 172
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=84 params=0 setup=2
[2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b6)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 138 of length 45
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBclose (pid 12833)
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 139 of length 100
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBntcreateX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/nttrans.c:nt_open_pipe(503)
  nt_open_pipe: Known pipe samr opening.
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 140 of length 140
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBwriteX (pid 12833)
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_pipe_bind_req(860)
  api_pipe_bind_req: \PIPE\samr -> \PIPE\lsass
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:check_bind_req(732)
  check_bind_req for \PIPE\samr
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_write_and_X(199)
  writeX-IPC pnum=74b7 nwritten=72
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 141 of length 63
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBreadX (pid 12833)
[2006/09/18 16:00:47, 3] smbd/pipes.c:reply_pipe_read_and_X(242)
  readX-IPC pnum=74b7 min=1024 max=1024 nread=68
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 142 of length 160
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=72 params=0 setup=2
[2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b7)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_CONNECT4
[2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 754
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 143 of length 164
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=76 params=0 setup=2
[2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b7)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_OPEN_DOMAIN
[2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(251)
[2006/09/18 16:00:47, 3] lib/util_seaccess.c:se_access_check(252)
  se_access_check: user sid is S-1-5-21-3001284405-1458979528-22331195-2062
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2013
  se_access_check: also S-1-1-0
  se_access_check: also S-1-5-2
  se_access_check: also S-1-5-11
  se_access_check: also S-1-5-21-3001284405-1458979528-22331195-2015
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544)
  free_pipe_context: destroying talloc pool of size 732
[2006/09/18 16:00:47, 3] smbd/process.c:process_smb(890)
  Transaction 144 of length 184
[2006/09/18 16:00:47, 3] smbd/process.c:switch_message(685)
  switch message SMBtrans (pid 12833)
[2006/09/18 16:00:47, 3] smbd/ipc.c:reply_trans(538)
  trans <\PIPE\> data=96 params=0 setup=2
[2006/09/18 16:00:47, 3] smbd/ipc.c:named_pipe(334)
  named pipe command on <> name
[2006/09/18 16:00:47, 3] smbd/ipc.c:api_fd_reply(296)
  Got API command 0x26 on pipe "samr" (pnum 74b7)free_pipe_context: destroying talloc pool of size 0
[2006/09/18 16:00:47, 3] rpc_server/srv_pipe.c:api_rpcTNP(1509)
  api_rpcTNP: rpc command: SAMR_LOOKUP_NAMES
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(531, 506) : sec_ctx_stack_ndx = 1
[2006/09/18 16:00:47, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(101) : conn_ctx_stack_ndx = 0
[2006/09/18 16:00:47, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1