NET(8)

NET(8) — System Administration tools

okay bestie, welcome to the net page 💅 this is the Samba admin tool that speaks to Samba and remote CIFS servers, and we are going to read it together. no cap. more parts are coming, so stay hydrated 🫶

✨ NAME ✨

net — Tool for administration of Samba and remote CIFS servers. periodt.

🦋 SYNOPSIS 🦋

       net {<ads|rap|rpc>} [-h|--help] [-d|--debuglevel=DEBUGLEVEL]
        [--debug-stdout] [--configfile=CONFIGFILE] [--option=name=value]
        [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full]
        [-R|--name-resolve=NAME-RESOLVE-ORDER]
        [-O|--socket-options=SOCKETOPTIONS] [-m|--max-protocol=MAXPROTOCOL]
        [-n|--netbiosname=NETBIOSNAME] [--netbios-scope=SCOPE]
        [-W|--workgroup=WORKGROUP] [--realm=REALM]
        [-U|--user=[DOMAIN/]USERNAME[%PASSWORD]] [-N|--no-pass]
        [--password=STRING] [--pw-nt-hash] [-A|--authentication-file=FILE]
        [-P|--machine-pass] [--simple-bind-dn=DN]
        [--use-kerberos=desired|required|off] [--use-krb5-ccache=CCACHE]
        [--use-winbind-ccache] [--client-protection=sign|encrypt|off]
        [-V|--version] [-w|--target-workgroup workgroup]
        [-I|--ipaddress ip-address] [-p|--port port] [--myname]
        [-S|--server server] [--long] [-v|--verbose] [-f|--force]
        [--request-timeout seconds] [-t|--timeout seconds]
        [--dns-ttl TTL-IN-SECONDS] [-i|--stdin]
        [--witness-registration=REGISTRATION_UUID] [--witness-net-name=REGEX]
        [--witness-share-name=REGEX] [--witness-ip-address=REGEX]
        [--witness-client-computer-name=REGEX] [--witness-apply-to-all]
        [--witness-new-node=NODEID] [--witness-new-ip=IPADDRESS]
        [--witness-forced-response=JSON]

💖 DESCRIPTION 💖

This tool is part of the samba(7) suite. 👑

The Samba net utility is meant to work just like the net utility available for Windows and DOS. The first argument should be used to specify the protocol to use when executing a certain command. ADS is used for ActiveDirectory, RAP is using for old (Win9x/NT3) clients and RPC can be used for NT4 and Windows 2000. If this argument is omitted, net will try to determine it automatically. Not all commands are available on all protocols. so like, choose your protocol wisely bestie 💅

🌸 OPTIONS 🌸

-w, --target-workgroup target-workgroup — Sets target workgroup or domain. You have to specify either this option or the IP address or the name of a server.
-I, --ipaddress ip-address — IP address of target server to use. You have to specify either this option or a target workgroup or a target server.
-p, --port port — Port on the target server to connect to (usually 139 or 445). Defaults to trying 445 first, then 139.
-S, --server server — Name of target server. You should specify either this option or a target workgroup or a target IP address.
--long — When listing data, give more information on each item.
-v, --verbose — When listing data, give more verbose information on each item.
-f, --force — Enforcing a net command.
--request-timeout 30 — Let client requests timeout after 30 seconds the default is 10 seconds.
-t, --timeout 30 — Set timeout for client operations to 30 seconds.
-i, --stdin — Take input for net commands from standard input.
-T, --test — Only test command sequence, dry-run.
-F, --flags FLAGS — Pass down integer flags to a net subcommand.
-C, --comment COMMENT — Pass down a comment string to a net subcommand.
--myname MYNAME — Use MYNAME as a requester name for a net subcommand.
-c, --container CONTAINER — Use a specific AD container for net ads operations.
-M, --maxusers MAXUSERS — Fill in the maxusers field in net rpc share operations.
-r, --reboot — Reboot a remote machine after a command has been successfully executed (e.g. in remote join operations).
--force-full-repl — When calling "net rpc vampire keytab" this option enforces a full re-creation of the generated keytab file.
--single-obj-repl — When calling "net rpc vampire keytab" this option allows one to replicate just a single object to the generated keytab file.
--clean-old-entries — When calling "net rpc vampire keytab" this option allows one to cleanup old entries from the generated keytab file.
--db — Define dbfile for "net idmap" commands.
--lock — Activates locking of the dbfile for "net idmap check" command.
-a, --auto — Activates noninteractive mode in "net idmap check".
--repair — Activates repair mode in "net idmap check".
--acls — Includes ACLs to be copied in "net rpc share migrate".
--attrs — Includes file attributes to be copied in "net rpc share migrate".
--timestamps — Includes timestamps to be copied in "net rpc share migrate".
-X, --exclude DIRECTORY — Allows one to exclude directories when copying with "net rpc share migrate".
--destination SERVERNAME — Defines the target servername of migration process (defaults to localhost).
-L, --local — Sets the type of group mapping to local (used in "net groupmap set").
-D, --domain — Sets the type of group mapping to domain (used in "net groupmap set").
-N, --ntname NTNAME — Sets the ntname of a group mapping (used in "net groupmap set").
--rid RID — Sets the rid of a group mapping (used in "net groupmap set").
--reg-version REG_VERSION — Assume database version {n|1,2,3} (used in "net registry check").
-o, --output FILENAME — Output database file (used in "net registry check").
--wipe — Create a new database from scratch (used in "net registry check").
--precheck PRECHECK_DB_FILENAME — Defines filename for database prechecking (used in "net registry import").
--no-dns-updates — Do not perform DNS updates as part of "net ads join".
--keep-account — Prevent the machine account removal as part of "net ads leave".
--json — Report results in JSON format for "net ads info" and "net ads lookup".
--recursive — Traverse a directory hierarchy.
--continue — Continue traversing a directory hierarchy in case conversion of one file fails.
--follow-symlinks — Follow symlinks encountered while traversing a directory.
--dns-ttl TTL-IN-SECONDS — Specify the Time to Live (TTL) of DNS records. DNS records will be created or updated with the given TTL. The TTL is specified in seconds. Can be used with "net ads dns register" and "net ads join". The default is 3600 seconds.
--witness-registration=REGISTRATION_UUID — This does a direct lookup for REGISTRATION_UUID instead of doing a database traversal.
--witness-net-name=REGEX — This specifies the 'server name' the client registered for monitoring.
--witness-share-name=REGEX — This specifies the 'share name' the client registered for monitoring. Note that the share name is optional in the registration, otherwise an empty string is matched.
--witness-ip-address=REGEX — This specifies the ip address the client registered for monitoring.
--witness-client-computer-name=REGEX — This specifies the client computer name the client specified in the registration. Note it is just a string chosen by the client itself.
--witness-apply-to-all — This selects all registrations.
--witness-new-node=NODEID — By specifying a NODEID all ip addresses currently available on the given node are included in the response. By specifying '-1' as NODEID all ip addresses of the cluster are included in the response.
--witness-new-ip=IPADDRESS — By specifying an IPADDRESS only the specified ip address is included in the response.
--witness-forced-response=JSON — This allows the generation of very complex witness_notifyResponse structures.
-d, --debuglevel=level — level is an integer from 0 to 10. The default value if this parameter is not specified is 1 for client applications.

The higher this value, the more detail will be logged to the log files about the activities of the server. At level 0, only critical errors and serious warnings will be logged. Level 1 is a reasonable level for day-to-day running - it generates a small amount of information about operations carried out.

Levels above 1 will generate considerable amounts of log data, and should only be used when investigating a problem. Levels above 3 are designed for use only by developers and generate HUGE amounts of log data, most of which is extremely cryptic.

Note that specifying this parameter here will override the log level parameter in the /etc/samba/smb.conf file.

--debug-stdout — This will redirect debug output to STDOUT. By default all clients are logging to STDERR.
--configfile=<configuration file> — The file specified contains the configuration details required by the client. The information in this file can be general for client and server or only provide client specific like options such as client smb encrypt. See /etc/samba/smb.conf for more information. The default configuration file name is determined at compile time.
--option=<name>=<value> — Set smb.conf(5) option "<name>" to value "<value>" from the command line. This overrides compiled-in defaults and options read from the configuration file. If a name or a value includes a space, wrap whole --option=name=value into quotes.
-l, --log-basename=logdirectory — Base directory name for log/debug files. The extension ".progname" will be appended (e.g. log.smbclient, log.smbd, etc...). The log file is never removed by the client.
--leak-report — Enable talloc leak reporting on exit.
--leak-report-full — Enable full talloc leak reporting on exit.
-V, --version — Prints the program version number.
-R, --name-resolve=NAME-RESOLVE-ORDER — This option is used to determine what naming services and in what order to resolve host names to IP addresses. The option takes a space-separated string of different name resolution options. The best is to wrap the whole --name-resolve=NAME-RESOLVE-ORDER into quotes.

The options are: "lmhosts", "host", "wins" and "bcast". They cause names to be resolved as follows:

lmhosts: Lookup an IP address in the Samba lmhosts file. If the line in lmhosts has no name type attached to the NetBIOS name (see the lmhosts(5) for details) then any name type matches for lookup.

host: does a standard host name → IP address resolution, using the system /etc/hosts, NIS, or DNS lookups. Heads up bestie, this method is operating system dependent — on IRIX or Solaris it may be controlled by the /etc/nsswitch.conf file. Also: this method only gets used if the NetBIOS name type being queried is the 0x20 (server) name type. Otherwise it's ignored, no thoughts, head empty.
wins: query a name with the IP address listed in the wins server parameter. If no WINS server has been specified, this method is ignored, full stop.
bcast: do a broadcast on each of the known local interfaces listed in the interfaces parameter. This is the least reliable of the name resolution methods, because it depends on the target host being on a locally connected subnet. it's giving "hope for the best" 💀

If this parameter isn't set, then the name resolve order defined in the /etc/samba/smb.conf file parameter (name resolve order) gets used instead.

The default order is lmhosts, host, wins, bcast. So without this parameter, or without any entry in the name resolve order parameter of the /etc/samba/smb.conf file, the name resolution methods get attempted in exactly that order. periodt.

-O, --socket-options=SOCKETOPTIONS — TCP socket options to set on the client socket. Wanna know what's valid? Go check the socket options parameter in the /etc/samba/smb.conf manual page for the list of valid options. ✨
-m, --max-protocol=MAXPROTOCOL — the value of the parameter (a string, bestie) is the highest protocol level the client will support.

Note that specifying this parameter here overrides the client max protocol parameter in the /etc/samba/smb.conf file. command line stays winning, no cap.

-n, --netbiosname=NETBIOSNAME — lets you override the NetBIOS name that Samba uses for itself. This is identical to setting the netbios name parameter in the /etc/samba/smb.conf file. BUT. a command line setting takes precedence over settings in /etc/samba/smb.conf. 💅
--netbios-scope=SCOPE — specifies a NetBIOS scope that nmblookup will use to communicate with when generating NetBIOS names. For the full lore on NetBIOS scopes, see rfc1001.txt and rfc1002.txt. NetBIOS scopes are very rarely used — only set this parameter if you are literally the system administrator in charge of all the NetBIOS systems you communicate with. like, all of them. every single one. 👑
-W, --workgroup=WORKGROUP — set the SMB domain of the username. This overrides the default domain, which is the domain defined in smb.conf. If the domain specified is the same as the server's NetBIOS name, it causes the client to log on using the server's local SAM (as opposed to the Domain SAM).

Note that specifying this parameter here will override the workgroup parameter in the /etc/samba/smb.conf file.

-r, --realm=REALM — set the realm for the domain.

Note that specifying this parameter here will override the realm parameter in the /etc/samba/smb.conf file.

