1<?xml version="1.0" encoding="iso-8859-1"?> 2<!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc"> 3<refentry id="net.8"> 4 5<refmeta> 6 <refentrytitle>net</refentrytitle> 7 <manvolnum>8</manvolnum> 8 <refmiscinfo class="source">Samba</refmiscinfo> 9 <refmiscinfo class="manual">System Administration tools</refmiscinfo> 10 <refmiscinfo class="version">3.5</refmiscinfo> 11</refmeta> 12 13 14<refnamediv> 15 <refname>net</refname> 16 <refpurpose>Tool for administration of Samba and remote 17 CIFS servers. 18 </refpurpose> 19</refnamediv> 20 21<refsynopsisdiv> 22 <cmdsynopsis> 23 <command>net</command> 24 <arg choice="req"><ads|rap|rpc></arg> 25 <arg choice="opt">-h</arg> 26 <arg choice="opt">-w workgroup</arg> 27 <arg choice="opt">-W myworkgroup</arg> 28 <arg choice="opt">-U user</arg> 29 <arg choice="opt">-I ip-address</arg> 30 <arg choice="opt">-p port</arg> 31 <arg choice="opt">-n myname</arg> 32 <arg choice="opt">-s conffile</arg> 33 <arg choice="opt">-S server</arg> 34 <arg choice="opt">-l</arg> 35 <arg choice="opt">-P</arg> 36 <arg choice="opt">-d debuglevel</arg> 37 <arg choice="opt">-V</arg> 38 <arg choice="opt">--request-timeout seconds</arg> 39 </cmdsynopsis> 40</refsynopsisdiv> 41 42<refsect1> 43 <title>DESCRIPTION</title> 44 45 <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle> 46 <manvolnum>7</manvolnum></citerefentry> suite.</para> 47 48 <para>The Samba net utility is meant to work just like the net utility 49 available for windows and DOS. The first argument should be used 50 to specify the protocol to use when executing a certain command. 51 ADS is used for ActiveDirectory, RAP is using for old (Win9x/NT3) 52 clients and RPC can be used for NT4 and Windows 2000. If this 53 argument is omitted, net will try to determine it automatically. 54 Not all commands are available on all protocols. 55 </para> 56 57</refsect1> 58 59<refsect1> 60 <title>OPTIONS</title> 61 62 <variablelist> 63 &stdarg.help; 64 65 <varlistentry> 66 <term>-w target-workgroup</term> 67 <listitem><para> 68 Sets target workgroup or domain. You have to specify 69 either this option or the IP address or the name of a server. 70 </para></listitem> 71 </varlistentry> 72 73 <varlistentry> 74 <term>-W workgroup</term> 75 <listitem><para> 76 Sets client workgroup or domain 77 </para></listitem> 78 </varlistentry> 79 80 <varlistentry> 81 <term>-U user</term> 82 <listitem><para> 83 User name to use 84 </para></listitem> 85 </varlistentry> 86 87 <varlistentry> 88 <term>-I ip-address</term> 89 <listitem><para> 90 IP address of target server to use. You have to 91 specify either this option or a target workgroup or 92 a target server. 93 </para></listitem> 94 </varlistentry> 95 96 <varlistentry> 97 <term>-p port</term> 98 <listitem><para> 99 Port on the target server to connect to (usually 139 or 445). 100 Defaults to trying 445 first, then 139. 101 </para></listitem> 102 </varlistentry> 103 104 &stdarg.netbios.name; 105 &stdarg.configfile; 106 107 <varlistentry> 108 <term>-S server</term> 109 <listitem><para> 110 Name of target server. You should specify either 111 this option or a target workgroup or a target IP address. 112 </para></listitem> 113 </varlistentry> 114 115 <varlistentry> 116 <term>-l</term> 117 <listitem><para> 118 When listing data, give more information on each item. 119 </para></listitem> 120 </varlistentry> 121 122 <varlistentry> 123 <term>-P</term> 124 <listitem><para> 125 Make queries to the external server using the machine account of the local server. 126 </para></listitem> 127 </varlistentry> 128 129 <varlistentry> 130 <term>--request-timeout 30</term> 131 <listitem><para> 132 Let client requests timeout after 30 seconds the default is 10 133 seconds. 134 </para></listitem> 135 </varlistentry> 136 137 &stdarg.server.debug; 138 </variablelist> 139</refsect1> 140 141<refsect1> 142<title>COMMANDS</title> 143 144<refsect2> 145<title>CHANGESECRETPW</title> 146 147<para>This command allows the Samba machine account password to be set from an external application 148to a machine account password that has already been stored in Active Directory. DO NOT USE this command 149unless you know exactly what you are doing. The use of this command requires that the force flag (-f) 150be used also. There will be NO command prompt. Whatever information is piped into stdin, either by 151typing at the command line or otherwise, will be stored as the literal machine password. Do NOT use 152this without care and attention as it will overwrite a legitimate machine password without warning. 153YOU HAVE BEEN WARNED. 154</para> 155 156</refsect2> 157 158<refsect2> 159 <title>TIME</title> 160 161 <para>The <command>NET TIME</command> command allows you to view the time on a remote server 162 or synchronise the time on the local server with the time on the remote server.</para> 163 164<refsect3> 165<title>TIME</title> 166 167<para>Without any options, the <command>NET TIME</command> command 168displays the time on the remote server. 169</para> 170 171</refsect3> 172 173<refsect3> 174<title>TIME SYSTEM</title> 175 176<para>Displays the time on the remote server in a format ready for <command>/bin/date</command>.</para> 177 178</refsect3> 179 180<refsect3> 181<title>TIME SET</title> 182<para>Tries to set the date and time of the local server to that on 183the remote server using <command>/bin/date</command>. </para> 184 185</refsect3> 186 187<refsect3> 188<title>TIME ZONE</title> 189 190<para>Displays the timezone in hours from GMT on the remote computer.</para> 191 192</refsect3> 193</refsect2> 194 195<refsect2> 196<title>[RPC|ADS] JOIN [TYPE] [-U username[%password]] [createupn=UPN] [createcomputer=OU] [options]</title> 197 198<para> 199Join a domain. If the account already exists on the server, and 200[TYPE] is MEMBER, the machine will attempt to join automatically. 201(Assuming that the machine has been created in server manager) 202Otherwise, a password will be prompted for, and a new account may 203be created.</para> 204 205<para> 206[TYPE] may be PDC, BDC or MEMBER to specify the type of server 207joining the domain. 208</para> 209 210<para> 211[UPN] (ADS only) set the principalname attribute during the join. The default 212format is host/netbiosname@REALM. 213</para> 214 215<para> 216[OU] (ADS only) Precreate the computer account in a specific OU. The 217OU string reads from top to bottom without RDNs, and is delimited by 218a '/'. Please note that '\' is used for escape by both the shell 219and ldap, so it may need to be doubled or quadrupled to pass through, 220and it is not used as a delimiter. 221</para> 222</refsect2> 223 224<refsect2> 225<title>[RPC] OLDJOIN [options]</title> 226 227<para>Join a domain. Use the OLDJOIN option to join the domain 228using the old style of domain joining - you need to create a trust 229account in server manager first.</para> 230</refsect2> 231 232<refsect2> 233<title>[RPC|ADS] USER</title> 234 235<refsect3> 236<title>[RPC|ADS] USER</title> 237 238<para>List all users</para> 239 240</refsect3> 241 242<refsect3> 243<title>[RPC|ADS] USER DELETE <replaceable>target</replaceable></title> 244 245<para>Delete specified user</para> 246 247</refsect3> 248 249<refsect3> 250<title>[RPC|ADS] USER INFO <replaceable>target</replaceable></title> 251 252<para>List the domain groups of the specified user.