samba - Feb 2013 - net rpc share allowedusers gives "Coult not query secdesc for share"?

Hi all,

[Please CC me in reply, I'm not subscribed]

On two of our machines, "net rpc share allowedusers" gives the error
"Coult not query secdesc for share", partial debug log (-d10) below.

The servers are both running Windows Server 2008 R2 Standard 6.1 but we
have other servers running the same version of Windows so I don't think
that is the issue.

This is definitely not a password issue since changing the password sent
gives a very different error.

Does anyone know what needs to be changed on the Windows side to allow
querying security descriptors remotely? Is this a samba bug?

foo
     srvsvc_NetShareGetInfo: struct srvsvc_NetShareGetInfo
        in: struct srvsvc_NetShareGetInfo
            server_unc               : *
                server_unc               : 'bar'
            share_name               : 'foo'
            level                    : 0x000001f6 (502)
     &r: struct ncacn_packet
        rpc_vers                 : 0x05 (5)
        rpc_vers_minor           : 0x00 (0)
        ptype                    : DCERPC_PKT_REQUEST (0)
        pfc_flags                : 0x03 (3)
        drep: ARRAY(4)
            [0]                      : 0x10 (16)
            [1]                      : 0x00 (0)
            [2]                      : 0x00 (0)
            [3]                      : 0x00 (0)
        frag_length              : 0x0018 (24)
        auth_length              : 0x0000 (0)
        call_id                  : 0x00000067 (103)
        u                        : union dcerpc_payload(case 0)
        request: struct dcerpc_request
            alloc_hint               : 0x00000038 (56)
            context_id               : 0x0000 (0)
            opnum                    : 0x0010 (16)
            object                   : union dcerpc_object(case 0)
            empty: struct dcerpc_empty
            _pad                     : DATA_BLOB length=0
            stub_and_verifier        : DATA_BLOB length=0
rpc_api_pipe: host bar
num_setup=2, max_setup=0, param_total=0, this_param=0, max_param=0,
data_total=80, this_data=80, max_data=4280, param_offset=84, param_pad=2,
param_disp=0, data_offset=84, data_pad=0, data_disp=0
rpc_read_send: data_to_read: 20
     r: struct ncacn_packet
        rpc_vers                 : 0x05 (5)
        rpc_vers_minor           : 0x00 (0)
        ptype                    : DCERPC_PKT_RESPONSE (2)
        pfc_flags                : 0x03 (3)
        drep: ARRAY(4)
            [0]                      : 0x10 (16)
            [1]                      : 0x00 (0)
            [2]                      : 0x00 (0)
            [3]                      : 0x00 (0)
        frag_length              : 0x0024 (36)
        auth_length              : 0x0000 (0)
        call_id                  : 0x00000067 (103)
        u                        : union dcerpc_payload(case 2)
        response: struct dcerpc_response
            alloc_hint               : 0x0000000c (12)
            context_id               : 0x0000 (0)
            cancel_count             : 0x00 (0)
            _pad                     : DATA_BLOB length=1
[0000] 00                                                . 
            stub_and_verifier        : DATA_BLOB length=12
[0000] F6 01 00 00 00 00 00 00   05 00 00 00              ?....... ....
Got pdu len 36, data_len 12, ss_len 0
rpc_api_pipe: got frag len of 36 at offset 0: NT_STATUS_OK
rpc_api_pipe: host bar returned 12 bytes.
     srvsvc_NetShareGetInfo: struct srvsvc_NetShareGetInfo
        out: struct srvsvc_NetShareGetInfo
            info                     : *
                info                     : union srvsvc_NetShareInfo(case 502)
                info502                  : NULL
            result                   : WERR_ACCESS_DENIED
Coult not query secdesc for share foo
rpc command function succedded
return code = 0

-- 
bye,
pabs

http://bonedaddy.net/pabs3/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL:
<http://lists.samba.org/pipermail/samba/attachments/20130227/d717f3b0/attachment.pgp>

On Wed, Feb 27, 2013 at 05:27:47PM +0800, Paul Wise
wrote:
> Hi all,
> 
> [Please CC me in reply, I'm not subscribed]
> 
> On two of our machines, "net rpc share allowedusers" gives the
error
> "Coult not query secdesc for share", partial debug log (-d10)
below.
> 
> The servers are both running Windows Server 2008 R2 Standard 6.1 but we
> have other servers running the same version of Windows so I don't think
> that is the issue.
> 
> This is definitely not a password issue since changing the password sent
> gives a very different error.
> 
> Does anyone know what needs to be changed on the Windows side to allow
> querying security descriptors remotely? Is this a samba bug?
Who are you authenticating as ? Are you doing this as Administrator ?