RPCCLIENT(1)

📦
version 4.24.7 · 27 versions
, in fedora 44

💅 rpcclient — the manual, but make it make sense

Okay bestie, gather round, because we're reading rpcclient(1) from the User Commands section of the manual and it's honestly giving main character energy. This is part 1 of 4, so hydrate and stay with me. 🫶

✨ NAME ✨

rpcclient — the tool for executing client-side MS-RPC functions. That's it, that's the whole vibe. 💅

🦋 SYNOPSIS 🦋

       rpcclient [-c|--command=COMMANDS] [-I|--dest-ip=IP] [-p|--port=PORT]
        [-?|--help] [--usage] [-d|--debuglevel=DEBUGLEVEL] [--debug-stdout]
        [--configfile=CONFIGFILE] [--option=name=value]
        [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full]
        [-R|--name-resolve=NAME-RESOLVE-ORDER]
        [-O|--socket-options=SOCKETOPTIONS] [-m|--max-protocol=MAXPROTOCOL]
        [-n|--netbiosname=NETBIOSNAME] [--netbios-scope=SCOPE]
        [-W|--workgroup=WORKGROUP] [--realm=REALM]
        [-U|--user=[DOMAIN/]USERNAME[%PASSWORD]] [-N|--no-pass]
        [--password=STRING] [--pw-nt-hash] [-A|--authentication-file=FILE]
        [-P|--machine-pass] [--simple-bind-dn=DN]
        [--use-kerberos=desired|required|off] [--use-krb5-ccache=CCACHE]
        [--use-winbind-ccache] [--client-protection=sign|encrypt|off]
        [-V|--version] {BINDING-STRING|HOST}

Look at all those flags, she's serving range. 🌈

🌸 DESCRIPTION 🌸

So, first thing's first: this tool is part of the samba(7) suite. Family reunion energy. 👑

Now the lore: rpcclient started out as a little utility to test MS-RPC functionality inside Samba itself. Then it went through several stages of development and stability — glow-up after glow-up, we love to see it. ✨

And now? Many system administrators have written scripts around it to manage Windows NT clients from their UNIX workstation. Not a phase, it's a lifestyle. Periodt.

💖 OPTIONS 💖

Okay buckle up, this is the long part. Every single one of these matters, no skipping, I will know. 🙈

  • BINDING-STRING|HOST — When you're connecting to a dcerpc service you need to specify a binding string. Non-negotiable, bestie.

The format is:

TRANSPORT:host[options]

where TRANSPORT is either ncacn_np (named pipes) for SMB, or ncacn_ip_tcp for DCERPC over TCP/IP.

"host" is an IP or hostname or netbios name. If the binding string identifies the server side of an endpoint, "host" may be an empty string. See below for more details — yes, there's more, keep scrolling.

"options" can include a SMB pipe name if you're using the ncacn_np transport, or a TCP port number if you're using the ncacn_ip_tcp transport. Otherwise they will be auto-determined for you. The tool's got you. 🫶

Examples — copy these exactly, they're iconic:

  • ncacn_ip_tcp:samba.example.com[1024]
  • ncacn_ip_tcp:samba.example.com[sign,seal,krb5]
  • ncacn_ip_tcp:samba.example.com[sign,spnego]
  • ncacn_np:samba.example.com
  • ncacn_np:samba.example.com[samr]
  • ncacn_np:samba.example.com[samr,sign,print]
  • ncalrpc:/path/to/unix/socket
  • //SAMBA

The supported transports are:

  • ncacn_np — Connect using named pipes
  • ncacn_ip_tcp — Connect over TCP/IP
  • ncalrpc — Connect over local RPC (unix sockets)

The supported options are:

  • sign — Use RPC integrity authentication level
  • seal — Enable RPC privacy (encryption) authentication level
  • connect — Use RPC connect level authentication (auth, but no sign or seal)
  • packet — Use RPC packet authentication level
  • spnego — Use SPNEGO instead of NTLMSSP authentication
  • ntlm — Use plain NTLM instead of SPNEGO or NTLMSSP
  • krb5 — Use Kerberos instead of NTLMSSP authentication
  • schannel — Create a schannel connection
  • smb1 — Use SMB1 for named pipes
  • smb2 — Use SMB2/3 for named pipes
  • validate — Enable the NDR validator
  • print — Enable debug output of packets
  • padcheck — Check reply data for non-zero pad bytes
  • bigendian — Use big endian for RPC
  • ndr64 — Use NDR64 for RPC
  • -c|--command=<command string> — Execute semicolon separated commands (they're listed below, further down the page, patience bestie). 🔥
  • -I|--dest-ip IP-address — IP-address is the address of the server to connect to. Write it in standard "a.b.c.d" notation, no creative formatting please.

Normally the client would try to locate a named SMB/CIFS server by looking it up via the NetBIOS name resolution mechanism described above in the name resolve order parameter. Using this parameter forces the client to assume that the server is on the machine with the specified IP address, and the NetBIOS name component of the resource being connected to will be ignored. Just straight-up ignored, she doesn't even look. 💀

There is no default for this parameter. If you don't supply it, it gets determined automatically by the client as described above.

  • -p|--port port — This number is the TCP port number used when making connections to the server. The standard (well-known) TCP port number for an SMB/CIFS server is 139, which is the default. Classic, timeless, never misses. 👑
  • -?|--help — Print a summary of command line options. When in doubt, ask for help, it's self care. 🎀
  • --usage — Display brief usage message. The short version. The trailer. The teaser. 🦋
  • -d|--debuglevel=level — level is an integer from 0 to 10. The default value if this parameter is not specified is 1 for client applications.

The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for day-to-day running — it generates a small amount of information about operations carried out. Chill, manageable, we love her. 💜

Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic. Like, do not. I'm serious. 😭

Note that specifying this parameter here will override the log level parameter in the /etc/samba/smb.conf file.
  • --debug-stdout — This will redirect debug output to STDOUT. By default all clients are logging to STDERR. Surprise relocation, but make it intentional. ✨
  • --configfile=<configuration file> — The file specified contains the configuration details required by the client. The information in this file can be general for client and server, or it can only provide client specific stuff like options such as client smb encrypt. See /etc/samba/smb.conf for more information. The default configuration file name is determined at compile time — so it was decided for you before you were even born, lowkey. 🌸
  • --option=<name>=<value> — Set the smb.conf(5) option "<name>" to value "<value>" from the command line. This overrides compiled-in defaults and options read from the configuration file. It's giving "I said what I said". 💅
If a name or a value includes a space, wrap whole --option=name=value into quotes.
  • -l|--log-basename=logdirectory — Base directory name for log/debug files. The extension ".progname" will be appended (e.g. log.smbclient, log.smbd, etc...). The log file is never removed by the client. It simply refuses to let go. 😭
  • --leak-report — Enable talloc leak reporting on exit. Snitching on memory, but for your own good. 🕵️
  • --leak-report-full — Enable full talloc leak reporting on exit. The director's cut. The extended edition. 🔥
  • -V|--version — Prints the program version number. Short, sweet, iconic. ⭐
  • -R|--name-resolve=NAME-RESOLVE-ORDER — This option determines what naming services get used, and in what order, to resolve host names to IP addresses. The option takes a space-separated string of different name resolution options. Best practice: wrap the whole --name-resolve=NAME-RESOLVE-ORDER into quotes. 🫶

The options are: "lmhosts", "host", "wins" and "bcast". They cause names to be resolved as follows:

  • lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see the lmhosts(5) for details) then any name type matches for lookup.
  • host: Do a standard host name to IP address resolution, using the system /etc/hosts, NIS, or DNS lookups. This method of name resolution is operating system dependent — for instance on IRIX or Solaris this may be controlled by the /etc/nsswitch.conf file). Note that this method is only used if the NetBIOS name type being queried is the 0x20 (server) name type, otherwise it is ignored. Picky, but valid. 💅
  • wins: Query a name with the IP address listed in the wins server parameter. If no WINS server has been specified this method will be ignored.
  • bcast: Do a broadcast on each of the known local interfaces listed in the interfaces parameter. This is the least reliable of the name resolution methods as it depends on the target host being on a locally connected subnet. Risky business, ngl.