-U, --user=[DOMAIN\]USERNAME[%PASSWORD] — sets the SMB username, or username and password.

If %PASSWORD isn't specified, the user gets prompted. The client will first check the USER environment variable (which is also permitted to contain the password, separated by a %), then the LOGNAME variable (which is not permitted to contain a password), and if either of those exists, that value gets used. If these environmental variables are not found, the username found in a Kerberos Credentials cache may be used.

A third option is to use a credentials file, which contains the plaintext of the username and password. This option is mainly provided for scripts where the admin does not wish to pass the credentials on the command line or via environment variables. If this method is used, make certain that the permissions on the file restrict access from unwanted users. See the -A for more details.

Be cautious about including passwords in scripts or passing user-supplied values onto the command line. For security it is better to let the Samba client tool ask for the password if needed, or obtain the password once with kinit. 🫶

While Samba will attempt to scrub the password from the process title (as seen in ps), this is after startup, and so is subject to a race. yeah. a race. scary. 😭

-N, --no-pass — if specified, this parameter suppresses the normal password prompt from the client to the user. Super useful when accessing a service that doesn't require a password.

Unless a password is specified on the command line, or this parameter is specified, the client will request a password.

If a password is specified on the command line and this option is also defined, the password on the command line will be silently ignored and no password will be used. gone. reduced to atoms. 🌸

--password — specify the password on the commandline.

Be cautious about including passwords in scripts or passing user-supplied values onto the command line. For security it is better to let the Samba client tool ask for the password if needed, or obtain the password once with kinit. 💖

If --password is not specified, the tool will check the PASSWD environment variable, followed by PASSWD_FD, which is expected to contain an open file descriptor (FD) number.

Finally it will check PASSWD_FILE (containing a file path to be opened). The file should only contain the password. Make certain that the permissions on the file restrict access from unwanted users! 🔥

While Samba will attempt to scrub the password from the process title (as seen in ps), this is after startup and so is subject to a race.

--pw-nt-hash — the supplied password is the NT hash. that's it, that's the whole thing.
-A, --authentication-file=filename — lets you specify a file from which to read the username and password used in the connection. The format of the file is:

username = <value>
password = <value>
domain   = <value>

Make certain that the permissions on the file restrict access from unwanted users! 🙈

-P, --machine-pass — use stored machine account password.
--simple-bind-dn=DN — DN to use for a simple bind.
--use-kerberos=desired|required|off — this parameter determines whether Samba client tools will try to authenticate using Kerberos. For Kerberos authentication you should use DNS names instead of IP addresses when connecting to a service. By default Samba client tools will try to use the default Kerberos credential cache (ccache). In case the ccache does not exist, or the -U|--user option was specified, clients will ask to enter a password and will obtain a Kerberos ticket (kinit) for you. If you want to use an alternative Kerberos credentical cache, use the --use-krb5-ccache option.

Note that specifying this parameter here will override the client use kerberos parameter in the /etc/samba/smb.conf file.

--use-krb5-ccache=CCACHE — specifies the credential cache location for Kerberos authentication.

This will enforce --use-kerberos=required. no negotiating, bestie. 💅

--use-winbind-ccache — try to use the credential cache by winbind.
--client-protection=sign|encrypt|off — sets the connection protection the client tool should use.

Note that specifying this parameter here will override the client protection parameter in the /etc/samba/smb.conf file.

In case you need more fine grained control you can use: --option=clientsmbencrypt=OPTION, --option=clientipcsigning=OPTION, --option=clientsigning=OPTION. 🎀

💥 COMMANDS 💥

CHANGESECRETPW

This command allows the Samba machine account password to be set from an external application to a machine account password that has already been stored in Active Directory.

DO NOT USE this command unless you know exactly what you are doing. 😭

The use of this command requires that the force flag (-f) be used also. There will be NO command prompt. Whatever information is piped into stdin, either by typing at the command line or otherwise, will be stored as the literal machine password.

Do NOT use this without care and attention, as it will overwrite a legitimate machine password without warning.

YOU HAVE BEEN WARNED. 🚨

TIME

The NET TIME command allows you to view the time on a remote server, or synchronise the time on the local server with the time on the remote server. clock girlies rise up ⏰✨

TIME

Without any options, the NET TIME command displays the time on the remote server. The remote server must be specified with the -S option.

TIME

Wait no, this one's the same name in the original, bestie, I'm just keeping it exactly as-is. 👑 Moving on:

TIME SYSTEM

Displays the time on the remote server in a format ready for /bin/date. The remote server must be specified with the -S option.

TIME SET

Tries to set the date and time of the local server to that on the remote server, using /bin/date. The remote server must be specified with the -S option.

TIME ZONE

Displays the timezone in hours from GMT on the remote server. The remote server must be specified with the -S option.

[RPC|ADS] JOIN [TYPE] [--no-dns-updates] [-U username[%password]] [dnshostname=FQDN] [createupn=UPN] [createcomputer=OU] [machinepass=PASS] [osName=string osVer=string] [options]

Join a domain. If the account already exists on the server, and [TYPE] is MEMBER, the machine will attempt to join automatically. (Assuming that the machine has been created in server manager.) Otherwise, a password will be prompted for, and a new account may be created.

[TYPE] may be PDC, BDC or MEMBER, to specify the type of server joining the domain.
[FQDN] (ADS only) set the dnsHostName attribute during the join. The default format is netbiosname.dnsdomain.
[UPN] (ADS only) set the principalname attribute during the join. The default format is host/netbiosname@REALM.
[OU] (ADS only) precreate the computer account in a specific OU. The OU string reads from top to bottom without RDNs, and is delimited by a /. Please note that \ is used for escape by both the shell and ldap, so it may need to be doubled or quadrupled to pass through, and it is not used as a delimiter. 💀
[PASS] (ADS only) set a specific password on the computer account being created by the join.
[osName=string osVer=String] (ADS only) set the operatingSystem and operatingSystemVersion attribute during the join. Both parameters must be specified for either to take effect.

[RPC] OLDJOIN [options] — join a domain, but the old school way 🧓✨. You use OLDJOIN if you wanna join with the legacy style of domain joining, and that means you gotta go make a trust account in server manager first, bestie. No account, no join. Periodt.
[RPC|ADS] USER
[RPC|ADS] USER — list every single user. (Yes, she's in here twice. She's just Like That. 💅 Same command, same energy.)
[RPC|ADS] USER DELETE target — yeet the user you point at. Gone. Bye. 💀
[RPC|ADS] USER INFO target — lists all the domain groups that the specified user is living in 🫶.
[RPC|ADS] USER RENAME oldname newname — glow-up for a username, literally rename them.
[RPC|ADS] USER ADD name [password] [-F user flags] [-C comment] — adds the specified user, new bestie acquired 🌸.
[RPC|ADS] GROUP
[RPC|ADS] GROUP [misc options] [targets] — list out the user groups 👑
[RPC|ADS] GROUP DELETE name [misc. options] — delete the group you named, no cap.
[RPC|ADS] GROUP ADD name [-C comment] — make the specified group, fresh group just dropped ✨
[ADS] LOOKUP — finds the closest Domain Controller in our domain and pulls the server info off it like a little detective 🔍
[RAP|RPC] SHARE
[RAP|RPC] SHARE [misc. options] [targets] — enumerates every exported resource (aka network share) on the target server. Full tour of what's being shared 🎀
[RAP|RPC] SHARE ADD name=serverpath [-C comment] [-M maxusers] [targets] — adds a share from a server, which makes that export go active. And Maxusers = how many users can be connected to that share at the same time, so like, set it wisely bestie 🫶
SHARE DELETE sharename — delete the specified share, it's giving cleanup day ✨
[RPC|RAP] FILE
[RPC|RAP] FILE — list all the open files on the remote server. (Again: in there twice. Iconic behavior, honestly. 💅)
[RPC|RAP] FILE CLOSE fileid — closes the file with the fileid you give it on the remote server. Snip snip 🔥
[RPC|RAP] FILE INFO fileid — prints the info on the specified fileid. Right now it lists these: file-id, username, locks, path, permissions. A whole lil dossier 📋
[RAP|RPC] FILE USER user — lists the files that the specified user opened. ⚠️ Heads up though: net rap file user does not work against Samba servers. Not a vibe, but them's the rules.
SESSION
RAP SESSION — with no other options, SESSION enumerates ALL the active SMB/CIFS sessions on the target server. Everybody who's here, accounted for 👀
RAP SESSION DELETE|CLOSE CLIENT_NAME — close the specified session(s). Yeah, that one too 🚪
RAP SESSION INFO CLIENT_NAME — gives you a list of every open file in the specified session 🦋
RAP SERVER DOMAIN — lists all servers in the specified domain or workgroup. If you don't say which, it defaults to the local domain.
RAP DOMAIN — lists every domain and workgroup visible on the current network 🌈
RAP PRINTQ
RAP PRINTQ INFO QUEUE_NAME — lists the specified print queue and its print jobs on the server. If you leave out QUEUE_NAME, it lists all the queues 🖨️
RAP PRINTQ DELETE JOBID — deletes the job with the specified id. Cancelled, fr fr.
RAP VALIDATE user [password] — validates whether the specified user can actually log in to the remote server. If you don't put the password on the command line, it'll prompt you for it 💬

Note: Currently NOT implemented. Don't come for me, it's just not there 🙈

RAP GROUPMEMBER
RAP GROUPMEMBER LIST GROUP — lists all the members of the specified group 🫂
RAP GROUPMEMBER DELETE GROUP USER — delete a member from the group. Removed from the group chat 😭
RAP GROUPMEMBER ADD GROUP USER — add a member to the group. Welcome to the group chat 💖
RAP ADMIN command — executes the specified command on the remote server. Only works with OS/2 servers, so, niche 💀

Note: Currently NOT implemented.

RAP SERVICE
RAP SERVICE START NAME [arguments...] — starts the specified service on the remote server. Not implemented yet, bestie 🥲

Note: Currently NOT implemented.

RAP SERVICE STOP — stops the specified service on the remote server 🛑

Note: Currently NOT implemented.