</para> 253 254</refsect3> 255 256<refsect3> 257<title>[RPC|ADS] USER RENAME <replaceable>oldname</replaceable> <replaceable>newname</replaceable></title> 258 259<para>Rename specified user.</para> 260 261</refsect3> 262 263<refsect3> 264<title>[RPC|ADS] USER ADD <replaceable>name</replaceable> [password] [-F user flags] [-C comment]</title> 265 266<para>Add specified user.</para> 267</refsect3> 268</refsect2> 269 270<refsect2> 271<title>[RPC|ADS] GROUP</title> 272 273<refsect3> 274<title>[RPC|ADS] GROUP [misc options] [targets]</title> 275<para>List user groups.</para> 276</refsect3> 277 278<refsect3> 279<title>[RPC|ADS] GROUP DELETE <replaceable>name</replaceable> [misc. options]</title> 280 281<para>Delete specified group.</para> 282 283</refsect3> 284 285<refsect3> 286<title>[RPC|ADS] GROUP ADD <replaceable>name</replaceable> [-C comment]</title> 287 288<para>Create specified group.</para> 289 290</refsect3> 291</refsect2> 292 293<refsect2> 294<title>[RAP|RPC] SHARE</title> 295 296<refsect3> 297<title>[RAP|RPC] SHARE [misc. options] [targets]</title> 298 299<para>Enumerates all exported resources (network shares) on target server.</para> 300 301</refsect3> 302 303<refsect3> 304<title>[RAP|RPC] SHARE ADD <replaceable>name=serverpath</replaceable> [-C comment] [-M maxusers] [targets]</title> 305 306<para>Adds a share from a server (makes the export active). Maxusers 307specifies the number of users that can be connected to the 308share simultaneously.</para> 309 310</refsect3> 311 312<refsect3> 313<title>SHARE DELETE <replaceable>sharename</replaceable></title> 314 315<para>Delete specified share.</para> 316</refsect3> 317</refsect2> 318 319<refsect2> 320<title>[RPC|RAP] FILE</title> 321 322<refsect3> 323<title>[RPC|RAP] FILE</title> 324 325<para>List all open files on remote server.</para> 326 327</refsect3> 328 329<refsect3> 330<title>[RPC|RAP] FILE CLOSE <replaceable>fileid</replaceable></title> 331 332<para>Close file with specified <replaceable>fileid</replaceable> on 333remote server.</para> 334 335</refsect3> 336 337<refsect3> 338<title>[RPC|RAP] FILE INFO <replaceable>fileid</replaceable></title> 339 340<para> 341Print information on specified <replaceable>fileid</replaceable>. 342Currently listed are: file-id, username, locks, path, permissions. 343</para> 344 345</refsect3> 346 347<refsect3> 348<title>[RAP|RPC] FILE USER <replaceable>user</replaceable></title> 349 350<para> 351List files opened by specified <replaceable>user</replaceable>. 352Please note that <command>net rap file user</command> does not work 353against Samba servers. 354</para> 355 356</refsect3> 357 358</refsect2> 359 360<refsect2> 361<title>SESSION</title> 362 363<refsect3> 364<title>RAP SESSION</title> 365 366<para>Without any other options, SESSION enumerates all active SMB/CIFS 367sessions on the target server.</para> 368 369</refsect3> 370 371<refsect3> 372<title>RAP SESSION DELETE|CLOSE <replaceable>CLIENT_NAME</replaceable></title> 373 374<para>Close the specified sessions.</para> 375 376</refsect3> 377 378<refsect3> 379<title>RAP SESSION INFO <replaceable>CLIENT_NAME</replaceable></title> 380 381<para>Give a list with all the open files in specified session.</para> 382 383</refsect3> 384 385</refsect2> 386 387<refsect2> 388<title>RAP SERVER <replaceable>DOMAIN</replaceable></title> 389 390<para>List all servers in specified domain or workgroup. Defaults 391to local domain.</para> 392 393</refsect2> 394 395<refsect2> 396<title>RAP DOMAIN</title> 397 398<para>Lists all domains and workgroups visible on the 399current network.</para> 400 401</refsect2> 402 403<refsect2> 404<title>RAP PRINTQ</title> 405 406<refsect3> 407<title>RAP PRINTQ INFO <replaceable>QUEUE_NAME</replaceable></title> 408 409<para>Lists the specified print queue and print jobs on the server. 410If the <replaceable>QUEUE_NAME</replaceable> is omitted, all 411queues are listed.</para> 412 413</refsect3> 414 415<refsect3> 416<title>RAP PRINTQ DELETE <replaceable>JOBID</replaceable></title> 417 418<para>Delete job with specified id.</para> 419 420</refsect3> 421 422</refsect2> 423 424<refsect2> 425<title>RAP VALIDATE <replaceable>user</replaceable> [<replaceable>password</replaceable>]</title> 426 427<para> 428Validate whether the specified user can log in to the 429remote server. If the password is not specified on the commandline, it 430will be prompted. 431</para> 432 433¬.implemented; 434 435</refsect2> 436 437<refsect2> 438<title>RAP GROUPMEMBER</title> 439 440<refsect3> 441<title>RAP GROUPMEMBER LIST <replaceable>GROUP</replaceable></title> 442 443<para>List all members of the specified group.</para> 444 445</refsect3> 446 447<refsect3> 448<title>RAP GROUPMEMBER DELETE <replaceable>GROUP</replaceable> <replaceable>USER</replaceable></title> 449 450<para>Delete member from group.</para> 451 452</refsect3> 453 454<refsect3> 455<title>RAP GROUPMEMBER ADD <replaceable>GROUP</replaceable> <replaceable>USER</replaceable></title> 456 457<para>Add member to group.</para> 458 459</refsect3> 460 461</refsect2> 462 463<refsect2> 464<title>RAP ADMIN <replaceable>command</replaceable></title> 465 466<para>Execute the specified <replaceable>command</replaceable> on 467the remote server. Only works with OS/2 servers. 468</para> 469 470¬.implemented; 471 472</refsect2> 473 474<refsect2> 475<title>RAP SERVICE</title> 476 477<refsect3> 478<title>RAP SERVICE START <replaceable>NAME</replaceable> [arguments...]</title> 479 480<para>Start the specified service on the remote server. Not implemented yet.</para> 481 482¬.implemented; 483 484</refsect3> 485 486<refsect3> 487<title>RAP SERVICE STOP</title> 488 489<para>Stop the specified service on the remote server.</para> 490 491¬.implemented; 492 493</refsect3> 494 495</refsect2> 496 497<refsect2> 498<title>RAP PASSWORD <replaceable>USER</replaceable> <replaceable>OLDPASS</replaceable> <replaceable>NEWPASS</replaceable></title> 499 500<para> 501Change password of <replaceable>USER</replaceable> from <replaceable>OLDPASS</replaceable> to <replaceable>NEWPASS</replaceable>. 502</para> 503 504</refsect2> 505 506<refsect2> 507<title>LOOKUP</title> 508 509<refsect3> 510<title>LOOKUP HOST <replaceable>HOSTNAME</replaceable> [<replaceable>TYPE</replaceable>]</title> 511 512<para> 513Lookup the IP address of the given host with the specified type (netbios suffix). 514The type defaults to 0x20 (workstation). 515</para> 516 517</refsect3> 518 519<refsect3> 520<title>LOOKUP LDAP [<replaceable>DOMAIN</replaceable>]</title> 521 522<para>Give IP address of LDAP server of specified <replaceable>DOMAIN</replaceable>. Defaults to local domain.</para> 523 524</refsect3> 525 526<refsect3> 527<title>LOOKUP KDC [<replaceable>REALM</replaceable>]</title> 528 529<para>Give IP address of KDC for the specified <replaceable>REALM</replaceable>. 530Defaults to local realm.