If this parameter is not set then the name resolve order defined in the /etc/samba/smb.conf file parameter (name resolve order) will be used.

The default order is lmhosts, host, wins, bcast. Without this parameter, or any entry in the name resolve order parameter of the /etc/samba/smb.conf file, the name resolution methods will be attempted in this order. That's the canon order, don't fight it. 🌈

  • -O|--socket-options=SOCKETOPTIONS — TCP socket options to set on the client socket. See the socket options parameter in the /etc/samba/smb.conf manual page for the list of valid options. Go read the other manual, she's got the full list. 📖
  • -m|--max-protocol=MAXPROTOCOL — The value of the parameter (a string) is the highest protocol level that will be supported by the client. Set the ceiling, bestie. 🎀
Note that specifying this parameter here will override the client max protocol parameter in the /etc/samba/smb.conf file.
  • -n|--netbiosname=NETBIOSNAME — This option lets you override the NetBIOS name that Samba uses for itself. This is identical to setting the netbios name parameter in the /etc/samba/smb.conf file. However, a command line setting will take precedence over settings in /etc/samba/smb.conf. Command line wins, always, no cap. 👑
  • --netbios-scope=SCOPE — This specifies a NetBIOS scope that nmblookup will use to communicate with when generating NetBIOS names. For details on the use of NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are very rarely used — only set this parameter if you are the system administrator in charge of all the NetBIOS systems you communicate with. That's a lot of responsibility, are you sure? 😭
  • -W|--workgroup=WORKGROUP — Set the SMB domain of the username. This overrides the default domain which is the domain defined in smb.conf. If the domain specified is the same as the servers NetBIOS name, it causes the client to log on using the servers local SAM (as opposed to the Domain SAM). Plot twist, but a useful one. ✨
Note that specifying this parameter here will override the workgroup parameter in the /etc/samba/smb.conf file.
  • -r|--realm=REALM — Set the realm for the domain. Straight to the point. 💜
Note that specifying this parameter here will override the realm parameter in the /etc/samba/smb.conf file.
  • -U|--user=[DOMAIN\]USERNAME[%PASSWORD] — Sets the SMB username or username and password.

Like, if %PASSWORD isn't specified, bestie, the user gets prompted. 💅 And the client goes on a lil scavenger hunt: first it checks the USER environment variable (which is also allowed to smuggle the password in, separated by a %), then it checks LOGNAME (which is not allowed to contain a password, sorry), and if either one exists, that value gets used. If neither of those environment variables is around? The username found in a Kerberos Credentials cache may be used instead. ✨

A third option, and honestly kind of the girlboss move for automation: a credentials file holding the plaintext of the username and password. This one's mainly for scripts where the admin does not want to pass credentials on the command line or through environment variables. If you go this route, you must make certain the permissions on the file restrict access from unwanted users. See the -A for the full tea. 🔐

Be cautious about including passwords in scripts or passing user-supplied values onto the command line. For security it is better to let the Samba client tool ask for the password if needed, or obtain the password once with kinit. No cap, this one's important.

And while Samba will attempt to scrub the password from the process title (the thing you'd see in ps), that happens after startup, so it is subject to a race. 😭 So it's giving "better safe than sorry" energy.

  • -N|--no-pass — if you specify this, it suppresses the normal password prompt from the client to the user. Super useful when you're accessing a service that doesn't require a password at all. Unless a password is specified on the command line or this parameter is specified, the client will request a password. And heads up: if a password is specified on the command line and this option is also defined, the password on the command line will be silently ignored and no password will be used. 🙈
  • --password — specify the password on the commandline. Be cautious about including passwords in scripts or passing user-supplied values onto the command line, fr fr — for security it is better to let the Samba client tool ask for the password if needed, or obtain the password once with kinit. If --password is not specified, the tool will check the PASSWD environment variable, followed by PASSWD_FD, which is expected to contain an open file descriptor (FD) number. And finally it will check PASSWD_FILE (containing a file path to be opened) — that file should only contain the password. Make certain that the permissions on the file restrict access from unwanted users! And while Samba will attempt to scrub the password from the process title (as seen in ps), this is after startup and so is subject to a race. 💀
  • --pw-nt-hash — the supplied password is the NT hash. that's it, that's the option. ✨
  • -A|--authentication-file=filename — this option lets you specify a file to read the username and password used in the connection from. The format of the file is:
username = <value>
password = <value>
domain   = <value>