RAP PASSWORD USER OLDPASS NEWPASS — changes the password of USER from OLDPASS to NEWPASS 🔐
LOOKUP
LOOKUP HOST HOSTNAME [TYPE] — looks up the IP address of the given host using the specified type (that's the netbios suffix). The type defaults to 0x20 (which means workstation) 🖥️
LOOKUP LDAP [DOMAIN] — gives you the IP address of the LDAP server for the specified DOMAIN. Defaults to the local domain.
LOOKUP KDC [REALM] — gives you the IP address of the KDC for the specified REALM. Defaults to the local realm ⭐
LOOKUP DC [DOMAIN] — gives you the IP's of the Domain Controllers for the specified DOMAIN. Defaults to the local domain.
LOOKUP MASTER DOMAIN — gives you the IP of the master browser for the specified DOMAIN or workgroup. Defaults to the local domain 👑
LOOKUP NAME [NAME] — looks up the username's sid and type for the specified NAME 🔍
LOOKUP SID [SID] — gives you the sid's name and type for the specified SID 💫
LOOKUP DSGETDCNAME [NAME] [FLAGS] [SITENAME] — gives you Domain Controller information for the specified domain NAME 🎀
CACHE — okay so Samba uses a general caching interface called gencache. You control it with NET CACHE 🗂️

All the timeout parameters support these suffixes:

s — Seconds
m — Minutes
h — Hours
d — Days
w — Weeks

CACHE ADD key data time-out — adds the specified key+data to the cache with the given timeout ⏱️
CACHE DEL key — deletes the key from the cache. Poof 💨
CACHE SET key data time-out — updates the data of an existing cache entry.
CACHE SEARCH PATTERN — searches for the specified pattern in the cache data 🔎
CACHE LIST — lists every current item in the cache 📝
CACHE FLUSH — removes ALL the current items from the cache. Total reset, clean slate 🌸
GETLOCALSID [DOMAIN] — prints the SID of the specified domain, or if you don't pass the parameter, the SID of the local server 🖨️
SETLOCALSID S-1-5-21-x-y-z — sets the SID for the local server to the specified SID 🔧
GETDOMAINSID — prints the local machine SID and the SID of the current domain 💜
SETDOMAINSID — sets the SID of the current domain.
GROUPMAP — manages the mappings between Windows group SIDs and UNIX groups. The common options include:
- unixgroup — name of the UNIX group
- ntgroup — name of the Windows NT group (it has to be resolvable to a SID)
- rid — unsigned 32-bit integer
- sid — full SID in the form of "S-1-..."
- type — type of the group; either 'domain', 'local', or 'builtin'
- comment — freeform text description of the group
GROUPMAP ADD — adds a new group mapping entry:

net groupmap add {rid=int|sid=string} unixgroup=string \
     [type={domain|local}] [ntgroup=string] [comment=string]

GROUPMAP DELETE — deletes a group mapping entry. And if more than one group name matches, the first entry found is the one that gets deleted, so careful 👀

net groupmap delete {ntgroup=string|sid=SID}

GROUPMAP MODIFY — updates an existing group entry ✨

net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] \
      [comment=string] [type={domain|local}]

GROUPMAP LIST — lists the existing group mapping entries 📋

net groupmap list [verbose] [ntgroup=string] [sid=SID]

MAXRID — prints out the highest RID currently in use on the local server (by the active 'passdb backend') 🔢
RPC INFO — prints info about the domain of the remote server, like the domain name, the domain sid, and how many users and groups there are 🫶
[RPC|ADS] TESTJOIN — checks whether participation in a domain is still valid. Like a vibe check but for your domain membership 💅
[RPC|ADS] CHANGETRUSTPW — forces a change of the domain trust password 🔐
RPC TRUSTDOM
RPC TRUSTDOM ADD DOMAIN — adds an interdomain trust account for DOMAIN. Fun fact: this is actually a Samba account named DOMAIN$ with the account flag 'I' (interdomain trust account). This is required for incoming trusts to work — it makes Samba be a trusted domain of the foreign (trusting) domain. Users of the Samba domain will then be made available in the foreign domain. And if you run this command against localhost, it has the same effect as smbpasswd -a -i DOMAIN. ⚠️ Also note: both commands expect an appropriate UNIX account, so don't forget that part 🫠
RPC TRUSTDOM DEL DOMAIN — removes the interdomain trust account for DOMAIN. If you run it against localhost, it has the same effect as smbpasswd -x DOMAIN$ 🗑️
RPC TRUSTDOM ESTABLISH DOMAIN — establishes a trust relationship to a trusted domain. The interdomain account must already be created on the remote PDC. This is required for outgoing trusts to work — it makes Samba be a trusting domain of a foreign (trusted) domain. Users of the foreign domain will be made available in our domain, and you'll need winbind plus a working idmap config to make them actually show up in your system 🧚
RPC TRUSTDOM REVOKE DOMAIN — abandons the relationship to the trusted domain. It's not you, it's the trust 💔
RPC TRUSTDOM LIST — lists all the interdomain trust relationships 💖
RPC TRUST
RPC TRUST CREATE — creates a trust object by calling lsaCreateTrustedDomainEx2. You can do this on a single server, or on two servers at once with the option to use a random trust password 🎀

Options:

otherserver — Domain controller of the second domain
otheruser — Admin user in the second domain
otherdomainsid — SID of the second domain
other_netbios_domain — NetBIOS (short) name of the second domain
otherdomain — DNS (full) name of the second domain
trustpw — Trust password

Examples:

Create a trust object on srv1.dom1.dom for the domain dom2:

net rpc trust create \
    otherdomainsid=S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx \
    other_netbios_domain=dom2 \
    otherdomain=dom2.dom \
    trustpw=12345678 \
    -S srv1.dom1.dom

Create a trust relationship between dom1 and dom2:

net rpc trust create \
    otherserver=srv2.dom2.test \
    otheruser=dom2adm \
    -S srv1.dom1.dom

RPC TRUST DELETE — deletes a trust object by calling lsaDeleteTrustedDomain. You can do this on a single server, or on two servers at once 🫶

Options:

otherserver — Domain controller of the second domain
otheruser — Admin user in the second domain
otherdomainsid — SID of the second domain

Examples:

Delete a trust object on srv1.dom1.dom for the domain dom2:

net rpc trust delete \
    otherdomainsid=S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx \
    -S srv1.dom1.dom

Delete a trust relationship between dom1 and dom2:

net rpc trust delete \
    otherserver=srv2.dom2.test \
    otheruser=dom2adm \
    -S srv1.dom1.dom

RPC RIGHTS — this subcommand is for viewing and managing Samba's rights assignments (they also get called privileges, iykyk). There are three options currently available: list, grant, and revoke. If you want more details on Samba's privilege model and how to use it, go check the Samba-HOWTO-Collection 📚
RPC ABORTSHUTDOWN — aborts the shutdown of a remote server. Saved it 🙌
RPC SHUTDOWN [-t timeout] [-r] [-f] [-C message] — shuts down the remote server 🛑
- -r — Reboot after shutdown.
- -f — Force shutting down all applications.
- -t timeout — Timeout before the system will be shut down. An interactive user of the system can use this time to cancel the shutdown. So like, give them a lil grace period 🕰️
- -C message — Display the specified message on the screen to announce the shutdown. A lil heads-up note before it all goes down 📢
RPC SAMDUMP — prints out the sam database of the remote server. You need to run this against the PDC, from a Samba machine that's joined as a BDC 👑

🧛 RPC VAMPIRE 🧛

Okay so bestie, this one sucks the life out of a remote server and pours it into your local one — exporting users, aliases and groups from a remote server to a local server. 💉✨

You need to run this against the PDC, from a Samba machine that's joined as a BDC. Also, absolutely crucial: this vampire command cannot be used against an Active Directory — only against an NT4 Domain Controller. So if you roll up with AD energy, it's giving 💀, it will not work.

🩸 RPC VAMPIRE KEYTAB

Dumps the remote SAM database straight into a local Kerberos keytab file. Slay. 🔑

🩸 RPC VAMPIRE LDIF

Dumps the remote SAM database into a local LDIF file, or to standard output if you want it right there in your terminal. 📄

🩸 RPC GETSID

Fetches the domain SID and stores it in the local secrets.tdb. That's it, that's the whole job. 🆔

👑 ADS GPO 👑

💅 ADS GPO APPLY <USERNAME|MACHINENAME>

Applies GPOs for a username or a machine name. You give it one of them — either username or machine name should be provided to the command, not both. Pick a lane, bestie. 🙅

💅 ADS GPO GETGPO [GPO]

Lists the specified GPO. Nice and simple. ✨

💅 ADS GPO LINKADD [LINKDN] [GPODN]

Links a container to a GPO.

LINKDN — the container to link to a GPO.
GPODN — the GPO to link the container to.

DNs must be provided properly escaped, okay? See RFC 4514 for the details — no cap, escaping matters here. 🫶

💅 ADS GPO LINKGET [CONTAINER]

Lists the gPLink of a container. 🔗

💅 ADS GPO LIST <USERNAME|MACHINENAME>

Lists all the GPOs for a username or a machine name. Again: either username or machine name should be provided to the command, not both. One or the other, queen. 👑

💅 ADS GPO LISTALL

Lists literally all the GPOs on a DC. The full roster, the whole lineup. 🌈

💅 ADS GPO REFRESH [USERNAME] [MACHINENAME]

Lists all GPOs assigned to an account and downloads them.

USERNAME — the user to refresh GPOs for.
MACHINENAME — the machine to refresh GPOs for.

Two separate args, both optional, it's giving options. 💖

🌐 ADS DNS 🌐

🦋 ADS DNS REGISTER [FQDN [IP [IP.....]]]

Adds a DNS record to Active Directory.

If FQDN is missing, the DNS hostname is used.
If IP is missing, IPs from all network interfaces are added.

And yeah, you can stack up more than one IP in there — IP..... and all. 📡

🦋 ADS DNS UNREGISTER <FQDN>

Removes the FQDN DNS entry from Active Directory. Bye bestie. 👋

🌸 ADS LEAVE [--keep-account]

Makes the remote host leave the domain it's part of. Dramatic exit, honestly iconic. 🚪💨

🌸 ADS STATUS

Prints out the status of the machine account of the local machine in ADS. Heads up though — it prints out quite some debug info, so this one is aimed at developers. Regular users should use NET ADS TESTJOIN instead. 🧑‍💻

🖨️ ADS PRINTER 🖨️

🎀 ADS PRINTER INFO [PRINTER] [SERVER]

Looks up info for PRINTER on SERVER. The printer name defaults to "*", and the server name defaults to the local host. Defaults are doing a lot of heavy lifting here. 💅

🎀 ADS PRINTER PUBLISH PRINTER

Publishes the specified printer using ADS. Getting that printer out into the world. 📢

🎀 ADS PRINTER REMOVE PRINTER

Removes the specified printer from the ADS directory. Unpublish, unbothered, unstanning. 🗑️

🔍 ADS SEARCH 🔍

🍓 ADS SEARCH EXPRESSION ATTRIBUTES...

Performs a raw LDAP search on an ADS server and dumps the results. The expression is a standard LDAP search expression, and the attributes are a list of LDAP fields to show in the results.

Example:

net ads search '(objectCategory=group)' sAMAccountName

🍓 ADS DN DN (attributes)

Performs a raw LDAP search on an ADS server and dumps the results. The DN is the standard LDAP DN, and the attributes are a list of LDAP fields to show in the result.

Example:

net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName

🗝️ ADS KEYTAB CREATE 🗝️

Since Samba 4.21.0, the keytab file is created as specified in sync machine password to keytab. 🫶

The keytab can be created only when the machine password is available in secrets.tdb — i.e. only for kerberos method = secrets only and kerberos method = secrets and keytab. With the smb.conf default values for kerberos method = secrets only and sync machine password to keytab (default is empty), the keytab is not generated at all. So like, no, you don't get a free keytab, sorry bestie. 😭

A keytab with a default name containing: SPNs synced from AD, account name COMPUTER$ and principal host/dns_hostname is created for kerberos method = secrets and keytab if sync machine password to keytab is missing.

Till Samba 4.20, these entries were created by default: the account name COMPUTER$, 'host' principal and SPNs synced from AD. The example below generates such a keytab:

sync machine password to keytab = /etc/krb5.keytab:spn_prefixes=host:account_name:sync_spns:sync_kvno:machine_password

No changes are made to the computer AD account. None. Zero. Untouched. ✨

🚫 (Removed!) ADS KEYTAB ADD (principal | machine | serviceclass | windows SPN) 🚫

This command is no longer available in Samba 4.21.0 and newer. See sync machine password to keytab for replacement. 💀

To replace, e.g., a call of

net ads keytab add wurst/brot@REALM

Add to smb.conf:

sync machine password to keytab = /path/to/keytab1:spns=wurst/brot@REALM:machine_password

and run:

net ads keytab create

Original description of this command:

Adds a new keytab entry, and the entry can be either;

kerberos principal — A kerberos principal (identified by the presence of '@') is just added to the keytab file.
machinename — A machinename (identified by the trailing '$') is used to create a kerberos principal 'machinename@realm' which is added to the keytab file.
serviceclass — A serviceclass (such as 'cifs', 'html' etc.) is used to create a pair of kerberos principals 'serviceclass/fully_qualified_dns_name@realm' & 'serviceclass/netbios_name@realm' which are added to the keytab file.
Windows SPN — A Windows SPN is of the format 'serviceclass/host:port', it is used to create a kerberos principal 'serviceclass/host@realm' which will be written to the keytab file.