</para> 531 532</refsect3> 533 534<refsect3> 535<title>LOOKUP DC [<replaceable>DOMAIN</replaceable>]</title> 536 537<para>Give IP's of Domain Controllers for specified <replaceable> 538DOMAIN</replaceable>. Defaults to local domain.</para> 539 540</refsect3> 541 542<refsect3> 543<title>LOOKUP MASTER <replaceable>DOMAIN</replaceable></title> 544 545<para>Give IP of master browser for specified <replaceable>DOMAIN</replaceable> 546or workgroup. Defaults to local domain.</para> 547 548</refsect3> 549 550</refsect2> 551 552<refsect2> 553<title>CACHE</title> 554 555<para>Samba uses a general caching interface called 'gencache'. It 556can be controlled using 'NET CACHE'.</para> 557 558<para>All the timeout parameters support the suffixes: 559 560<simplelist> 561<member>s - Seconds</member> 562<member>m - Minutes</member> 563<member>h - Hours</member> 564<member>d - Days</member> 565<member>w - Weeks</member> 566</simplelist> 567 568</para> 569 570<refsect3> 571<title>CACHE ADD <replaceable>key</replaceable> <replaceable>data</replaceable> <replaceable>time-out</replaceable></title> 572 573<para>Add specified key+data to the cache with the given timeout.</para> 574 575</refsect3> 576 577<refsect3> 578<title>CACHE DEL <replaceable>key</replaceable></title> 579 580<para>Delete key from the cache.</para> 581 582</refsect3> 583 584<refsect3> 585<title>CACHE SET <replaceable>key</replaceable> <replaceable>data</replaceable> <replaceable>time-out</replaceable></title> 586 587<para>Update data of existing cache entry.</para> 588 589</refsect3> 590 591<refsect3> 592<title>CACHE SEARCH <replaceable>PATTERN</replaceable></title> 593 594<para>Search for the specified pattern in the cache data.</para> 595 596</refsect3> 597 598<refsect3> 599<title>CACHE LIST</title> 600 601<para> 602List all current items in the cache. 603</para> 604 605</refsect3> 606 607<refsect3> 608<title>CACHE FLUSH</title> 609 610<para>Remove all the current items from the cache.</para> 611 612</refsect3> 613 614</refsect2> 615 616<refsect2> 617<title>GETLOCALSID [DOMAIN]</title> 618 619<para>Prints the SID of the specified domain, or if the parameter is 620omitted, the SID of the local server.</para> 621 622</refsect2> 623 624<refsect2> 625<title>SETLOCALSID S-1-5-21-x-y-z</title> 626 627<para>Sets SID for the local server to the specified SID.</para> 628 629</refsect2> 630 631<refsect2> 632<title>GETDOMAINSID</title> 633 634<para>Prints the local machine SID and the SID of the current 635domain.</para> 636 637</refsect2> 638 639<refsect2> 640<title>SETDOMAINSID</title> 641 642<para>Sets the SID of the current domain.</para> 643 644</refsect2> 645 646<refsect2> 647<title>GROUPMAP</title> 648 649<para>Manage the mappings between Windows group SIDs and UNIX groups. 650Common options include:</para> 651 652<itemizedlist> 653<listitem><para>unixgroup - Name of the UNIX group</para></listitem> 654<listitem><para>ntgroup - Name of the Windows NT group (must be 655 resolvable to a SID</para></listitem> 656<listitem><para>rid - Unsigned 32-bit integer</para></listitem> 657<listitem><para>sid - Full SID in the form of "S-1-..."</para></listitem> 658<listitem><para>type - Type of the group; either 'domain', 'local', 659 or 'builtin'</para></listitem> 660<listitem><para>comment - Freeform text description of the group</para></listitem> 661</itemizedlist> 662 663<refsect3> 664<title>GROUPMAP ADD</title> 665 666<para> 667Add a new group mapping entry: 668<programlisting> 669net groupmap add {rid=int|sid=string} unixgroup=string \ 670 [type={domain|local}] [ntgroup=string] [comment=string] 671</programlisting> 672</para> 673 674</refsect3> 675 676<refsect3> 677<title>GROUPMAP DELETE</title> 678 679<para>Delete a group mapping entry. If more than one group name matches, the first entry found is deleted.</para> 680 681<para>net groupmap delete {ntgroup=string|sid=SID}</para> 682 683</refsect3> 684 685<refsect3> 686<title>GROUPMAP MODIFY</title> 687 688<para>Update en existing group entry.</para> 689 690<para> 691<programlisting> 692net groupmap modify {ntgroup=string|sid=SID} [unixgroup=string] \ 693 [comment=string] [type={domain|local}] 694</programlisting> 695</para> 696</refsect3> 697 698<refsect3> 699<title>GROUPMAP LIST</title> 700 701<para>List existing group mapping entries.</para> 702 703<para>net groupmap list [verbose] [ntgroup=string] [sid=SID]</para> 704 705</refsect3> 706</refsect2> 707 708 709 710<refsect2> 711<title>MAXRID</title> 712 713<para>Prints out the highest RID currently in use on the local 714server (by the active 'passdb backend'). 715</para> 716 717</refsect2> 718 719<refsect2> 720<title>RPC INFO</title> 721 722<para>Print information about the domain of the remote server, 723such as domain name, domain sid and number of users and groups. 724</para> 725 726</refsect2> 727 728<refsect2> 729<title>[RPC|ADS] TESTJOIN</title> 730 731<para>Check whether participation in a domain is still valid.</para> 732 733</refsect2> 734 735<refsect2> 736<title>[RPC|ADS] CHANGETRUSTPW</title> 737 738<para>Force change of domain trust password.</para> 739 740</refsect2> 741 742<refsect2> 743<title>RPC TRUSTDOM</title> 744 745<refsect3> 746<title>RPC TRUSTDOM ADD <replaceable>DOMAIN</replaceable></title> 747 748<para>Add a interdomain trust account for <replaceable>DOMAIN</replaceable>. 749This is in fact a Samba account named <replaceable>DOMAIN$</replaceable> 750with the account flag <constant>'I'</constant> (interdomain trust account). 751This is required for incoming trusts to work. It makes Samba be a 752trusted domain of the foreign (trusting) domain. 753Users of the Samba domain will be made available in the foreign domain. 754If the command is used against localhost it has the same effect as 755<command>smbpasswd -a -i DOMAIN</command>. Please note that both commands 756expect a appropriate UNIX account. 757</para> 758 759</refsect3> 760 761<refsect3> 762<title>RPC TRUSTDOM DEL <replaceable>DOMAIN</replaceable></title> 763 764<para>Remove interdomain trust account for 765<replaceable>DOMAIN</replaceable>. If it is used against localhost 766it has the same effect as <command>smbpasswd -x DOMAIN$</command>. 767</para> 768 769</refsect3> 770 771<refsect3> 772<title>RPC TRUSTDOM ESTABLISH <replaceable>DOMAIN</replaceable></title> 773 774<para> 775Establish a trust relationship to a trusted domain. 776Interdomain account must already be created on the remote PDC. 777This is required for outgoing trusts to work. It makes Samba be a 778trusting domain of a foreign (trusted) domain. 779Users of the foreign domain will be made available in our domain. 780You'll need winbind and a working idmap config to make them 781appear in your system. 782</para> 783 784</refsect3> 785 786<refsect3> 787<title>RPC TRUSTDOM REVOKE <replaceable>DOMAIN</replaceable></title> 788<para>Abandon relationship to trusted domain</para> 789 790</refsect3> 791 792<refsect3> 793<title>RPC TRUSTDOM LIST</title> 794 795<para>List all interdomain trust relationships.</para> 796 797</refsect3> 798 799<refsect3> 800<title>RPC RIGHTS</title> 801 802<para>This subcommand is used to view and manage Samba's rights assignments (also 803referred to as privileges). There are three options currently available: 804<parameter>list</parameter>, <parameter>grant</parameter>, and 805<parameter>revoke</parameter>. More details on Samba's privilege model and its use 806can be found in the Samba-HOWTO-Collection.