search for: xnbxxxxxixz31wwxxxxypxxx

Hello, I have a small test network with a Win2k8R2 DC. I've added a samba4 as second DC in this network. The join seems to run smoothly. But, after the join, this command: ldapsearch -LLL -x -H ldapi://%2Fvar%2Flib%2Fsamba%2Fprivate%2Fldap_priv%2Fldapi -b "dc=test,dc=dom" "(SAMAccountName=Administrateur)" returns some strange results: ? some attributes like unicodePwd

...DC > *and* use the path to the ldb file: > > ldbsearch -H /var/lib/samba/private/sam.ldb -b "DC=example,DC=com" -s > sub "(SAMAccountName=Administrator)" unicodePwd -UAdministrator > # record 1 > dn: CN=Administrator,CN=Users,DC=example,DC=com > unicodePwd:: XnbXXXXXIXZ31WwXXXXYpXXX > > Not that it gets you anywhere, you would now have to crack the > password (and no, that is not a real password) > > What I am trying to say is, there are attributes in AD that you need > to explicitly ask for, some of which you cannot read anyway. Passwords > on AD need to...

...need to run the command on the DC *and* use the path to the ldb file: ldbsearch -H /var/lib/samba/private/sam.ldb -b "DC=example,DC=com" -s sub "(SAMAccountName=Administrator)" unicodePwd -UAdministrator # record 1 dn: CN=Administrator,CN=Users,DC=example,DC=com unicodePwd:: XnbXXXXXIXZ31WwXXXXYpXXX Not that it gets you anywhere, you would now have to crack the password (and no, that is not a real password) What I am trying to say is, there are attributes in AD that you need to explicitly ask for, some of which you cannot read anyway. Passwords on AD need to be changed over port 636 (SSL)...