Unlike old versions, no computer AD objects are modified by this command. To preserve the behaviour of older clients, 'net ads keytab ad_update_ads' is available.

🗝️ ADS KEYTAB LIST [keytab]

This command will list the contents of a keytab. If no keytab is specified, it will display the default keytab configured by KRB5. Peek inside the box, it's giving mystery box reveal. 🎁

🚫 (Removed!) ADS KEYTAB DELETE (principal | machine | serviceclass | windows SPN) 🚫

This command is no longer available in Samba 4.21.0 and newer. See sync machine password to keytab for replacement. 💀

To replace, e.g., a call of

net ads keytab delete wurst/brot@REALM

Delete from sync machine password to keytab principal "wurst/brot@REALM" and run:

net ads keytab create

🚫 (Removed!) ADS KEYTAB ADD_UPDATE_ADS (principal | machine | serviceclass | windows SPN) 🚫

This command is no longer available in Samba 4.21.0 and newer. See sync machine password to keytab for replacement. 💀

To replace, e.g., a call of

net ads keytab add_update_ads wurst/brot@REALM

Add to smb.conf:

sync machine password to keytab = /path/to/keytab2:sync_spns:machine_password

and run:

net ads setspn add wurst/brot@REALM
net ads keytab create

Original description of this command:

Adds a new keytab entry (see section for net ads keytab add). In addition to adding entries to the keytab file, corresponding Windows SPNs are created from the entry passed to this command. These SPN(s) are added to the AD computer account object associated with the client machine running this command, for the following entry types;

serviceclass — A serviceclass (such as 'cifs', 'html' etc.) is used to create a pair of Windows SPN(s) 'param/full_qualified_dns' & 'param/netbios_name' which are added to the AD computer account object for this client.
Windows SPN — A Windows SPN is of the format 'serviceclass/host:port', it is added as passed to the AD computer account object for this client.

🏷️ ADS SETSPN 🏷️

💜 ADS SETSPN LIST [machine]

Lists the Windows SPNs stored in the 'machine' Windows AD Computer object. If 'machine' is not specified, then the computer account for this client is used instead.

Example:

net ads setspn list --machine-pass

💜 ADS SETSPN ADD [machine] SPN

Adds the specified Windows SPN to the 'machine' Windows AD Computer object. If 'machine' is not specified, then the computer account for this client is used instead.

Example:

net ads setspn add computername host/computername.example.com -U Administrator%Passw0rd

💜 ADS SETSPN DELETE [machine] SPN

DELETES the specified Window SPN from the 'machine' Windows AD Computer object. If 'machine' is not specified, then the computer account for this client is used instead.

Example:

net ads setspn delete computername host/computername.example.com -U Administrator%Passw0rd

🏢 ADS WORKGROUP 🏢

Prints out the workgroup name for the specified kerberos realm. Simple. Clean. Iconic. 🫶

🔐 ADS ENCTYPES 🔐

Lists, modifies, or deletes the value of the "msDS-SupportedEncryptionTypes" attribute of an account in AD.

This attribute allows one to control which Kerberos encryption types are used for the generation of initial and service tickets. The value consists of an integer bitmask with the following values:

0x00000001 — DES-CBC-CRC
0x00000002 — DES-CBC-MD5
0x00000004 — RC4-HMAC
0x00000008 — AES128-CTS-HMAC-SHA1-96
0x00000010 — AES256-CTS-HMAC-SHA1-96
0x00000020 — AES256-CTS-HMAC-SHA1-96-SK
0x00080000 — RESOURCE-SID-COMPRESSION-DISABLED

🔥 ADS ENCTYPES LIST <ACCOUNTNAME>

Lists the value of the "msDS-SupportedEncryptionTypes" attribute of a given account. Heads up: the computer account needs '$' at the end.

Example:

net ads enctypes list Computername$ --machine-pass

🔥 ADS ENCTYPES SET <ACCOUNTNAME> [enctypes]

Sets the value of the "msDS-SupportedEncryptionTypes" attribute of the LDAP object of ACCOUNTNAME to a given value. If the value is omitted, the value is set to 28, which enables RC4-HMAC, AES128-CTS-HMAC-SHA1-96 and AES256-CTS-HMAC-SHA1-96 encryption types.

Example:

net ads enctypes set Computername$ 24 --machine-pass

🔥 ADS ENCTYPES DELETE <ACCOUNTNAME>

Deletes the "msDS-SupportedEncryptionTypes" attribute of the LDAP object of ACCOUNTNAME. Gone. Deleted. Not a trace. 💅

Example:

net ads enctypes delete Computername$ --machine-pass

🎫 ADS KERBEROS 🎫

Issues Kerberos operations against an Active Directory KDC. Ticket queen behaviour, honestly. 👑

⭐ ADS KERBEROS KINIT

Issues a kinit request for a given user. The following methods can be used to specify where to store the ticket granting ticket (TGT), in order of precedence:

option --use-krb5-ccache
KRB5CCNAME environment variable
default_ccache_name setting in krb5.conf

Examples:

Use file based cache (FILE:/tmp/krb5cache)

net ads kerberos kinit -P --use-krb5-ccache=/tmp/krb5cache

Use memory cache (MEMORY:net) to verify the authentication

net ads kerberos kinit -P --use-krb5-ccache=MEMORY:net

⭐ ADS KERBEROS RENEW

Renews an already acquired ticket granting ticket (TGT). Glow-up for your ticket. ✨

Example:

net ads kerberos renew

⭐ ADS KERBEROS PAC

Requests a Kerberos PAC while authenticating to an Active Directory KDC.

The following commands are provided:

net ads kerberos pac dump - Dump a PAC to stdout.
net ads kerneros pac save - Save a PAC to a file.

All commands allow to define an impersonation principal to do a Kerberos Service for User (S4U2SELF) operation via the impersonate=STRING option. The impersonation principal can have multiple different formats:

user@MY.REALM

This is the default format.

user@MY.REALM@MY.REALM

The Kerberos Service for User (S4U2SELF) also supports Enterprise Principals.

user@UPN.SUFFIX@MY.REALM

Enterprise Principal using a defined upn suffix.

user@WORKGROUP@MY.REALM

...Enterprise Principal with netbios domain name. ✨ And heads up bestie: this format is currently not supported by Samba AD 😭 no cap, it just isn't.

By default, net requests a service ticket for the local service of the joined machine. Want a different one? Define it with local_service=STRING and go off. 💅

🎟️ `ADS KERBEROS PAC DUMP` 🎟️

ADS KERBEROS PAC DUMP [impersonate=string] [local_service=string] [pac_buffer_type=int]

So this one requests a Kerberos PAC while it's authenticating to an Active Directory KDC, and then prints that PAC straight to stdout. Iconic. 🫶

Pick no specific pac_buffer and you get all the buffers printed. Want just one? Select it with pac_buffer_type=INT, and here's the menu of valid values, copy-paste ready:

    1 PAC_TYPE_LOGON_INFO
    2 PAC_TYPE_CREDENTIAL_INFO
    6 PAC_TYPE_SRV_CHECKSUM
    7 PAC_TYPE_KDC_CHECKSUM
   10 PAC_TYPE_LOGON_NAME
   11 PAC_TYPE_CONSTRAINED_DELEGATION
   12 PAC_TYPE_UPN_DNS_INFO
   13 PAC_TYPE_CLIENT_CLAIMS_INFO
   14 PAC_TYPE_DEVICE_INFO
   15 PAC_TYPE_DEVICE_CLAIMS_INFO
   16 PAC_TYPE_TICKET_CHECKSUM
   17 PAC_TYPE_ATTRIBUTES_INFO
   18 PAC_TYPE_REQUESTER_SID
   19 PAC_TYPE_FULL_CHECKSUM

Example, because seeing it in action just hits different:

net ads kerberos pac dump -P impersonate=anyuser@MY.REALM.COM

🎟️ `ADS KERBEROS PAC SAVE` 💾

ADS KERBEROS PAC SAVE [impersonate=string] [local_service=string] [filename=string]

Same energy as above — it requests a Kerberos PAC while authenticating to an AD KDC — except this time the PAC gets saved into a file instead of yeeted to stdout. 🌸

Where does it land? You set that with the filename=STRING option.

Example, and yes it's literally this:

net ads kerberos pac save -U user%password filename=/tmp/pacstore

🔧 `SAM CREATEBUILTINGROUP` <NAME>

(This is a (Re)Create situation, btw.) It makes a BUILTIN group — and only a wellknown set of BUILTIN groups can be created this way, so don't get creative. 🎀 The list of names it currently recognizes:

Administrators
Users
Guests
Power Users
Account Operators
Server Operators
Print Operators
Backup Operators
Replicator
RAS Servers
Pre-Windows 2000 compatible Access

This command needs a running Winbindd with idmap allocation properly configured, fr fr. The group gid gets allocated out of the winbindd range.

🔧 `SAM CREATELOCALGROUP` <NAME>

Creates a LOCAL group (aka an Alias, iykyk). Same deal as above: you need a running Winbindd with idmap allocation configured properly, and the group gid is allocated out of the winbindd range. ✨

🗑️ `SAM DELETELOCALGROUP` <NAME>

Deletes an existing LOCAL group (the Alias one, yeah). Gone. 💀

🔗 `SAM MAPUNIXGROUP` <NAME>

Maps an existing Unix group and makes it a Domain Group — and the domain group keeps the same name. Slay. 🌈

✂️ `SAM UNMAPUNIXGROUP` <NAME>

Removes an existing group mapping entry. Bye bye, mapping. 👋

➕ `SAM ADDMEM` <GROUP> <MEMBER>

Adds a member to a Local group. Sneaky detail: the group can only be specified by name, but the member can be specified by name or SID. 💖

➖ `SAM DELMEM` <GROUP> <MEMBER>

Removes a member from a Local group. And here, both the group and the member must be specified by name — no SIDs allowed. No cap.

📋 `SAM LISTMEM` <GROUP>

Lists the Local group's members. The group must be specified by name. That's it, that's the whole thing. 💅

📋 `SAM LIST` <users|groups|localgroups|builtin|workstations> [verbose]

Lists the set of accounts you asked for, by name. Add verbose and you also get the rid and the description for every single account. Obsessed with that level of detail. 🍓

👑 `SAM RIGHTS LIST`

Lists all the available privileges. Every last one. ✨

🎁 `SAM RIGHTS GRANT` <NAME> <PRIVILEGE>

Grants one or more privileges to a user. Give them the goods. 💜

🚫 `SAM RIGHTS REVOKE` <NAME> <PRIVILEGE>

Revokes one or more privileges from a user. Taking it back, respectfully. 😭

🔍 `SAM SHOW` <NAME>

Shows the full DOMAIN\NAME, the SID, and the type for the account you point at. The whole vibe check of an account. 🦋

🏠 `SAM SET HOMEDIR` <NAME> <DIRECTORY>

Sets the home directory for a user account. 🏡

🗂️ `SAM SET PROFILEPATH` <NAME> <PATH>

Sets the profile path for a user account.

💬 `SAM SET COMMENT` <NAME> <COMMENT>

Sets the comment for a user or a group account. Equal opportunity commenting.