</para> 807 808</refsect3> 809 810 811</refsect2> 812 813<refsect2> 814<title>RPC ABORTSHUTDOWN</title> 815 816<para>Abort the shutdown of a remote server.</para> 817 818</refsect2> 819 820<refsect2> 821<title>RPC SHUTDOWN [-t timeout] [-r] [-f] [-C message]</title> 822 823<para>Shut down the remote server.</para> 824 825<variablelist> 826<varlistentry> 827<term>-r</term> 828<listitem><para> 829Reboot after shutdown. 830</para></listitem> 831</varlistentry> 832 833<varlistentry> 834<term>-f</term> 835<listitem><para> 836Force shutting down all applications. 837</para></listitem> 838</varlistentry> 839 840<varlistentry> 841<term>-t timeout</term> 842<listitem><para> 843Timeout before system will be shut down. An interactive 844user of the system can use this time to cancel the shutdown. 845</para></listitem> 846</varlistentry> 847 848<varlistentry> 849<term>-C message</term> 850<listitem><para>Display the specified message on the screen to 851announce the shutdown.</para></listitem> 852</varlistentry> 853</variablelist> 854 855</refsect2> 856 857<refsect2> 858<title>RPC SAMDUMP</title> 859 860<para>Print out sam database of remote server. You need 861to run this against the PDC, from a Samba machine joined as a BDC. </para> 862</refsect2> 863 864<refsect2> 865<title>RPC VAMPIRE</title> 866 867<para>Export users, aliases and groups from remote server to 868local server. You need to run this against the PDC, from a Samba machine joined as a BDC. 869</para> 870</refsect2> 871 872<refsect2> 873<title>RPC VAMPIRE KEYTAB</title> 874 875<para>Dump remote SAM database to local Kerberos keytab file. 876</para> 877</refsect2> 878 879<refsect2> 880<title>RPC VAMPIRE LDIF</title> 881 882<para>Dump remote SAM database to local LDIF file or standard output. 883</para> 884</refsect2> 885 886<refsect2> 887<title>RPC GETSID</title> 888 889<para>Fetch domain SID and store it in the local <filename>secrets.tdb</filename>. </para> 890 891</refsect2> 892 893<refsect2> 894<title>ADS LEAVE</title> 895 896<para>Make the remote host leave the domain it is part of. </para> 897 898</refsect2> 899 900<refsect2> 901<title>ADS STATUS</title> 902 903<para>Print out status of machine account of the local machine in ADS. 904Prints out quite some debug info. Aimed at developers, regular 905users should use <command>NET ADS TESTJOIN</command>.</para> 906 907</refsect2> 908 909<refsect2> 910<title>ADS PRINTER</title> 911 912<refsect3> 913<title>ADS PRINTER INFO [<replaceable>PRINTER</replaceable>] [<replaceable>SERVER</replaceable>]</title> 914 915<para> 916Lookup info for <replaceable>PRINTER</replaceable> on <replaceable>SERVER</replaceable>. The printer name defaults to "*", the 917server name defaults to the local host.</para> 918 919</refsect3> 920 921<refsect3> 922<title>ADS PRINTER PUBLISH <replaceable>PRINTER</replaceable></title> 923 924<para>Publish specified printer using ADS.</para> 925 926</refsect3> 927 928<refsect3> 929<title>ADS PRINTER REMOVE <replaceable>PRINTER</replaceable></title> 930 931<para>Remove specified printer from ADS directory.</para> 932 933</refsect3> 934 935</refsect2> 936 937<refsect2> 938<title>ADS SEARCH <replaceable>EXPRESSION</replaceable> <replaceable>ATTRIBUTES...</replaceable></title> 939 940<para>Perform a raw LDAP search on a ADS server and dump the results. The 941expression is a standard LDAP search expression, and the 942attributes are a list of LDAP fields to show in the results.</para> 943 944<para>Example: <userinput>net ads search '(objectCategory=group)' sAMAccountName</userinput> 945</para> 946 947</refsect2> 948 949<refsect2> 950<title>ADS DN <replaceable>DN</replaceable> <replaceable>(attributes)</replaceable></title> 951 952<para> 953Perform a raw LDAP search on a ADS server and dump the results. The 954DN standard LDAP DN, and the attributes are a list of LDAP fields 955to show in the result. 956</para> 957 958<para>Example: <userinput>net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' SAMAccountName</userinput></para> 959 960</refsect2> 961 962<refsect2> 963<title>ADS WORKGROUP</title> 964 965<para>Print out workgroup name for specified kerberos realm.</para> 966 967</refsect2> 968 969<refsect2> 970<title>SAM CREATEBUILTINGROUP <NAME></title> 971 972<para> 973(Re)Create a BUILTIN group. 974Only a wellknown set of BUILTIN groups can be created with this command. 975This is the list of currently recognized group names: Administrators, 976Users, Guests, Power Users, Account Operators, Server Operators, Print 977Operators, Backup Operators, Replicator, RAS Servers, Pre-Windows 2000 978compatible Access. 979 980This command requires a running Winbindd with idmap allocation properly 981configured. The group gid will be allocated out of the winbindd range. 982</para> 983 984</refsect2> 985 986<refsect2> 987<title>SAM CREATELOCALGROUP <NAME></title> 988 989<para> 990Create a LOCAL group (also known as Alias). 991 992This command requires a running Winbindd with idmap allocation properly 993configured. The group gid will be allocated out of the winbindd range. 994</para> 995 996</refsect2> 997 998<refsect2> 999<title>SAM DELETELOCALGROUP <NAME></title> 1000 1001<para> 1002Delete an existing LOCAL group (also known as Alias). 1003 1004</para> 1005 1006</refsect2> 1007 1008<refsect2> 1009<title>SAM MAPUNIXGROUP <NAME></title> 1010 1011<para> 1012Map an existing Unix group and make it a Domain Group, the domain group 1013will have the same name. 1014</para> 1015 1016</refsect2> 1017 1018<refsect2> 1019<title>SAM UNMAPUNIXGROUP <NAME></title> 1020 1021<para> 1022Remove an existing group mapping entry. 1023</para> 1024 1025</refsect2> 1026 1027<refsect2> 1028<title>SAM ADDMEM <GROUP> <MEMBER></title> 1029 1030<para> 1031Add a member to a Local group. The group can be specified only by name, 1032the member can be specified by name or SID. 1033</para> 1034 1035</refsect2> 1036 1037<refsect2> 1038<title>SAM DELMEM <GROUP> <MEMBER></title> 1039 1040<para> 1041Remove a member from a Local group. The group and the member must be 1042specified by name. 1043</para> 1044 1045</refsect2> 1046 1047<refsect2> 1048<title>SAM LISTMEM <GROUP></title> 1049 1050<para> 1051List Local group members. The group must be specified by name. 1052</para> 1053 1054</refsect2> 1055 1056<refsect2> 1057<title>SAM LIST <users|groups|localgroups|builtin|workstations> [verbose]</title> 1058 1059<para> 1060List the specified set of accounts by name. If verbose is specified, 1061the rid and description is also provided for each account. 1062</para> 1063 1064</refsect2> 1065 1066<refsect2> 1067<title>SAM RIGHTS LIST</title> 1068 1069<para> 1070List all available privileges. 