Make certain that the permissions on the file restrict access from unwanted users! 🫶

  • -P|--machine-pass — use stored machine account password. lowkey iconic for machine accounts.
  • --simple-bind-dn=DN — DN to use for a simple bind.
  • --use-kerberos=desired|required|off — this parameter determines whether Samba client tools will try to authenticate using Kerberos. For Kerberos authentication you should use DNS names instead of IP addresses when connecting to a service. By default, Samba client tools will try to use the default Kerberos credential cache (ccache). In case the ccache does not exist or the -U|--user option was specified, clients will ask to enter a password and will obtain a Kerberos ticket (kinit) for you. If you want to use an alternative Kerberos credential cache, use the --use-krb5-ccache option. Note that specifying this parameter here will override the client use kerberos parameter in the /etc/samba/smb.conf file. 🎀
  • --use-krb5-ccache=CCACHE — specifies the credential cache location for Kerberos authentication. This will enforce --use-kerberos=required. 💅
  • --use-winbind-ccache — try to use the credential cache by winbind.
  • --client-protection=sign|encrypt|off — sets the connection protection the client tool should use. Note that specifying this parameter here will override the client protection parameter in the /etc/samba/smb.conf file. In case you need more fine grained control you can use: --option=clientsmbencrypt=OPTION, --option=clientipcsigning=OPTION, --option=clientsigning=OPTION. 🔥

🎀 COMMANDS 🎀

okay bestie, this is the good part — all the actual RPC commands you can throw at it. buckle up. 🦋

LSARPC

  • lsaquery — query info policy
  • lookupsids — convert SIDs to names
  • lookupsids3 — convert SIDs to names
  • lookupsids_level — convert SIDs to names
  • lookupnames — convert names to SIDs
  • lookupnames4 — convert names to SIDs
  • lookupnames_level — convert names to SIDs
  • enumtrust — enumerate trusted domains
  • enumprivs — enumerate privileges
  • getdispname — get the privilege name
  • lsaenumsid — enumerate the LSA SIDS
  • lsacreateaccount — create a new lsa account
  • lsaenumprivsaccount — enumerate the privileges of an SID
  • lsaenumacctrights — enumerate the rights of an SID
  • lsaaddpriv — assign a privilege to a SID
  • lsadelpriv — revoke a privilege from a SID
  • lsaaddacctrights — add rights to an account
  • lsaremoveacctrights — remove rights from an account
  • lsalookupprivvalue — get a privilege value given its name
  • lsaquerysecobj — query LSA security object
  • lsaquerytrustdominfo — query LSA trusted domains info (given a SID)
  • lsaquerytrustdominfobyname — query LSA trusted domains info (given a name), only works for Windows > 2k
  • lsaquerytrustdominfobysid — query LSA trusted domains info (given a SID)
  • lsasettrustdominfo — set LSA trusted domain info
  • getusername — get username
  • createsecret — create Secret
  • deletesecret — delete Secret
  • querysecret — query Secret
  • setsecret — set Secret
  • retrieveprivatedata — retrieve Private Data
  • storeprivatedata — store Private Data
  • createtrustdom — create Trusted Domain
  • deletetrustdom — delete Trusted Domain

LSARPC-DS

  • dsroledominfo — get Primary Domain Information

DFS

  • dfsversion — query DFS support
  • dfsadd — add a DFS share
  • dfsremove — remove a DFS share
  • dfsgetinfo — query DFS share info
  • dfsenum — enumerate dfs shares
  • dfsenumex — enumerate dfs shares