🪪 `SAM SET FULLNAME` <NAME> <FULL NAME>

Sets the full name for a user account. Government name era. 👑

📜 `SAM SET LOGONSCRIPT` <NAME> <SCRIPT>

Sets the logon script for a user account. ✨

🚗 `SAM SET HOMEDRIVE` <NAME> <DRIVE>

Sets the home drive for a user account. Vroom. 🏎️

🖥️ `SAM SET WORKSTATIONS` <NAME> <WORKSTATIONS>

Sets which workstations a user account is allowed to log in from. Gatekeeping, but make it policy. 🔒

⛔ `SAM SET DISABLE` <NAME>

Sets the "disabled" flag for a user account. They're on read-only mode now. 💀

🔓 `SAM SET PWNOTREQ` <NAME>

Sets the "password not required" flag for a user account.

🔐 `SAM SET AUTOLOCK` <NAME>

Sets the "autolock" flag for a user account.

♾️ `SAM SET PWNOEXP` <NAME>

Sets the "password do not expire" flag for a user account. Forever password energy. ✨

🔄 `SAM SET PWDMUSTCHANGENOW` <NAME> [yes|no]

Sets or unsets the "password must change" flag for a user account. Yes or no, your call. 🎀

📜 `SAM POLICY LIST`

Lists the available account policies.

👀 `SAM POLICY SHOW` <account policy>

Shows the value of the account policy you asked about.

✍️ `SAM POLICY SET` <account policy> <value>

Sets a value for the account policy. Valid values can be: "forever", "never", "off", or a number. Those are the options, bestie — pick one.

🧚 `SAM PROVISION`

Only available if ldapsam:editposix is set AND winbindd is running. If you don't have both, this does nothing for you, sorry. 😭

When it is available, it properly populates the ldap tree with the basic accounts (Administrator) and groups (Domain Users, Domain Admins, Domain Guests) on the ldap tree. Set it up and let it cook. 🍓

🗄️ `IDMAP DUMP` <local tdb file name>

Dumps the mappings sitting inside the local tdb file you specified. Super useful when you want to dump only the mappings produced by the idmap_tdb backend. 🌸

♻️ `IDMAP RESTORE` [input file]

Restores the mappings from the file you specified, or from stdin if you didn't specify one. 🫶

🤫 `IDMAP SET SECRET` <DOMAIN> <secret>

Stores a secret for the domain you named. This is used primarily for domains that use idmap_ldap as a backend — in that case, the secret is used as the password for the user DN used to bind to the ldap server. iykyk. 🔐

📏 `IDMAP SET RANGE` <RANGE> <SID> [index] [--db=<DB>]

Stores a domain-range mapping for a given domain (and index) in the autorid database.

⚙️ `IDMAP SET CONFIG` <config> [--db=<DB>]

Updates the CONFIG entry in the autorid database.

🔎 `IDMAP GET RANGE` <SID> [index] [--db=<DB>]

Gets the range for a given domain and index from the autorid database.

🔎 `IDMAP GET RANGES` [<SID>] [--db=<DB>]

Gets ranges for all domains, or for just the one identified by the SID you gave. Your choice. ✨

🔎 `IDMAP GET CONFIG` [--db=<DB>]

Gets the CONFIG entry from the autorid database.

🗑️ `IDMAP DELETE MAPPING` [-f] [--db=<DB>] <ID>

Deletes a mapping sid <-> gid or sid <-> uid from the IDMAP database. The mapping you're deleting is given by <ID>, which may either be:

a sid: S-x-...
a gid: "GID number"
a uid: "UID number"

Use -f to delete an invalid partial mapping <ID> -> xx. 😤

Use "smbcontrol all idmap ..." to notify running smbd instances. See the smbcontrol(1) manpage for details, bestie.

🗑️ `IDMAP DELETE RANGE` [-f] [--db=<TDB>] <RANGE>|(<SID> [<INDEX>])

Deletes a domain range mapping identified by 'RANGE' or by "domain SID and INDEX" from the autorid database. Use -f to delete invalid mappings. 💅

🗑️ `IDMAP DELETE RANGES` [-f] [--db=<TDB>] <SID>

Deletes all the domain range mappings for a domain identified by SID. Use -f to delete invalid mappings. Clean sweep. 🧹

🩺 `IDMAP CHECK` [-v] [-r] [-a] [-T] [-f] [-l] [--db=<DB>]

Checks and repairs the IDMAP database. Give it no option at all and it does a read only check of the database. Among other things, you can choose an interactive or automatic repair mode with one of these:

-r, --repair — Interactive repair mode. It is going to ask you a lot of questions. 😭
-a, --auto — Noninteractive repair mode. Default answers, no chat.
-v, --verbose — Produces more output.
-f, --force — Tries to apply changes even if they don't apply cleanly. Careful with this one.
-T, --test — Dry run. Shows what changes would be made but doesn't touch anything. 🫶
-l, --lock — Locks the database while doing the check.
--db <DB> — Checks the specified database.

It reports on finding the following errors:

Missing reverse mapping: a record with mapping A->B where there is no B->A. The default action in repair mode is to "fix" this by adding the reverse mapping.
Invalid mapping: a record with mapping A->B where B->C. The default action is to "delete" this record.
Missing or invalid HWM: a high water mark isn't at least equal to the largest ID in the database. The default action is to "fix" this by setting it to the largest ID found +1.
Invalid record: something it failed to parse. The default action is to "edit" it in interactive mode and "delete" it in automatic mode.

🧑‍🤝‍🧑 `USERSHARE` 🌈

Starting with version 3.0.23, a Samba server now supports letting non-root users add user defined shares to be exported, using the "net usershare" commands. Periodt. 👑

Wanna set this up? Okay, step by step, bestie:

First, set up your /etc/samba/smb.conf by adding this to the [global] section: usershare path = /usr/local/samba/lib/usershares
Next, create the directory /usr/local/samba/lib/usershares, change the owner to root, and set the group owner to the UNIX group who should have the ability to create usershares — for example, a group called "serverops".
Set the permissions on /usr/local/samba/lib/usershares to 01770. (That's owner and group all access, no access for others, plus the sticky bit — which means a file in that directory can be renamed or deleted only by the owner of the file. Iconic.)
Finally, tell smbd how many usershares you'll allow by adding a line to the [global] section of /etc/samba/smb.conf such as: usershare max shares = 100 — that particular one allows 100 usershare definitions.

Now members of the UNIX group "serverops" can create user defined shares on demand using the commands below. 🎉

The usershare commands are:

net usershare add sharename path [comment [acl] [guest_ok=[y|n]]] — to add or change a user defined share.
net usershare delete sharename — to delete a user defined share.
net usershare info [--long] [wildcard sharename] — to print info about a user defined share.
net usershare list [--long] [wildcard sharename] — to list user defined shares.

➕ `USERSHARE ADD` sharename path [comment] [acl] [guest_ok=[y|n]]

Adds or replaces a new user defined share, with the name "sharename". ✨

"path" specifies the absolute pathname on the system that's being exported. Restrictions may be put on this — go check the global /etc/samba/smb.conf parameters: "usershare owner only", "usershare prefix allow list", and "usershare prefix deny list".

The optional "comment" parameter is the comment that'll show up on the share when a client browses to it. 💬

The optional "acl" field says which users have read and write access to the entire share. Note: guest connections are not allowed unless the /etc/samba/smb.conf parameter "usershare allow guests" has been set. The definition of a user defined share acl is "user:permission", where user is a valid username on the system and permission can be "F", "R", or "D":

"F" stands for "full permissions", i.e. read and write permissions. 💅
"D" stands for "deny" for a user, i.e. it prevents this user from accessing this share. 🚫
"R" stands for "read only", i.e. it only allows read access to this share — no creating new files or directories, and no writing to files. 🔒

The default, if no "acl" is given, is "Everyone:R" — which means any authenticated user has read-only access. That's the fallback vibe. 🎀

okay so this lil param right here?? it's literally the same energy as the parameter with the same name in /etc/samba/smb.conf — it lets guests have access to this user-defined share. But 💅 it's only allowed if the global parameter usershare allow guests has been set to true in /etc/samba/smb.conf. No global permission, no guest party. periodt.

And bestie, there's no separate command to modify an existing user-defined share. Just hit the net usershare add [sharename] command again with the same sharename you wanna modify, and specify the new options you want. The Samba smbd daemon notices user-defined share modifications at connect time, so it'll see the change immediately — no need to restart smbd when adding, deleting, or changing a user-defined share. slay. ✨

🗑️ USERSHARE DELETE sharename

Deletes the user-defined share by name. The Samba smbd daemon immediately notices this change, although it will not disconnect any users currently connected to the deleted share. So like… the share is gone but the people already in the club are still in the club. 💀

🔍 USERSHARE INFO `[--long] [wildcard sharename]`

Get info on user-defined shares owned by the current user matching the given pattern, or all users.

net usershare info on its own dumps out info on the user-defined shares that were created by the current user, or restricts them to share names that match the given wildcard pattern ('*' matches one or more characters, '?' matches only one character). If the '--long' option is also given, it prints out info on user-defined shares created by other users. 👀

The information given about a share looks like:

[foobar] path=/home/jeremy comment=testme usershare_acl=Everyone:F guest_ok=n

And it's a list of the current settings of the user-defined share that can be modified by the net usershare add command. 🎀

📋 USERSHARE LIST `[--long] wildcard sharename`

List all the user-defined shares owned by the current user matching the given pattern, or all users.

net usershare list on its own lists out the names of the user-defined shares that were created by the current user, or restricts the list to share names that match the given wildcard pattern ('*' matches one or more characters, '?' matches only one character). If the '--long' option is also given, it includes the names of user-defined shares created by other users. 🦋

🧚 `[RPC] CONF`

Starting with version 3.2.0, a Samba server can be configured by data stored in registry. This configuration data can be edited with the new net conf commands. There is also the possibility to configure a remote Samba server by enabling the RPC conf mode and specifying the address of the remote server. 🌈

The deployment of this configuration data can be activated in two levels from the /etc/samba/smb.conf file: Share definitions from registry are activated by setting registry shares to “yes” in the [global] section, and global configuration options are activated by setting include = registry in the [global] section for a mixed configuration, or by setting config backend = registry in the [global] section for a registry-only configuration. See the smb.conf(5) manpage for details. 👑

The conf commands are:

net [rpc] conf list - Dump the complete configuration in smb.conf like format.
net [rpc] conf import - Import configuration from file in smb.conf format.
net [rpc] conf listshares - List the registry shares.
net [rpc] conf drop - Delete the complete configuration from registry.
net [rpc] conf showshare - Show the definition of a registry share.
net [rpc] conf addshare - Create a new registry share.
net [rpc] conf delshare - Delete a registry share.
net [rpc] conf setparm - Store a parameter.
net [rpc] conf getparm - Retrieve the value of a parameter.
net [rpc] conf delparm - Delete a parameter.
net [rpc] conf getincludes - Show the includes of a share definition.
net [rpc] conf setincludes - Set includes for a share.
net [rpc] conf delincludes - Delete includes from a share definition.

💖 `[RPC] CONF LIST`

Print the configuration data stored in the registry in a smb.conf-like format to standard output. it's giving… exactly what it says on the tin. ✨

📥 `[RPC] CONF IMPORT [--test|-T] filename [section]`

This command imports configuration from a file in smb.conf format. If a section encountered in the input file is present in registry, its contents is replaced. Sections of registry configuration that have no counterpart in the input file are not affected. If you want to delete these, you will have to use the net conf drop or net conf delshare commands. 🫶

Optionally, a section may be specified to restrict the effect of the import command to that specific section.

A test mode is enabled by specifying the parameter "-T" on the commandline. In test mode, no changes are made to the registry, and the resulting configuration is printed to standard output instead. bestie that's a dry run, use it, it's free. 😌

🗂️ `[RPC] CONF LISTSHARES`

List the names of the shares defined in registry.