1071</para> 1072 1073</refsect2> 1074 1075<refsect2> 1076<title>SAM RIGHTS GRANT <NAME> <PRIVILEGE></title> 1077 1078<para> 1079Grant one or more privileges to a user. 1080</para> 1081 1082</refsect2> 1083 1084<refsect2> 1085<title>SAM RIGHTS REVOKE <NAME> <PRIVILEGE></title> 1086 1087<para> 1088Revoke one or more privileges from a user. 1089</para> 1090 1091</refsect2> 1092 1093<refsect2> 1094<title>SAM SHOW <NAME></title> 1095 1096<para> 1097Show the full DOMAIN\\NAME the SID and the type for the corresponding 1098account. 1099</para> 1100 1101</refsect2> 1102 1103<refsect2> 1104<title>SAM SET HOMEDIR <NAME> <DIRECTORY></title> 1105 1106<para> 1107Set the home directory for a user account. 1108</para> 1109 1110</refsect2> 1111 1112<refsect2> 1113<title>SAM SET PROFILEPATH <NAME> <PATH></title> 1114 1115<para> 1116Set the profile path for a user account. 1117</para> 1118 1119</refsect2> 1120 1121<refsect2> 1122<title>SAM SET COMMENT <NAME> <COMMENT></title> 1123 1124<para> 1125Set the comment for a user or group account. 1126</para> 1127 1128</refsect2> 1129 1130<refsect2> 1131<title>SAM SET FULLNAME <NAME> <FULL NAME></title> 1132 1133<para> 1134Set the full name for a user account. 1135</para> 1136 1137</refsect2> 1138 1139<refsect2> 1140<title>SAM SET LOGONSCRIPT <NAME> <SCRIPT></title> 1141 1142<para> 1143Set the logon script for a user account. 1144</para> 1145 1146</refsect2> 1147 1148<refsect2> 1149<title>SAM SET HOMEDRIVE <NAME> <DRIVE></title> 1150 1151<para> 1152Set the home drive for a user account. 1153</para> 1154 1155</refsect2> 1156 1157<refsect2> 1158<title>SAM SET WORKSTATIONS <NAME> <WORKSTATIONS></title> 1159 1160<para> 1161Set the workstations a user account is allowed to log in from. 1162</para> 1163 1164</refsect2> 1165 1166<refsect2> 1167<title>SAM SET DISABLE <NAME></title> 1168 1169<para> 1170Set the "disabled" flag for a user account. 1171</para> 1172 1173</refsect2> 1174 1175<refsect2> 1176<title>SAM SET PWNOTREQ <NAME></title> 1177 1178<para> 1179Set the "password not required" flag for a user account. 1180</para> 1181 1182</refsect2> 1183 1184<refsect2> 1185<title>SAM SET AUTOLOCK <NAME></title> 1186 1187<para> 1188Set the "autolock" flag for a user account. 1189</para> 1190 1191</refsect2> 1192 1193<refsect2> 1194<title>SAM SET PWNOEXP <NAME></title> 1195 1196<para> 1197Set the "password do not expire" flag for a user account. 1198</para> 1199 1200</refsect2> 1201 1202<refsect2> 1203<title>SAM SET PWDMUSTCHANGENOW <NAME> [yes|no]</title> 1204 1205<para> 1206Set or unset the "password must change" flag for a user account. 1207</para> 1208 1209</refsect2> 1210 1211<refsect2> 1212<title>SAM POLICY LIST</title> 1213 1214<para> 1215List the available account policies. 1216</para> 1217 1218</refsect2> 1219 1220<refsect2> 1221<title>SAM POLICY SHOW <account policy></title> 1222 1223<para> 1224Show the account policy value. 1225</para> 1226 1227</refsect2> 1228 1229<refsect2> 1230<title>SAM POLICY SET <account policy> <value></title> 1231 1232<para> 1233Set a value for the account policy. 1234Valid values can be: "forever", "never", "off", or a number. 1235</para> 1236 1237</refsect2> 1238 1239<refsect2> 1240<title>SAM PROVISION</title> 1241 1242<para> 1243Only available if ldapsam:editposix is set and winbindd is running. 1244Properly populates the ldap tree with the basic accounts (Administrator) 1245and groups (Domain Users, Domain Admins, Domain Guests) on the ldap tree. 1246</para> 1247 1248</refsect2> 1249 1250<refsect2> 1251<title>IDMAP DUMP <local tdb file name></title> 1252 1253<para> 1254Dumps the mappings contained in the local tdb file specified. 1255This command is useful to dump only the mappings produced by the idmap_tdb backend. 1256</para> 1257 1258</refsect2> 1259 1260<refsect2> 1261<title>IDMAP RESTORE [input file]</title> 1262 1263<para> 1264Restore the mappings from the specified file or stdin. 1265</para> 1266 1267</refsect2> 1268 1269<refsect2> 1270<title>IDMAP SECRET <DOMAIN>|ALLOC <secret></title> 1271 1272<para> 1273Store a secret for the specified domain, used primarily for domains 1274that use idmap_ldap as a backend. In this case the secret is used 1275as the password for the user DN used to bind to the ldap server. 1276</para> 1277 1278</refsect2> 1279 1280<refsect2> 1281<title>USERSHARE</title> 1282 1283<para>Starting with version 3.0.23, a Samba server now supports the ability for 1284non-root users to add user defined shares to be exported using the "net usershare" 1285commands. 1286</para> 1287 1288<para> 1289To set this up, first set up your smb.conf by adding to the [global] section: 1290 1291usershare path = /usr/local/samba/lib/usershares 1292 1293Next create the directory /usr/local/samba/lib/usershares, change the owner to root and 1294set the group owner to the UNIX group who should have the ability to create usershares, 1295for example a group called "serverops". 1296 1297Set the permissions on /usr/local/samba/lib/usershares to 01770. 1298 1299(Owner and group all access, no access for others, plus the sticky bit, 1300which means that a file in that directory can be renamed or deleted only 1301by the owner of the file). 1302 1303Finally, tell smbd how many usershares you will allow by adding to the [global] 1304section of smb.conf a line such as : 1305 1306usershare max shares = 100. 1307 1308To allow 100 usershare definitions. Now, members of the UNIX group "serverops" 1309can create user defined shares on demand using the commands below. 1310</para> 1311 1312<para>The usershare commands are: 1313 1314<simplelist> 1315<member>net usershare add sharename path [comment [acl] [guest_ok=[y|n]]] - to add or change a user defined share.</member> 1316<member>net usershare delete sharename - to delete a user defined share.</member> 1317<member>net usershare info [-l|--long] [wildcard sharename] - to print info about a user defined share.</member> 1318<member>net usershare list [-l|--long] [wildcard sharename] - to list user defined shares.</member> 1319</simplelist> 1320 1321</para> 1322 1323<refsect3> 1324<title>USERSHARE ADD <replaceable>sharename</replaceable> <replaceable>path</replaceable> <replaceable>[comment]</replaceable> <replaceable>[acl]</replaceable> <replaceable>[guest_ok=[y|n]]</replaceable></title> 1325 1326<para> 1327Add or replace a new user defined share, with name "sharename". 1328</para> 1329 1330<para> 1331"path" specifies the absolute pathname on the system to be exported. 1332Restrictions may be put on this, see the global smb.conf parameters: 1333"usershare owner only", "usershare prefix allow list", and 1334"usershare prefix deny list". 1335</para> 1336 1337<para> 1338The optional "comment" parameter is the comment that will appear 1339on the share when browsed to by a client. 1340</para> 1341 1342<para>The optional "acl" field 1343specifies which users have read and write access to the entire share. 1344Note that guest connections are not allowed unless the smb.conf parameter 1345"usershare allow guests" has been set. The definition of a user 1346defined share acl is: "user:permission", where user is a valid 1347username on the system and permission can be "F", "R", or "D". 1348"F" stands for "full permissions", ie. read and write permissions. 1349"D" stands for "deny" for a user, ie. prevent this user from accessing 1350this share. 