SHUTDOWN

  • shutdowninit — syntax: shutdown [-m message]
  • shutdownabort — syntax: shutdownabort

SRVSVC

  • srvinfo — server query info
  • netshareenum — enumerate shares
  • netshareenumall — enumerate all shares
  • netsharegetinfo — get Share Info
  • netsharesetinfo — set Share Info
  • netsharesetdfsflags — set DFS flags
  • netfileenum — enumerate open files
  • netremotetod — fetch remote time of day
  • netnamevalidate — validate sharename
  • netfilegetsec — get File security
  • netsessdel — delete Session
  • netsessenum — enumerate Sessions
  • netdiskenum — enumerate Disks
  • netconnenum — enumerate Connections
  • netshareadd — add share
  • netsharedel — delete share

SAMR

  • queryuser — query user info
  • querygroup — query group info
  • queryusergroups — query user groups
  • queryuseraliases — query user aliases
  • querygroupmem — query group membership
  • queryaliasmem — query alias membership
  • queryaliasinfo — query alias info
  • deletealias — delete an alias
  • querydispinfo — query display info
  • querydispinfo2 — query display info
  • querydispinfo3 — query display info
  • querydominfo — query domain info
  • enumdomusers — enumerate domain users
  • enumdomgroups — enumerate domain groups
  • enumalsgroups — enumerate alias groups
  • enumdomains — enumerate domains
  • createdomuser — create domain user
  • createdomgroup — create domain group
  • createdomalias — create domain alias
  • samlookupnames — look up names
  • samlookuprids — look up names
  • deletedomgroup — delete domain group
  • deletedomuser — delete domain user
  • samquerysecobj — query SAMR security object
  • getdompwinfo — retrieve domain password info
  • getusrdompwinfo — retrieve user domain password info
  • lookupdomain — lookup Domain Name
  • chgpasswd — change user password
  • chgpasswd2 — change user password
  • chgpasswd3 — change user password (RC4 encrypted)
  • chgpasswd4 — change user password (AES encrypted)
  • getdispinfoidx — get Display Information Index
  • setuserinfo — set user info
  • setuserinfo2 — set user info2

SPOOLSS

  • adddriver <arch> <config> [<version>] — execute an AddPrinterDriver() RPC to install the printer driver information on the server. Note that the driver files should already exist in the directory returned by getdriverdir. Possible values for arch are the same as those for the getdriverdir command. The config parameter is defined as follows:
Long Driver Name:\
Driver File Name:\
Data File Name:\
Config File Name:\
Help File Name:\
Language Monitor Name:\
Default Data Type:\
Comma Separated list of Files

Any empty fields should be enter as the string "NULL".

Samba does not need to support the concept of Print Monitors since these only apply to local printers whose driver can make use of a bi-directional link for communication. This field should be "NULL". On a remote NT print server, the Print Monitor for a driver must already be installed prior to adding the driver or else the RPC will fail. 😭

The version parameter lets you specify the printer driver version number. If omitted, the default driver version for the specified architecture will be used. This option can be used to upload Windows 2000 (version 3) printer drivers. 🖨️✨