💥 `[RPC] CONF DROP`

Delete the complete configuration data from registry.

okay this one is a full nuke. all of it. gone. no undo button. 🙈

🔎 `[RPC] CONF SHOWSHARE sharename`

Show the definition of the share or section specified. It is valid to specify "global" as sharename to retrieve the global configuration options from registry.

🎀 `[RPC] CONF ADDSHARE sharename path [writeable={y|N} [guest_ok={y|N} [comment]]]`

Create a new share definition in registry. The sharename and path have to be given. The share name may not be "global". Optionally, values for the very common options "writeable", "guest ok" and a "comment" may be specified. The same result may be obtained by a sequence of net conf setparm commands. 💅

🚫 `[RPC] CONF DELSHARE sharename`

Delete a share definition from registry.

💾 `[RPC] CONF SETPARM section parameter value`

Store a parameter in registry. The section may be global or a sharename. The section is created if it does not exist yet. iconic, it just… makes room for you. 👑

🔍 `[RPC] CONF GETPARM section parameter`

Show a parameter stored in registry.

🗑️ `[RPC] CONF DELPARM section parameter`

Delete a parameter stored in registry.

📜 `[RPC] CONF GETINCLUDES section`

Get the list of includes for the provided section (global or share).

ngl this part is a whole lore drop, so pay attention bestie 🧚

Note that due to the nature of the registry database and the nature of include directives, the includes need special treatment: Parameters are stored in registry by the parameter name as valuename, so there is only ever one instance of a parameter per share. Also, a specific order like in a text file is not guaranteed. For all real parameters, this is perfectly ok, but the include directive is rather a meta parameter, for which, in the smb.conf text file, the place where it is specified between the other parameters is very important. This can not be achieved by the simple registry smbconf data model, so there is one ordered list of includes per share, and this list is evaluated after all the parameters of the share. 🤯

Further note that currently, only files can be included from registry configuration. In the future, there will be the ability to include configuration data from other registry keys. 🔮

🛠️ `[RPC] CONF SETINCLUDES section [filename]+`

Set the list of includes for the provided section (global or share) to the given list of one or more filenames. The filenames may contain the usual smb.conf macros like %I. 🌸

✂️ `[RPC] CONF DELINCLUDES section`

Delete the list of includes from the provided section (global or share).

👑 REGISTRY

Manipulate Samba's registry.

The registry commands are:

net registry enumerate   - Enumerate registry keys and values.
net registry enumerate_recursive - Enumerate registry key and its subkeys.
net registry createkey   - Create a new registry key.
net registry deletekey   - Delete a registry key.
net registry deletekey_recursive - Delete a registry key with subkeys.
net registry getvalue    - Print a registry value.
net registry getvalueraw - Print a registry value (raw format).
net registry setvalue    - Set a new registry value.
net registry increment   - Increment a DWORD registry value under a lock.
net registry deletevalue - Delete a registry value.
net registry getsd       - Get security descriptor.
net registry getsd_sdd1  - Get security descriptor in sddl format.
net registry setsd_sdd1  - Set security descriptor from sddl format string.
net registry import      - Import a registration entries (.reg) file.
net registry export      - Export a registration entries (.reg) file.
net registry convert     - Convert a registration entries (.reg) file.
net registry check       - Check and repair a registry database.

🔢 `REGISTRY ENUMERATE key`

Enumerate subkeys and values of key. 💜

🔁 `REGISTRY ENUMERATE_RECURSIVE key`

Enumerate values of key and its subkeys. it goes all the way down, fr fr.

🌱 `REGISTRY CREATEKEY key`

Create a new key if not yet existing.

🗑️ `REGISTRY DELETEKEY key`

Delete the given key and its values from the registry, if it has no subkeys. no subkeys allowed, sorry babe.

💀 `REGISTRY DELETEKEY_RECURSIVE key`

Delete the given key and all of its subkeys and values from the registry.

this one is the no-mercy version. it takes the whole tree. 🔥

🔎 `REGISTRY GETVALUE key name`

Output type and actual value of the name of the given key.

🧪 `REGISTRY GETVALUERAW key name`

Output the actual value of the name of the given key.

✍️ `REGISTRY SETVALUE key name type value ...`

Set the name of an existing key. type may be one of sz, multi_sz or dword. In case of multi_sz value may be given multiple times. 💅

➕ `REGISTRY INCREMENT key name [inc]`

Increment the DWORD name of key by inc while holding a g_lock. inc defaults to 1. 🎀

🗑️ `REGISTRY DELETEVALUE key name`

Delete the name of the given key.

🔐 `REGISTRY GETSD key`

Get the security descriptor of the given key.

🎫 `REGISTRY GETSD_SDDL key`

Get the security descriptor of the given key as a Security Descriptor Definition Language (SDDL) string.

🖊️ `REGISTRY SETSD_SDDL key sd`

Set the security descriptor of the given key from a Security Descriptor Definition Language (SDDL) string sd.

📥 `REGISTRY IMPORT file [--precheck <check-file>] [opt]`

Import a registration entries (.reg) file.

The following options are available:

--precheck check-file — This is a mechanism to check the existence or non-existence of certain keys or values specified in a precheck file before applying the import file. The import file will only be applied if the precheck succeeds.

The check-file follows the normal registry file syntax with the following semantics:

<value name>=<value> checks whether the value exists and has the given value.
<value name>=- checks whether the value does not exist.
[key] checks whether the key exists.
[-key] checks whether the key does not exist.

📤 `REGISTRY EXPORT keyfile[opt]`

Export a key to a registration entries (.reg) file. 🦋

🔄 `REGISTRY CONVERT in out [[inopt] outopt]`

Convert a registration entries (.reg) file in.

🌈

🗂️ REGISTRY CHECK

REGISTRY CHECK [-ravTl] [-o <ODB>] [--wipe] [<DB>]

Okay so this one checks and repairs the registry database ✨ If you give it no option at all, it just does a read-only check of the database — no touching, just looking 👀 Among other things you can pick an interactive or automatic repair mode with one of these options:

-r, --repair — Interactive repair mode, bestie. It is going to ask a lot of questions. Like, a LOT. Answer them all 💅
-a, --auto — Noninteractive repair mode, it just uses the default answers. No questions, no conversation, no drama 🎀
-v, --verbose — Produce more output. Give me ALL the tea ☕
-T, --test — Dry run 🧚 it shows you what changes would be made but doesn't touch anything. Nothing. Nada. Zero contact.
-l, --lock — Lock the database while doing the check 🔒
--reg-version={1,2,3} — Specify the format of the registry database. If you don't give it, it defaults to the value of the binary or — if an registry.tdb is explicitly stated at the commandline — to the value found in the INFO/version record 🌸
[--db] <DB> — Check the specified database.
-o, --output <ODB> — Create a new registry database <ODB> instead of modifying the input 💖 If <ODB> is already existing, --wipe may be used to overwrite it.
--wipe — Replace the registry database instead of modifying the input, or overwrite an existing output database. It's giving no takebacks 💀

📜 EVENTLOG

Starting with version 3.4.0, net can read, dump, import and export native win32 eventlog files (usually *.evt) 🌈 And yes, evt files are used by the native Windows eventviewer tools, so this is the real deal.

Heads up bestie: the import and export of evt files can only succeed when eventlog list is used in /etc/samba/smb.conf. See the smb.conf(5) manpage for the details 📖

The eventlog commands are:

net eventlog dump — Dump a eventlog *.evt file on the screen.
net eventlog import — Import a eventlog *.evt into the samba internal tdb based representation of eventlogs.
net eventlog export — Export the samba internal tdb based representation of eventlogs into an eventlog *.evt file.

📤 EVENTLOG DUMP filename

Prints a eventlog *.evt file to standard output. Just straight to stdout, no filter, main character energy 👑

📥 EVENTLOG IMPORT filename eventlog

Imports a eventlog *.evt file defined by filename into the samba internal tdb representation of eventlog defined by eventlog ✨ eventlog needs to part of the eventlog list defined in /etc/samba/smb.conf. See the smb.conf(5) manpage for details 🫶

📦 EVENTLOG EXPORT filename eventlog

Exports the samba internal tdb representation of eventlog defined by eventlog to a eventlog *.evt file defined by filename 💖 eventlog needs to part of the eventlog list defined in /etc/samba/smb.conf. See the smb.conf(5) manpage for details 🌸

🏰 DOM

Starting with version 3.2.0, Samba has support for remote join and unjoin APIs — both client and server-side, iconic behavior honestly 💅 Windows supports remote join capabilities since Windows 2000, so this is old money.

In order for Samba to be joined or unjoined remotely, an account must be used that is either:

a member of the Domain Admins group,
a member of the local Administrators group,
or a user that is granted the SeMachineAccountPrivilege privilege 🔐

The client side support for remote join is implemented in the net dom commands, which are:

net dom join — Join a remote computer into a domain.
net dom unjoin — Unjoin a remote computer from a domain.
net dom renamecomputer — Renames a remote computer joined to a domain.

🤝 DOM JOIN domain=DOMAIN ou=OU account=ACCOUNT password=PASSWORD reboot

Joins a computer into a domain 🎉 This command supports the following additional parameters:

DOMAIN can be a NetBIOS domain name (also known as short domain name) or a DNS domain name for Active Directory Domains. As in Windows, it is also possible to control which Domain Controller to use. This can be achieved by appending the DC name using the \ separator character. Example: MYDOM\MYDC. The DOMAIN parameter cannot be NULL. No cap.
OU can be set to a RFC 1779 LDAP DN, like ou=mymachines,cn=Users,dc=example,dc=com in order to create the machine account in a non-default LDAP container 🗂️ This optional parameter is only supported when joining Active Directory Domains.
ACCOUNT defines a domain account that will be used to join the machine to the domain. This domain account needs to have sufficient privileges to join machines.
PASSWORD defines the password for the domain account defined with ACCOUNT 🔑
REBOOT is an optional parameter that can be set to reboot the remote machine after successful join to the domain.

Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to join 🫶 These additional parameters include: -S computer and -U user.

Example:

net dom join -S xp -U XP\\administrator%secret domain=MYDOM account=MYDOM\\administrator password=topsecret reboot.

This example would connect to a computer named XP as the local administrator using password secret, and join the computer into a domain called MYDOM using the MYDOM domain administrator account and password topsecret. After successful join, the computer would reboot 🔄

👋 DOM UNJOIN account=ACCOUNT password=PASSWORD reboot

Unjoins a computer from a domain 💔 This command supports the following additional parameters:

ACCOUNT defines a domain account that will be used to unjoin the machine from the domain. This domain account needs to have sufficient privileges to unjoin machines.
PASSWORD defines the password for the domain account defined with ACCOUNT 🔑
REBOOT is an optional parameter that can be set to reboot the remote machine after successful unjoin from the domain.

Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to unjoin 🫶 These additional parameters include: -S computer and -U user.

Example:

net dom unjoin -S xp -U XP\\administrator%secret account=MYDOM\\administrator password=topsecret reboot.

This example would connect to a computer named XP as the local administrator using password secret, and unjoin the computer from the domain using the MYDOM domain administrator account and password topsecret. After successful unjoin, the computer would reboot 🔄

✏️ DOM RENAMECOMPUTER newname=NEWNAME account=ACCOUNT password=PASSWORD reboot

Renames a computer that is joined to a domain 🎀 This command supports the following additional parameters:

NEWNAME defines the new name of the machine in the domain.
ACCOUNT defines a domain account that will be used to rename the machine in the domain. This domain account needs to have sufficient privileges to rename machines.
PASSWORD defines the password for the domain account defined with ACCOUNT 🔑
REBOOT is an optional parameter that can be set to reboot the remote machine after successful rename in the domain.

Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to rename in the domain 🫶 These additional parameters include: -S computer and -U user.