1351"R" stands for "read only", ie. only allow read access to this 1352share (no creation of new files or directories or writing to files). 1353</para> 1354 1355<para> 1356The default if no "acl" is given is "Everyone:R", which means any 1357authenticated user has read-only access. 1358</para> 1359 1360<para> 1361The optional "guest_ok" has the same effect as the parameter of the 1362same name in smb.conf, in that it allows guest access to this user 1363defined share. This parameter is only allowed if the global parameter 1364"usershare allow guests" has been set to true in the smb.conf. 1365</para> 1366 1367There is no separate command to modify an existing user defined share, 1368just use the "net usershare add [sharename]" command using the same 1369sharename as the one you wish to modify and specify the new options 1370you wish. The Samba smbd daemon notices user defined share modifications 1371at connect time so will see the change immediately, there is no need 1372to restart smbd on adding, deleting or changing a user defined share. 1373</refsect3> 1374 1375<refsect3> 1376<title>USERSHARE DELETE <replaceable>sharename</replaceable></title> 1377 1378<para> 1379Deletes the user defined share by name. The Samba smbd daemon 1380immediately notices this change, although it will not disconnect 1381any users currently connected to the deleted share. 1382</para> 1383 1384</refsect3> 1385 1386<refsect3> 1387<title>USERSHARE INFO <replaceable>[-l|--long]</replaceable> <replaceable>[wildcard sharename]</replaceable></title> 1388 1389<para> 1390Get info on user defined shares owned by the current user matching the given pattern, or all users. 1391</para> 1392 1393<para> 1394net usershare info on its own dumps out info on the user defined shares that were 1395created by the current user, or restricts them to share names that match the given 1396wildcard pattern ('*' matches one or more characters, '?' matches only one character). 1397If the '-l' or '--long' option is also given, it prints out info on user defined 1398shares created by other users. 1399</para> 1400 1401<para> 1402The information given about a share looks like: 1403 1404[foobar] 1405path=/home/jeremy 1406comment=testme 1407usershare_acl=Everyone:F 1408guest_ok=n 1409 1410And is a list of the current settings of the user defined share that can be 1411modified by the "net usershare add" command. 1412</para> 1413 1414</refsect3> 1415 1416<refsect3> 1417<title>USERSHARE LIST <replaceable>[-l|--long]</replaceable> <replaceable>wildcard sharename</replaceable></title> 1418 1419<para> 1420List all the user defined shares owned by the current user matching the given pattern, or all users. 1421</para> 1422 1423<para> 1424net usershare list on its own list out the names of the user defined shares that were 1425created by the current user, or restricts the list to share names that match the given 1426wildcard pattern ('*' matches one or more characters, '?' matches only one character). 1427If the '-l' or '--long' option is also given, it includes the names of user defined 1428shares created by other users. 1429</para> 1430 1431</refsect3> 1432 1433</refsect2> 1434 1435<refsect2> 1436<title>CONF</title> 1437 1438<para>Starting with version 3.2.0, a Samba server can be configured by data 1439stored in registry. This configuration data can be edited with the new "net 1440conf" commands. 1441</para> 1442 1443<para> 1444The deployment of this configuration data can be activated in two levels from the 1445<emphasis>smb.conf</emphasis> file: Share definitions from registry are 1446activated by setting <parameter>registry shares</parameter> to 1447<quote>yes</quote> in the [global] section and global configuration options are 1448activated by setting <smbconfoption name="include">registry</smbconfoption> in 1449the [global] section for a mixed configuration or by setting 1450<smbconfoption name="config backend">registry</smbconfoption> in the [global] 1451section for a registry-only configuration. 1452See the <citerefentry><refentrytitle>smb.conf</refentrytitle> 1453<manvolnum>5</manvolnum></citerefentry> manpage for details. 1454</para> 1455 1456<para>The conf commands are: 1457<simplelist> 1458<member>net conf list - Dump the complete configuration in smb.conf like 1459format.</member> 1460<member>net conf import - Import configuration from file in smb.conf 1461format.</member> 1462<member>net conf listshares - List the registry shares.</member> 1463<member>net conf drop - Delete the complete configuration from 1464registry.</member> 1465<member>net conf showshare - Show the definition of a registry share.</member> 1466<member>net conf addshare - Create a new registry share.</member> 1467<member>net conf delshare - Delete a registry share.</member> 1468<member>net conf setparm - Store a parameter.</member> 1469<member>net conf getparm - Retrieve the value of a parameter.</member> 1470<member>net conf delparm - Delete a parameter.</member> 1471<member>net conf getincludes - Show the includes of a share definition.</member> 1472<member>net conf setincludes - Set includes for a share.</member> 1473<member>net conf delincludes - Delete includes from a share definition.</member> 1474</simplelist> 1475</para> 1476 1477<refsect3> 1478<title>CONF LIST</title> 1479 1480<para> 1481Print the configuration data stored in the registry in a smb.conf-like format to 1482standard output. 1483</para> 1484</refsect3> 1485 1486<refsect3> 1487<title>CONF IMPORT <replaceable>[--test|-T]</replaceable> <replaceable>filename</replaceable> <replaceable>[section]</replaceable></title> 1488 1489<para> 1490This command imports configuration from a file in smb.conf format. 1491If a section encountered in the input file is present in registry, 1492its contents is replaced. Sections of registry configuration that have 1493no counterpart in the input file are not affected. If you want to delete these, 1494you will have to use the "net conf drop" or "net conf delshare" commands. 1495Optionally, a section may be specified to restrict the effect of the 1496import command to that specific section. A test mode is enabled by specifying 1497the parameter "-T" on the commandline. In test mode, no changes are made to the 1498registry, and the resulting configuration is printed to standard output instead. 1499</para> 1500</refsect3> 1501 1502<refsect3> 1503<title>CONF LISTSHARES</title> 1504 1505<para> 1506List the names of the shares defined in registry. 1507</para> 1508</refsect3> 1509 1510<refsect3> 1511<title>CONF DROP</title> 1512 1513<para> 1514Delete the complete configuration data from registry. 1515</para> 1516</refsect3> 1517 1518<refsect3> 1519<title>CONF SHOWSHARE <replaceable>sharename</replaceable></title> 1520 1521<para> 1522Show the definition of the share or section specified. It is valid to specify 1523"global" as sharename to retrieve the global configuration options from 1524registry. 1525</para> 1526</refsect3> 1527 1528<refsect3> 1529<title>CONF ADDSHARE <replaceable>sharename</replaceable> <replaceable>path</replaceable> [<replaceable>writeable={y|N}</replaceable> [<replaceable>guest_ok={y|N}</replaceable> [<replaceable>comment</replaceable>]]] </title> 1530 1531<para>Create a new share definition in registry. 