  • addprinter <printername> <sharename> <drivername> <port> — Adds a printer on the remote server, and she gets auto-shared the second she exists ✨. Heads up though: the printer driver has to be already installed on the server first (go look at adddriver), and the port must be a valid port name (peep enumports).
  • deldriver <driver> — Deletes the specified printer driver for all architectures. Ngl this does not delete the actual driver files off the server — it only yanks the entry out of the server's list of drivers. So the vibes are gone, the files are still there 💀.
  • deldriverex <driver> [architecture] [version] [flags] — Deletes the specified printer driver and, optionally, files associated with the driver. You can limit the whole thing to a specific architecture and a specific version. If no architecture is given, all driver files of that driver get deleted. The flags correspond to numeric DPD_* values — so a value of 3 requests (DPD_DELETE_UNUSED_FILES | DPD_DELETE_SPECIFIC_VERSION).
  • enumdata — Enumerates all printer setting data stored on the server 🗂️. On Windows NT clients these values live in the registry, while Samba servers store them in the printers TDB. This one corresponds to the MS Platform SDK GetPrinterData() function (* this command is currently unimplemented).
  • enumdataex — Enumerate printer data for a key 🔑.
  • enumkey — Enumerate printer keys.
  • enumjobs <printer> — Lists the jobs and status of a given printer, bestie 📋. Corresponds to the MS Platform SDK EnumJobs() function.
  • getjob — Get print job. That's it, that's the whole description, she's mysterious like that 🫶.
  • setjob — Set print job.
  • enumports [level] — Executes an EnumPorts() call using the specified info level. Currently only info levels 1 and 2 are supported (yes, only those two, don't come for me).
  • enumdrivers [level] — Executes an EnumPrinterDrivers() call and lists all the various installed printer drivers for all architectures 🖨️. For more details on the various flags and calling options, refer to the MS Platform SDK documentation. Currently supported info levels are 1, 2, and 3.
  • enumprinters [level] — Executes an EnumPrinters() call, listing all the installed and shared printers. Same deal: the MS Platform SDK documentation has the details on the various flags and calling options. Currently supported info levels are 1, 2 and 5.
  • getdata <printername> <valuename;> — Retrieves the data for a given printer setting. Go look at the enumdata command if you want more info. This one corresponds to the GetPrinterData() MS Platform SDK function.
  • getdataex — Get printer driver data with keyname.
  • getdriver <printername> — Retrieves the printer driver information (like driver file, config file, dependent files, etc...) for the given printer 👑. Corresponds to the GetPrinterDriver() MS Platform SDK function. Currently info levels 1, 2, and 3 are supported.
  • getdriverdir <arch> — Executes a GetPrinterDriverDirectory() RPC to retrieve the SMB share name and subdirectory where printer driver files for a given architecture get stored. Possible values for arch are "Windows 4.0" (for Windows 95/98), "Windows NT x86", "Windows NT PowerPC", "Windows Alpha_AXP", and "Windows NT R4000" — yes, real ones, we don't make the rules 🌈.
  • getdriverpackagepath — Get print driver package download directory.
  • getprinter <printername> — Retrieves the current printer information ✨. Corresponds to the GetPrinter() MS Platform SDK function.
  • openprinter <printername> — Executes an OpenPrinterEx() and ClosePrinter() RPC against a given printer.
  • openprinter_ex <printername> — Open printer handle.
  • setdriver <printername> <drivername> — Executes a SetPrinter() command to update the printer driver associated with an installed printer. The printer driver must already be correctly installed on the print server — no shortcuts, bestie 💅.

Also peep the enumprinters and enumdrivers commands for obtaining a list of installed printers and drivers.

  • getprintprocdir — Get print processor directory.
  • addform — Add form.
  • setform — Set form.
  • getform — Get form.
  • deleteform — Delete form.
  • enumforms — Enumerate form.
  • setprinter — Set printer comment.
  • setprinterdata — Set REG_SZ printer data.
  • setprintername <printername> <newprintername> — Set printer name.
  • rffpcnex — Rffpcnex test.
  • printercmp — Printer comparison test.
  • enumprocs — Enumerate Print Processors.
  • enumprocdatatypes — Enumerate Print Processor Data Types.
  • enummonitors — Enumerate Print Monitors.
  • createprinteric — Create Printer IC.
  • playgdiscriptonprinteric — Create Printer IC.
  • getcoreprinterdrivers — Get CorePrinterDriver.
  • enumpermachineconnections — Enumerate Per Machine Connections.
  • addpermachineconnection — Add Per Machine Connection.
  • delpermachineconnection — Delete Per Machine Connection.