Example:

net dom renamecomputer -S xp -U XP\\administrator%secret newname=XPNEW account=MYDOM\\administrator password=topsecret reboot.

This example would connect to a computer named XP as the local administrator using password secret, and rename the joined computer to XPNEW using the MYDOM domain administrator account and password topsecret. After successful rename, the computer would reboot 🔄

🔐 G_LOCK

Manage global locks. Very demure, very mindful 🧘

🔒 G_LOCK DO lockname timeout command

Execute a shell command under a global lock. This might be useful to define the order in which several shell commands will be executed ⏳ The locking information is stored in a file called g_lock.tdb. In setups with CTDB running, the locking information will be available on all cluster nodes 🌐

LOCKNAME defines the name of the global lock.
TIMEOUT defines the timeout. ⏰
COMMAND defines the shell command to execute.

📋 G_LOCK LOCKS

Print a list of all currently existing locknames ✨

🗃️ G_LOCK DUMP lockname

Dump the locking table of a certain global lock 💅

💽 TDB

Print information from tdb records.

🔑 TDB LOCKING key [DUMP]

List sharename, filename and number of share modes for a record from locking.tdb 🌸 With the optional DUMP options, dump the complete record — the whole thing, no holding back.

KEY — Key of the tdb record as hex string.

🧹 tdb smbXsrv wipedbs

Clean stale entries from smbXsrv databases 🧼✨

An alias for net serverid wipedbs. iykyk

🗄️ vfs

Access shared filesystem through the VFS 🦋

vfs stream2abouble [--recursive] [--verbose] [--continue] [--follow-symlinks] share path

Convert file streams to AppleDouble files 🍏🍎

share — A Samba share.
path — A relative path of something in the Samba share. "." can be used for the root directory of the share.

Options:

--recursive — Traverse a directory hierarchy 🌳
--verbose — Verbose output.
--continue — Continue traversing a directory hierarchy if a single conversion fails. She does not give up 💪
--follow-symlinks — Follow symlinks encountered while traversing a directory 🔗

Display the security descriptor of a file or directory 👀

share — A Samba share.
path — A relative path of something in the Samba share. "." can be used for the root directory of the share.

🌐 OFFLINEJOIN

Starting with version 4.15, Samba has support for offline join APIs ✨ Windows supports offline join capabilities since Windows 7 and Windows 2008 R2. Look at us, keeping up 💅

The following offline commands are implemented:

net offlinejoin provision — Provisions a machine account in AD.
net offlinejoin requestodj — Requests a domain offline join.

📝 OFFLINEJOIN PROVISION domain=DOMAIN machine_name=MACHINE_NAME machine_account_ou=MACHINE_ACCOUNT_OU dcname=DCNAME defpwd reuse savefile=FILENAME printblob

OFFLINEJOIN PROVISION domain=DOMAIN machine_name=MACHINE_NAME
machine_account_ou=MACHINE_ACCOUNT_OU dcname=DCNAME defpwd reuse
savefile=FILENAME printblob

Provisions a machine account in AD 🎉 This command needs network connectivity to the domain controller to succeed 🌐 This command supports the following additional parameters:

DOMAIN can be a NetBIOS domain name (also known as short domain name) or a DNS domain name for Active Directory Domains. The DOMAIN parameter cannot be NULL.
MACHINE_NAME defines the machine account name that will be provisioned in AD. The MACHINE_NAME parameter cannot be NULL.
MACHINE_ACCOUNT_OU — set this to an RFC 1779 LDAP DN, like ou=mymachines,cn=Users,dc=example,dc=com, and the machine account gets created in a non-default LDAP container instead of the usual spot. ✨ This one is optional, and heads up — it's only supported when you're joining Active Directory Domains. 💅
DCNAME — pins down a specific domain controller to create the machine account on in AD. No more mystery about who's doing the honors 🎀
DEFPWD — optional, and it forces the use of the default machine account password. Genuinely, do not do this — the default machine account password is stupidly easy to guess. 😭 Like, trivially. Don't.
REUSE — optional, and it forces reusing a machine account that already exists in AD. Recycling era ♻️✨
SAVEFILE — optional, dumps the generated provisioning data onto disk so you can keep it.
PRINTBLOB — optional, prints the generated provisioning data straight to stdout. Boom, there it is.

Example, babes:

net offlinejoin provision -U administrator%secret domain=MYDOM machine_name=MYHOST savefile=provisioning.txt

OFFLINEJOIN REQUESTODJ loadfile=FILENAME 🧚

This one requests an offline domain join by handing over file-based provisioning data. It supports these extra parameters:

LOADFILE — required, because this is literally how you load the provisioning in from a file. No file, no join, periodt.

Example:

net offlinejoin requestodj loadfile=provisioning.txt

👑 WITNESS 👑

Okay so — starting with version 4.20, Samba has support for the SMB Witness service in a cluster. Slay. 🌈

Here are the witness commands that are implemented:

net witness list — List witness registrations from rpcd_witness_registration.tdb.
net witness client-move — Generate client move notifications for witness registrations to a new ip or node.
net witness share-move — Generate share move notifications for witness registrations to a new ip or node.
net witness force-unregister — Force unregistrations for witness registrations.
net witness force-response — Force an AsyncNotify response based on json input (mostly for testing).

WITNESS LIST 💖

List witness registrations from rpcd_witness_registration.tdb.

Note: Only supported with clustering=yes!

You can get machine readable output with this option:

--json — makes the output machine readable, bestie. 🤖

And you can narrow down which registrations get selected with these:

--witness-registration=REGISTRATION_UUID — does a direct lookup for REGISTRATION_UUID instead of grinding through a database traversal. Snappy.

The following options all take a POSIX Extended Regular Expression, which lets you filter the selection of registrations even further. They're applied as a logical AND — but each REGEX can specify multiple strings using the pipe symbol. 🫶

--witness-net-name=REGEX — this specifies the 'server name' the client registered for monitoring.
--witness-share-name=REGEX — this specifies the 'share name' the client registered for monitoring. Just so you know, the share name is optional in the registration — otherwise an empty string is what gets matched.
--witness-ip-address=REGEX — this specifies the ip address the client registered for monitoring.
--witness-client-computer-name=REGEX — this specifies the client computer name the client specified in the registration. Ngl, it's just a string the client chose all by itself. 🙈

WITNESS CLIENT-MOVE 🦋

Generate client move notifications for witness registrations to a new ip or node.

Note: Only supported with clustering=yes!

Machine readable output can be generated with this option:

--json — machine readable output, iconic as always ✨

The selection of registrations can be limited by the following options:

--witness-registration=REGISTRATION_UUID — this does a direct lookup for REGISTRATION_UUID instead of doing a database traversal.

The following options all take a POSIX Extended Regular Expression, which can further filter the selection of registrations. These options are applied as a logical AND, but each REGEX allows specifying multiple strings using the pipe symbol.

--witness-net-name=REGEX — this specifies the 'server name' the client registered for monitoring.
--witness-share-name=REGEX — this specifies the 'share name' the client registered for monitoring. Note that the share name is optional in the registration, otherwise an empty string is matched.
--witness-ip-address=REGEX — this specifies the ip address the client registered for monitoring.
--witness-client-computer-name=REGEX — this specifies the client computer name the client specified in the registration. Note it is just a string chosen by the client itself.

If the update should be applied to all registrations, it needs to be explicitly specified:

--witness-apply-to-all — this selects all registrations.

Note: This is mutual exclusive to the above options. Pick a lane, babe. 💅

The content of the CLIENT_MOVE notification contains ip addresses specified by (exactly one) of the following options:

--witness-new-node=NODEID — by specifying a NODEID, all ip addresses currently available on the given node are included in the response. And if you specify -1 as NODEID, all ip addresses of the cluster get included in the response. Everything, everywhere, all at once. 💀
--witness-new-ip=IPADDRESS — by specifying an IPADDRESS, only the specified ip address is included in the response.

Generate share move notifications for witness registrations to a new ip or node.

Note: Only supported with clustering=yes!

Machine readable output can be generated with this option:

--json — machine readable output. Obsessed. ⭐

The selection of registrations can be limited by the following options:

--witness-registration=REGISTRATION_UUID — this does a direct lookup for REGISTRATION_UUID instead of doing a database traversal.

--witness-net-name=REGEX — this specifies the 'server name' the client registered for monitoring.
--witness-share-name=REGEX — this specifies the 'share name' the client registered for monitoring. Note that the share name is optional in the registration, otherwise an empty string is matched.
--witness-ip-address=REGEX — this specifies the ip address the client registered for monitoring.
--witness-client-computer-name=REGEX — this specifies the client computer name the client specified in the registration. Note it is just a string chosen by the client itself.

If the update should be applied to all registrations it needs to be explicitly specified:

--witness-apply-to-all — this selects all registrations.

Note: This is mutual exclusive to the above options.

Note: This only applies to registrations with a non empty share name! 🫠

The content of the SHARE_MOVE notification contains ip addresses specified by (exactly one) of the following options:

--witness-new-node=NODEID — by specifying a NODEID, all ip addresses currently available on the given node are included in the response. By specifying -1 as NODEID, all ip addresses of the cluster are included in the response.
--witness-new-ip=IPADDRESS — by specifying an IPADDRESS, only the specified ip address is included in the response.

WITNESS FORCE-UNREGISTER 🌸

Force unregistrations for witness registrations.

Note: Only supported with clustering=yes!

Machine readable output can be generated with the following option:

--json — machine readable output, you know the drill 💜

The selection of registrations can be limited by the following options:

--witness-registration=REGISTRATION_UUID — this does a direct lookup for REGISTRATION_UUID instead of doing a database traversal.

--witness-net-name=REGEX — this specifies the 'server name' the client registered for monitoring.
--witness-share-name=REGEX — this specifies the 'share name' the client registered for monitoring. Note that the share name is optional in the registration, otherwise an empty string is matched.
--witness-ip-address=REGEX — this specifies the ip address the client registered for monitoring.
--witness-client-computer-name=REGEX — this specifies the client computer name the client specified in the registration. Note it is just a string chosen by the client itself.

If the update should be applied to all registrations it needs to be explicitly specified:

--witness-apply-to-all — this selects all registrations.

Note: This is mutual exclusive to the above options.

The selected registrations are removed on the server and any pending AsyncNotify request will get a NOT_FOUND error. 😭

Typically this triggers a clean re-registration on the client. Glow-up arc. ✨

WITNESS FORCE-RESPONSE 🔥

Force an AsyncNotify response based on json input (mostly for testing).

Note: Only supported with clustering=yes!

Machine readable output can be generated with the following option:

--json — machine readable output 💅

The selection of registrations can be limited by the following options:

--witness-registration=REGISTRATION_UUID — this does a direct lookup for REGISTRATION_UUID instead of doing a database traversal.

--witness-net-name=REGEX — this specifies the 'server name' the client registered for monitoring.
--witness-share-name=REGEX — this specifies the 'share name' the client registered for monitoring. Note that the share name is optional in the registration, otherwise an empty string is matched.
--witness-ip-address=REGEX — this specifies the ip address the client registered for monitoring.
--witness-client-computer-name=REGEX — this specifies the client computer name the client specified in the registration. Note it is just a string chosen by the client itself.

If the update should be applied to all registrations it needs to be explicitly specified:

--witness-apply-to-all — this selects all registrations.

Note: This is mutual exclusive to the above options.

