search for: netsessionenum

Hi Everybody, It seems that there is a bug in the implementation of the MS Windows API function NetSessionEnum. I am using Windows XP against a Samba 3.023d domain controller. When NetSessionEnum is successful it is supposed to return either NERR_Success (0) when it is finished or ERROR_MORE_DATA when there is more data outstanding. In my program which tries to retrieve all currently logged-on users from...

'right structure' is a bit above my level of knowledge.  microsoft documentation on NetSessionEnum level 10 has some sample code but I'm not sure how to implement it... On Wednesday, 12 September 2018, 07:59:50 GMT-7, Andrew Bartlett via samba <samba at lists.samba.org> wrote: On Wed, 2018-09-12 at 14:33 +0000, ray klassen via samba wrote: >  Are you saying that it could...

...That still assumes the appliance is reading the same type of event log (because the eventlog RPC service was superseeded by eventlog6 and the WMI thin, which is the reason I asked for details).  > The appliance in question also supports getting the necessary info > via the netapi call "netsessionenum" I have tried that and a > wireshark dump shows samba replying with WERR_INVALID_LEVEL.  > if you could shed any light on that, I would appreciate it. If you could get the exact details on that, or the capture file if not confidential, that would be good. Note however that the Samba A...

...research the solution could possibly be to create a python script to monitor the json output in log.samba and push out eventlog formatted events to 'Security' with eventlogadm. Seems a lot of work. The appliance in question also supports getting the necessary info via the netapi call "netsessionenum" I have tried that and a wireshark dump shows samba replying with WERR_INVALID_LEVEL. if you could shed any light on that, I would appreciate it. On Monday, 10 September 2018, 18:03:12 GMT-7, Andrew Bartlett via samba <samba at lists.samba.org> wrote: On Mon, 2018-09-10 at 21:...

...he same type of event > log > (because the eventlog RPC service was superseeded by eventlog6 and > the > WMI thin, which is the reason I asked for details).  > > > > > The appliance in question also supports getting the necessary info > > via the netapi call "netsessionenum" I have tried that and a > > wireshark dump shows samba replying with WERR_INVALID_LEVEL.  > > > > if you could shed any light on that, I would appreciate it. > If you could get the exact details on that, or the capture file if > not > confidential, that would be go...

...he same type of event > log > (because the eventlog RPC service was superseeded by eventlog6 and > the > WMI thin, which is the reason I asked for details).  > > > > > The appliance in question also supports getting the necessary info > > via the netapi call "netsessionenum" I have tried that and a > > wireshark dump shows samba replying with WERR_INVALID_LEVEL.  > > > > if you could shed any light on that, I would appreciate it. > If you could get the exact details on that, or the capture file if > not > confidential, that would be go...

...r down the rabbit hole, I would have to create a init_srv_sess_info_10 to go with it? On Wednesday, 12 September 2018, 08:26:11 GMT-7, ray klassen <julius_ahenobarbus at yahoo.co.uk> wrote: 'right structure' is a bit above my level of knowledge.  microsoft documentation on NetSessionEnum level 10 has some sample code but I'm not sure how to implement it... On Wednesday, 12 September 2018, 07:59:50 GMT-7, Andrew Bartlett via samba <samba at lists.samba.org> wrote: On Wed, 2018-09-12 at 14:33 +0000, ray klassen via samba wrote: >  Are you saying that it could...

...That still assumes the appliance is reading the same type of event log (because the eventlog RPC service was superseeded by eventlog6 and the WMI thin, which is the reason I asked for details).  > The appliance in question also supports getting the necessary info > via the netapi call "netsessionenum" I have tried that and a > wireshark dump shows samba replying with WERR_INVALID_LEVEL.  > if you could shed any light on that, I would appreciate it. If you could get the exact details on that, or the capture file if not confidential, that would be good. Note however that the Samba A...

we have recently purchased a security appliance that wants to poll the DC's for login info (ipaddress:logged-in-user) to give more granular access to internet resources this seems possible with samba 4.8.4 my smb.conf     log level = 1 auth_audit:3     eventlog list = Application System Security SyslogLinux It doesn't look like audit events are ending up in