🌸 NETLOGON 🌸

  • logonctrl2 — Logon Control 2.
  • getanydcname — Get trusted DC name.
  • getdcname — Get trusted PDC name.
  • dsr_getdcname — Get trusted DC name.
  • dsr_getdcnameex — Get trusted DC name.
  • dsr_getdcnameex2 — Get trusted DC name.
  • dsr_getsitename — Get sitename.
  • dsr_getforesttrustinfo — Get Forest Trust Info.
  • logonctrl — Logon Control.
  • samlogon — Sam Logon.
  • change_trust_pw — Change Trust Account Password.
  • gettrustrid — Get trust rid.
  • dsr_enumtrustdom — Enumerate trusted domains.
  • dsenumdomtrusts — Enumerate all trusted domains in an AD forest 🌈.
  • deregisterdnsrecords — Deregister DNS records.
  • netrenumtrusteddomains — Enumerate trusted domains.
  • netrenumtrusteddomainsex — Enumerate trusted domains.
  • getdcsitecoverage — Get the Site-Coverage from a DC.
  • capabilities — Return Capabilities.
  • logongetdomaininfo — Return LogonGetDomainInfo.

🦋 FSRVP 🦋

  • fss_is_path_sup — Check whether a share supports shadow-copy.
  • fss_get_sup_version — Get supported FSRVP version from server.
  • fss_create_expose — Request shadow-copy creation and exposure.
  • fss_delete — Request shadow-copy share deletion.
  • fss_has_shadow_copy — Check for an associated share shadow-copy.
  • fss_get_mapping — Get shadow-copy share mapping information.
  • fss_recovery_complete — Flag read-write snapshot as recovery complete,

💜 CLUSAPI 💜

  • clusapi_open_cluster — Open cluster.
  • clusapi_get_cluster_name — Get cluster name.
  • clusapi_get_cluster_version — Get cluster version.
  • clusapi_get_quorum_resource — Get quorum resource.
  • clusapi_create_enum — Create enum query.
  • clusapi_create_enumex — Create enumex query.
  • clusapi_open_resource — Open cluster resource.
  • clusapi_online_resource — Set cluster resource online.
  • clusapi_offline_resource — Set cluster resource offline.
  • clusapi_get_resource_state — Get cluster resource state.
  • clusapi_get_cluster_version2 — Get cluster version2.
  • clusapi_pause_node — Pause cluster node.
  • clusapi_resume_node — Resume cluster node.

🎀 DRSUAPI 🎀

  • dscracknames — Crack Name.
  • dsgetdcinfo — Get Domain Controller Info.
  • dsgetncchanges — Get NC Changes.
  • dswriteaccountspn — Write Account SPN.

⭐ ECHO ⭐

  • echoaddone — Add one to a number.
  • echodata — Echo data.
  • sinkdata — Sink data.
  • sourcedata — Source data.

🧚 EPMAPPER 🧚

  • epmmap — Map a binding.
  • epmlookup — Lookup bindings.

🔥 EVENTLOG 🔥

  • eventlog_readlog — Read Eventlog.
  • eventlog_numrecord — Get number of records.
  • eventlog_oldestrecord — Get oldest record.
  • eventlog_reportevent — Report event.
  • eventlog_reporteventsource — Report event and source.
  • eventlog_registerevsource — Register event source.
  • eventlog_backuplog — Backup Eventlog File.
  • eventlog_loginfo — Get Eventlog Information.

🖨️ IRemoteWinspool 🖨️

  • winspool_AsyncOpenPrinter — Open printer handle.
  • winspool_AsyncCorePrinterDriverInstalled — Query Core Printer Driver Installed.

💖 NTSVCS 💖

  • ntsvcs_getversion — Query NTSVCS version.
  • ntsvcs_validatedevinst — Query NTSVCS device instance.
  • ntsvcs_hwprofflags — Query NTSVCS HW prof flags.
  • ntsvcs_hwprofinfo — Query NTSVCS HW prof info.
  • ntsvcs_getdevregprop — Query NTSVCS device registry property.
  • ntsvcs_getdevlistsize — Query NTSVCS device list size.
  • ntsvcs_getdevlist — Query NTSVCS device list.

🍓 MDSSVC 🍓

  • fetch_properties — Fetch connection properties.
  • fetch_attributes — Fetch attributes for a CNID.