1532The sharename and path have to be given. The share name may 1533<emphasis>not</emphasis> be "global". Optionally, values for the very 1534common options "writeable", "guest ok" and a "comment" may be specified. 1535The same result may be obtained by a sequence of "net conf setparm" 1536commands. 1537</para> 1538</refsect3> 1539 1540<refsect3> 1541<title>CONF DELSHARE <replaceable>sharename</replaceable></title> 1542 1543<para> 1544Delete a share definition from registry. 1545</para> 1546</refsect3> 1547 1548<refsect3> 1549<title>CONF SETPARM <replaceable>section</replaceable> <replaceable>parameter</replaceable> <replaceable>value</replaceable></title> 1550 1551<para> 1552Store a parameter in registry. The section may be global or a sharename. 1553The section is created if it does not exist yet. 1554</para> 1555</refsect3> 1556 1557<refsect3> 1558<title>CONF GETPARM <replaceable>section</replaceable> <replaceable>parameter</replaceable></title> 1559 1560<para> 1561Show a parameter stored in registry. 1562</para> 1563</refsect3> 1564 1565<refsect3> 1566<title>CONF DELPARM <replaceable>section</replaceable> <replaceable>parameter</replaceable></title> 1567 1568<para> 1569Delete a parameter stored in registry. 1570</para> 1571</refsect3> 1572 1573<refsect3> 1574<title>CONF GETINCLUDES <replaceable>section</replaceable></title> 1575 1576<para> 1577Get the list of includes for the provided section (global or share). 1578</para> 1579 1580<para> 1581Note that due to the nature of the registry database and the nature of include directives, 1582the includes need special treatment: Parameters are stored in registry by the parameter 1583name as valuename, so there is only ever one instance of a parameter per share. 1584Also, a specific order like in a text file is not guaranteed. For all real 1585parameters, this is perfectly ok, but the include directive is rather a meta 1586parameter, for which, in the smb.conf text file, the place where it is specified 1587between the other parameters is very important. This can not be achieved by the 1588simple registry smbconf data model, so there is one ordered list of includes 1589per share, and this list is evaluated after all the parameters of the share. 1590</para> 1591 1592<para> 1593Further note that currently, only files can be included from registry 1594configuration. In the future, there will be the ability to include configuration 1595data from other registry keys. 1596</para> 1597</refsect3> 1598 1599<refsect3> 1600<title>CONF SETINCLUDES <replaceable>section</replaceable> [<replaceable>filename</replaceable>]+</title> 1601 1602<para> 1603Set the list of includes for the provided section (global or share) to the given 1604list of one or more filenames. The filenames may contain the usual smb.conf 1605macros like %I. 1606</para> 1607</refsect3> 1608 1609<refsect3> 1610<title>CONF DELINCLUDES <replaceable>section</replaceable></title> 1611 1612<para> 1613Delete the list of includes from the provided section (global or share). 1614</para> 1615</refsect3> 1616 1617</refsect2> 1618 1619<refsect2> 1620<title>EVENTLOG</title> 1621 1622<para>Starting with version 3.4.0 net can read, dump, import and export native 1623win32 eventlog files (usually *.evt). evt files are used by the native Windows eventviewer tools. 1624</para> 1625 1626<para> 1627The import and export of evt files can only succeed when <parameter>eventlog list</parameter> is used in 1628<emphasis>smb.conf</emphasis> file. 1629See the <citerefentry><refentrytitle>smb.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manpage for details. 1630</para> 1631 1632<para>The eventlog commands are: 1633<simplelist> 1634<member>net eventlog dump - Dump a eventlog *.evt file on the screen.</member> 1635<member>net eventlog import - Import a eventlog *.evt into the samba internal 1636tdb based representation of eventlogs.</member> 1637<member>net eventlog export - Export the samba internal tdb based representation 1638of eventlogs into an eventlog *.evt file.</member> 1639</simplelist> 1640</para> 1641 1642<refsect3> 1643<title>EVENTLOG DUMP <replaceable>filename</replaceable></title> 1644 1645<para> 1646Prints a eventlog *.evt file to standard output. 1647</para> 1648</refsect3> 1649 1650<refsect3> 1651<title>EVENTLOG IMPORT <replaceable>filename</replaceable> <replaceable>eventlog</replaceable></title> 1652 1653<para> 1654Imports a eventlog *.evt file defined by <replaceable>filename</replaceable> into the 1655samba internal tdb representation of eventlog defined by <replaceable>eventlog</replaceable>. 1656<replaceable>eventlog</replaceable> needs to part of the <parameter>eventlog list</parameter> 1657defined in smb.conf. 1658See the <citerefentry><refentrytitle>smb.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manpage for details. 1659</para> 1660 1661</refsect3> 1662 1663<refsect3> 1664<title>EVENTLOG EXPORT <replaceable>filename</replaceable> <replaceable>eventlog</replaceable></title> 1665 1666<para> 1667Exports the samba internal tdb representation of eventlog defined by <replaceable>eventlog</replaceable> 1668to a eventlog *.evt file defined by <replaceable>filename</replaceable>. 1669<replaceable>eventlog</replaceable> needs to part of the <parameter>eventlog list</parameter> 1670defined in smb.conf. 1671See the <citerefentry><refentrytitle>smb.conf</refentrytitle> <manvolnum>5</manvolnum></citerefentry> manpage for details. 1672</para> 1673 1674</refsect3> 1675 1676</refsect2> 1677 1678<refsect2> 1679<title>DOM</title> 1680 1681<para>Starting with version 3.2.0 Samba has support for remote join and unjoin APIs, both client and server-side. Windows supports remote join capabilities since Windows 2000. 1682</para> 1683<para>In order for Samba to be joined or unjoined remotely an account must be used that is either member of the Domain Admins group, a member of the local Administrators group or a user that is granted the SeMachineAccountPrivilege privilege. 1684</para> 1685 1686<para>The client side support for remote join is implemented in the net dom commands which are: 1687<simplelist> 1688<member>net dom join - Join a remote computer into a domain.</member> 1689<member>net dom unjoin - Unjoin a remote computer from a domain.</member> 1690<member>net dom renamecomputer - Renames a remote computer joined to a domain.</member> 1691</simplelist> 1692</para> 1693 1694<refsect3> 1695<title>DOM JOIN <replaceable>domain=DOMAIN</replaceable> <replaceable>ou=OU</replaceable> <replaceable>account=ACCOUNT</replaceable> <replaceable>password=PASSWORD</replaceable> <replaceable>reboot</replaceable></title> 1696 1697<para> 1698Joins a computer into a domain. This command supports the following additional parameters: 1699</para> 1700 1701<itemizedlist> 1702 1703<listitem><para><replaceable>DOMAIN</replaceable> can be a NetBIOS domain name (also known as short domain name) or a DNS domain name for Active Directory Domains. As in Windows, it is also possible to control which Domain Controller to use. This can be achieved by appending the DC name using the \ separator character. Example: MYDOM\MYDC. The <replaceable>DOMAIN</replaceable> parameter cannot be NULL.