Note: This is designed for testing and debugging! 🙈

In short: it is not designed to be used by administrators — it's for developers and automated tests. So if you're an admin, step away from this one, bestie. 🚫

By default an empty response with WERR_OK is generated, but basically any valid response can be specified by specifying a JSON string:

--witness-forced-response=JSON — hand it a JSON string and that's the response you get. Anything you want. The whole buffet. 👑

...which is how you end up with very complex witness_notifyResponse structures, no cap. 🫶

Ok bestie, real talk: this one is for the developers, so please actually read the code if you wanna understand all the possible values of that JSON string format... like, go read it, i'm not gonna hold your hand through it 😭

See net help witness force-response for further details, mwah 💋

🦋 serverid 🦋

Checks if a serverid actually exists, and also sweeps the stale entries out of the fileserver state databases. Bestie it's giving spring cleaning but for databases 🧹✨

The following commands are implemented:

net serverid exists — check existence of a serverid
net serverid wipedbs — clean stale entries from fileserver state databases

💜 serverid exists <serverid> 💜

Checks if a serverid exists. That's it, that's the whole job. Simple. Iconic. 💅

🌸 serverid wipedbs 🌸

Clean stale entries from fileserver state databases. Lowkey the main character of this section. 👑

Options for wipedbs:

--test — only check for stale entries and log them (peek, don't touch 🫣)
--verbose — produce verbose logging (so you get all the tea ☕)

✨ HELP [COMMAND] ✨

Gives usage information for the specified command. Like when you're lost and you need someone to just tell you what to do — this is that, bestie. 🧚

⭐ VERSION ⭐

This man page is part of version 4.24.7-Ubuntu-4.24.7+dfsg-1ubuntu1 of the Samba suite. 💖

👑 AUTHOR 👑

The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed. Fr fr, legends only. 🔥

The net manpage was written by Jelmer Vernooij. 🎀

and that's a wrap on NET(8) bestie!! this one shipped with Samba 4.24.7-Ubuntu-4.24.7+dfsg-1ubuntu1, dated 09/13/2026 — so if you're reading it on a different day, hi, hope you're hydrated. 💖✨ bye bestie, go net something iconic 🦋💅

📦 where this page comes from

ubuntu stonking: samba-common-bin 2:4.24.7+dfsg-1ubuntu1 · GPL-3.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms

NET(8)

NET(8) — System Administration tools

✨ NAME ✨

🦋 SYNOPSIS 🦋

💖 DESCRIPTION 💖

🌸 OPTIONS 🌸

💥 COMMANDS 💥

CHANGESECRETPW

TIME

TIME

TIME

TIME SYSTEM

TIME SET

TIME ZONE

[RPC|ADS] JOIN [TYPE] [--no-dns-updates] [-U username[%password]] [dnshostname=FQDN] [createupn=UPN] [createcomputer=OU] [machinepass=PASS] [osName=string osVer=string] [options]

🧛 RPC VAMPIRE 🧛

🩸 RPC VAMPIRE KEYTAB

🩸 RPC VAMPIRE LDIF

🩸 RPC GETSID

👑 ADS GPO 👑

💅 ADS GPO APPLY <USERNAME|MACHINENAME>

💅 ADS GPO GETGPO [GPO]

💅 ADS GPO LINKADD [LINKDN] [GPODN]

💅 ADS GPO LINKGET [CONTAINER]

💅 ADS GPO LIST <USERNAME|MACHINENAME>

💅 ADS GPO LISTALL

💅 ADS GPO REFRESH [USERNAME] [MACHINENAME]

🌐 ADS DNS 🌐

🦋 ADS DNS REGISTER [FQDN [IP [IP.....]]]

🦋 ADS DNS UNREGISTER <FQDN>

🌸 ADS LEAVE [--keep-account]

🌸 ADS STATUS

🖨️ ADS PRINTER 🖨️

🎀 ADS PRINTER INFO [PRINTER] [SERVER]

🎀 ADS PRINTER PUBLISH PRINTER

🎀 ADS PRINTER REMOVE PRINTER

🔍 ADS SEARCH 🔍

🍓 ADS SEARCH EXPRESSION ATTRIBUTES...

🍓 ADS DN DN (attributes)

🗝️ ADS KEYTAB CREATE 🗝️

🚫 (Removed!) ADS KEYTAB ADD (principal | machine | serviceclass | windows SPN) 🚫

🗝️ ADS KEYTAB LIST [keytab]

🚫 (Removed!) ADS KEYTAB DELETE (principal | machine | serviceclass | windows SPN) 🚫

🚫 (Removed!) ADS KEYTAB ADD_UPDATE_ADS (principal | machine | serviceclass | windows SPN) 🚫

🏷️ ADS SETSPN 🏷️

💜 ADS SETSPN LIST [machine]

💜 ADS SETSPN ADD [machine] SPN

💜 ADS SETSPN DELETE [machine] SPN

🏢 ADS WORKGROUP 🏢

🔐 ADS ENCTYPES 🔐

🔥 ADS ENCTYPES LIST <ACCOUNTNAME>

🔥 ADS ENCTYPES SET <ACCOUNTNAME> [enctypes]

🔥 ADS ENCTYPES DELETE <ACCOUNTNAME>

🎫 ADS KERBEROS 🎫

⭐ ADS KERBEROS KINIT

⭐ ADS KERBEROS RENEW

⭐ ADS KERBEROS PAC

🎟️ ADS KERBEROS PAC DUMP 🎟️

🎟️ ADS KERBEROS PAC SAVE 💾

🔧 SAM CREATEBUILTINGROUP <NAME>

🔧 SAM CREATELOCALGROUP <NAME>

🗑️ SAM DELETELOCALGROUP <NAME>

🔗 SAM MAPUNIXGROUP <NAME>

✂️ SAM UNMAPUNIXGROUP <NAME>

➕ SAM ADDMEM <GROUP> <MEMBER>

➖ SAM DELMEM <GROUP> <MEMBER>

📋 SAM LISTMEM <GROUP>

📋 SAM LIST <users|groups|localgroups|builtin|workstations> [verbose]

👑 SAM RIGHTS LIST

🎁 SAM RIGHTS GRANT <NAME> <PRIVILEGE>

🚫 SAM RIGHTS REVOKE <NAME> <PRIVILEGE>

🔍 SAM SHOW <NAME>

🏠 SAM SET HOMEDIR <NAME> <DIRECTORY>

🗂️ SAM SET PROFILEPATH <NAME> <PATH>

💬 SAM SET COMMENT <NAME> <COMMENT>

🪪 SAM SET FULLNAME <NAME> <FULL NAME>

📜 SAM SET LOGONSCRIPT <NAME> <SCRIPT>

🚗 SAM SET HOMEDRIVE <NAME> <DRIVE>

🖥️ SAM SET WORKSTATIONS <NAME> <WORKSTATIONS>

⛔ SAM SET DISABLE <NAME>

🎟️ `ADS KERBEROS PAC DUMP` 🎟️

🎟️ `ADS KERBEROS PAC SAVE` 💾

🔧 `SAM CREATEBUILTINGROUP` <NAME>

🔧 `SAM CREATELOCALGROUP` <NAME>

🗑️ `SAM DELETELOCALGROUP` <NAME>

🔗 `SAM MAPUNIXGROUP` <NAME>

✂️ `SAM UNMAPUNIXGROUP` <NAME>

➕ `SAM ADDMEM` <GROUP> <MEMBER>

➖ `SAM DELMEM` <GROUP> <MEMBER>

📋 `SAM LISTMEM` <GROUP>

📋 `SAM LIST` <users|groups|localgroups|builtin|workstations> [verbose]

👑 `SAM RIGHTS LIST`

🎁 `SAM RIGHTS GRANT` <NAME> <PRIVILEGE>

🚫 `SAM RIGHTS REVOKE` <NAME> <PRIVILEGE>

🔍 `SAM SHOW` <NAME>

🏠 `SAM SET HOMEDIR` <NAME> <DIRECTORY>

🗂️ `SAM SET PROFILEPATH` <NAME> <PATH>

💬 `SAM SET COMMENT` <NAME> <COMMENT>

🪪 `SAM SET FULLNAME` <NAME> <FULL NAME>

📜 `SAM SET LOGONSCRIPT` <NAME> <SCRIPT>

🚗 `SAM SET HOMEDRIVE` <NAME> <DRIVE>

🖥️ `SAM SET WORKSTATIONS` <NAME> <WORKSTATIONS>

⛔ `SAM SET DISABLE` <NAME>

🔓 `SAM SET PWNOTREQ` <NAME>

🔐 `SAM SET AUTOLOCK` <NAME>

♾️ `SAM SET PWNOEXP` <NAME>

🔄 `SAM SET PWDMUSTCHANGENOW` <NAME> [yes|no]

📜 `SAM POLICY LIST`

👀 `SAM POLICY SHOW` <account policy>

✍️ `SAM POLICY SET` <account policy> <value>

🧚 `SAM PROVISION`

🗄️ `IDMAP DUMP` <local tdb file name>

♻️ `IDMAP RESTORE` [input file]

🤫 `IDMAP SET SECRET` <DOMAIN> <secret>

📏 `IDMAP SET RANGE` <RANGE> <SID> [index] [--db=<DB>]

⚙️ `IDMAP SET CONFIG` <config> [--db=<DB>]

🔎 `IDMAP GET RANGE` <SID> [index] [--db=<DB>]

🔎 `IDMAP GET RANGES` [<SID>] [--db=<DB>]

🔎 `IDMAP GET CONFIG` [--db=<DB>]

🗑️ `IDMAP DELETE MAPPING` [-f] [--db=<DB>] <ID>

🗑️ `IDMAP DELETE RANGE` [-f] [--db=<TDB>] <RANGE>|(<SID> [<INDEX>])

🗑️ `IDMAP DELETE RANGES` [-f] [--db=<TDB>] <SID>

🩺 `IDMAP CHECK` [-v] [-r] [-a] [-T] [-f] [-l] [--db=<DB>]

🧑‍🤝‍🧑 `USERSHARE` 🌈

➕ `USERSHARE ADD` sharename path [comment] [acl] [guest_ok=[y|n]]

🔍 USERSHARE INFO `[--long] [wildcard sharename]`

📋 USERSHARE LIST `[--long] wildcard sharename`

🧚 `[RPC] CONF`

💖 `[RPC] CONF LIST`

📥 `[RPC] CONF IMPORT [--test|-T] filename [section]`

🗂️ `[RPC] CONF LISTSHARES`

💥 `[RPC] CONF DROP`

🔎 `[RPC] CONF SHOWSHARE sharename`

🎀 `[RPC] CONF ADDSHARE sharename path [writeable={y|N} [guest_ok={y|N} [comment]]]`

🚫 `[RPC] CONF DELSHARE sharename`

💾 `[RPC] CONF SETPARM section parameter value`

🔍 `[RPC] CONF GETPARM section parameter`

🗑️ `[RPC] CONF DELPARM section parameter`

📜 `[RPC] CONF GETINCLUDES section`

🛠️ `[RPC] CONF SETINCLUDES section [filename]+`

✂️ `[RPC] CONF DELINCLUDES section`

🔢 `REGISTRY ENUMERATE key`

🔁 `REGISTRY ENUMERATE_RECURSIVE key`

🌱 `REGISTRY CREATEKEY key`

🗑️ `REGISTRY DELETEKEY key`

💀 `REGISTRY DELETEKEY_RECURSIVE key`

🔎 `REGISTRY GETVALUE key name`

🧪 `REGISTRY GETVALUERAW key name`

✍️ `REGISTRY SETVALUE key name type value ...`

➕ `REGISTRY INCREMENT key name [inc]`

🗑️ `REGISTRY DELETEVALUE key name`

🔐 `REGISTRY GETSD key`

🎫 `REGISTRY GETSD_SDDL key`

🖊️ `REGISTRY SETSD_SDDL key sd`

📥 `REGISTRY IMPORT file [--precheck <check-file>] [opt]`

📤 `REGISTRY EXPORT keyfile[opt]`

🔄 `REGISTRY CONVERT in out [[inopt] outopt]`