👑 WINREG 👑

  • winreg_enumkey — Enumerate Keys.
  • querymultiplevalues — Query multiple values.
  • querymultiplevalues2 — Query multiple values.

💅 WITNESS 💅

  • GetInterfaceList — List the interfaces to which witness client connections can be made.
  • Register — Register for resource state change notifications of a NetName and IPAddress.
  • UnRegister — Unregister for notifications from the server.
  • AsyncNotify — Request notification of registered resource changes from the server.
  • RegisterEx — Register for resource state change notifications of a NetName, ShareName and multiple IPAddresses.

🌈 WKSSVC 🌈

  • wkssvc_wkstagetinfo — Query WKSSVC Workstation Information.
  • wkssvc_getjoininformation — Query WKSSVC Join Information.
  • wkssvc_messagebuffersend — Send WKSSVC message.
  • wkssvc_enumeratecomputernames — Enumerate WKSSVC computer names.
  • wkssvc_enumerateusers — Enumerate WKSSVC users.

✨ GENERAL OPTIONS ✨

  • help — Get help on commands 🫶.
  • ? — Get help on commands (same energy, different key).
  • debuglevel — Set debug level.
  • debug — Set debug level.
  • list — List available commands on pipe.
  • exit — Exit program.
  • quit — Exit program.
  • sign — Force RPC pipe connections to be signed.
  • seal — Force RPC pipe connections to be sealed.
  • packet — Force RPC pipe connections with packet authentication level.
  • schannel — Force RPC pipe connections to be sealed with 'schannel'. Assumes valid machine account to this domain controller. (The page literally says the sealing thing twice, and honestly? we respect the commitment.)
  • schannelsign — Force RPC pipe connections to be signed (not sealed) with 'schannel'. Assumes valid machine account to this domain controller.
  • timeout — Set timeout (in milliseconds) for RPC operations ⏱️.
  • transport — pick the ncacn transport for RPC operations 💅
  • none — forces RPC pipe connections to have no special properties. that's it, that's the whole vibe. ✨

💀 BUGS 💀

okay bestie, real talk, no filter: rpcclient is literally designed as a developer testing tool, so it may not be robust in certain areas — like, for example, command line parsing. and yes, it has been known to generate a core dump upon failures when invalid parameters were passed to the interpreter. it's giving chaotic energy fr fr. 😭

and now, straight from Luke Leighton's original rpcclient man page, because this warning is iconic and deserves to be preserved in amber:

WARNING! The MSRPC over SMB code has been developed from examining Network traces. No documentation is available from the original creators (Microsoft) on how MSRPC over SMB works, or how the individual MSRPC services work. Microsoft's implementation of these services has been demonstrated (and reported) to be... a bit flaky in places.

not me reading that and going 💀 — "a bit flaky in places" is the most polite way anyone has ever described a whole protocol stack, periodt.

The development of Samba's implementation is also a bit rough, and as more of the services are understood, it can even result in versions of smbd(8) and rpcclient(1) that are incompatible for some commands or services. 😭 additionally, the developers are sending reports to Microsoft, and problems found or reported to Microsoft are fixed in Service Packs, which may result in incompatibilities. so like… the bugs get fixed over there and then everything gets more mismatched over here. the way that this is just how it is 🙈

🌈 VERSION 🌈

This man page is part of version 4.24.7 of the Samba suite. 🫶

👑 AUTHOR 👑

The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. 🌸

The original rpcclient man page was written by Matthew Geddes, Luke Kenneth Casson Leighton, and rewritten by Gerald Carter. The conversion to DocBook for Samba 2.2 was done by Gerald Carter. The conversion to DocBook XML 4.2 for Samba 3.0 was done by Alexander Bokovoy. 👑

and that's the whole page, bestie!! 🎀 you made it to the end, I'm so proud of you fr fr 💖

this one's Samba 4.24.7, dated 09/09/2026, and it's the RPCCLIENT(1) manual page — so go forth, poke at some RPC pipes, and remember: if it core dumps, that's not a you problem, that's canon. 😭💅✨

📦 where this page comes from