</para></listitem> 1704 1705<listitem><para><replaceable>OU</replaceable> can be set to a RFC 1779 LDAP DN, like <emphasis>ou=mymachines,cn=Users,dc=example,dc=com</emphasis> in order to create the machine account in a non-default LDAP containter. This optional parameter is only supported when joining Active Directory Domains.</para></listitem> 1706 1707<listitem><para><replaceable>ACCOUNT</replaceable> defines a domain account that will be used to join the machine to the domain. This domain account needs to have sufficient privileges to join machines.</para></listitem> 1708 1709<listitem><para><replaceable>PASSWORD</replaceable> defines the password for the domain account defined with <replaceable>ACCOUNT</replaceable>.</para></listitem> 1710 1711<listitem><para><replaceable>REBOOT</replaceable> is an optional parameter that can be set to reboot the remote machine after successful join to the domain.</para></listitem> 1712 1713</itemizedlist> 1714 1715<para> 1716Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to join. These additional parameters include: -S computer and -U user. 1717</para> 1718<para> 1719 Example: 1720 net dom join -S xp -U XP\\administrator%secret domain=MYDOM account=MYDOM\\administrator password=topsecret reboot. 1721</para> 1722<para> 1723This example would connect to a computer named XP as the local administrator using password secret, and join the computer into a domain called MYDOM using the MYDOM domain administrator account and password topsecret. After successful join, the computer would reboot. 1724</para> 1725 1726</refsect3> 1727 1728<refsect3> 1729<title>DOM UNJOIN <replaceable>account=ACCOUNT</replaceable> <replaceable>password=PASSWORD</replaceable> <replaceable>reboot</replaceable></title> 1730 1731<para> 1732Unjoins a computer from a domain. This command supports the following additional parameters: 1733</para> 1734 1735<itemizedlist> 1736 1737<listitem><para><replaceable>ACCOUNT</replaceable> defines a domain account that will be used to unjoin the machine from the domain. This domain account needs to have sufficient privileges to unjoin machines.</para></listitem> 1738 1739<listitem><para><replaceable>PASSWORD</replaceable> defines the password for the domain account defined with <replaceable>ACCOUNT</replaceable>.</para></listitem> 1740 1741<listitem><para><replaceable>REBOOT</replaceable> is an optional parameter that can be set to reboot the remote machine after successful unjoin from the domain.</para></listitem> 1742 1743</itemizedlist> 1744 1745<para> 1746Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to unjoin. These additional parameters include: -S computer and -U user. 1747</para> 1748<para> 1749 Example: 1750 net dom unjoin -S xp -U XP\\administrator%secret account=MYDOM\\administrator password=topsecret reboot. 1751</para> 1752<para> 1753This example would connect to a computer named XP as the local administrator using password secret, and unjoin the computer from the domain using the MYDOM domain administrator account and password topsecret. After successful unjoin, the computer would reboot. 1754</para> 1755 1756</refsect3> 1757 1758<refsect3> 1759<title>DOM RENAMECOMPUTER <replaceable>newname=NEWNAME</replaceable> <replaceable>account=ACCOUNT</replaceable> <replaceable>password=PASSWORD</replaceable> <replaceable>reboot</replaceable></title> 1760 1761<para> 1762Renames a computer that is joined to a domain. This command supports the following additional parameters: 1763</para> 1764 1765<itemizedlist> 1766 1767<listitem><para><replaceable>NEWNAME</replaceable> defines the new name of the machine in the domain.</para></listitem> 1768 1769<listitem><para><replaceable>ACCOUNT</replaceable> defines a domain account that will be used to rename the machine in the domain. This domain account needs to have sufficient privileges to rename machines.</para></listitem> 1770 1771<listitem><para><replaceable>PASSWORD</replaceable> defines the password for the domain account defined with <replaceable>ACCOUNT</replaceable>.</para></listitem> 1772 1773<listitem><para><replaceable>REBOOT</replaceable> is an optional parameter that can be set to reboot the remote machine after successful rename in the domain.</para></listitem> 1774 1775</itemizedlist> 1776 1777<para> 1778Note that you also need to use standard net parameters to connect and authenticate to the remote machine that you want to rename in the domain. These additional parameters include: -S computer and -U user. 1779</para> 1780<para> 1781 Example: 1782 net dom renamecomputer -S xp -U XP\\administrator%secret newname=XPNEW account=MYDOM\\administrator password=topsecret reboot. 1783</para> 1784<para> 1785This example would connect to a computer named XP as the local administrator using password secret, and rename the joined computer to XPNEW using the MYDOM domain administrator account and password topsecret. After successful rename, the computer would reboot. 1786</para> 1787 1788</refsect3> 1789 1790</refsect2> 1791 1792<refsect2> 1793<title>G_LOCK</title> 1794 1795<para>Manage global locks.</para> 1796 1797<refsect3> 1798<title>G_LOCK DO <replaceable>lockname</replaceable> <replaceable>timeout</replaceable> <replaceable>command</replaceable></title> 1799 1800<para> 1801Execute a shell command under a global lock. This might be useful to define the 1802order in which several shell commands will be executed. The locking information 1803is stored in a file called <filename>g_lock.tdb</filename>. In setups with CTDB 1804running, the locking information will be available on all cluster nodes. 1805</para> 1806 1807<itemizedlist> 1808<listitem><para><replaceable>LOCKNAME</replaceable> defines the name of the global lock.</para></listitem> 1809<listitem><para><replaceable>TIMEOUT</replaceable> defines the timeout.</para></listitem> 1810<listitem><para><replaceable>COMMAND</replaceable> defines the shell command to execute.</para></listitem> 1811</itemizedlist> 1812</refsect3> 1813 1814<refsect3> 1815<title>G_LOCK LOCKS</title> 1816 1817<para> 1818Print a list of all currently existing locknames. 1819</para> 1820</refsect3> 1821 1822<refsect3> 1823<title>G_LOCK DUMP <replaceable>lockname</replaceable></title> 1824 1825<para> 1826Dump the locking table of a certain global lock. 1827</para> 1828</refsect3> 1829 1830</refsect2> 1831 1832<refsect2> 1833<title>HELP [COMMAND]</title> 1834 1835<para>Gives usage information for the specified command.</para> 1836 1837</refsect2> 1838 1839</refsect1> 1840 1841<refsect1> 1842 <title>VERSION</title> 1843 1844 <para>This man page is complete for version 3 of the Samba 1845 suite.</para> 1846</refsect1> 1847 1848<refsect1> 1849 <title>AUTHOR</title> 1850 1851 <para>The original Samba software and related utilities 1852 were created by Andrew Tridgell. Samba is now developed 1853 by the Samba Team as an Open Source project similar 1854 to the way the Linux kernel is developed.</para> 1855 1856 <para>The net manpage was written by Jelmer Vernooij.</para> 1857 1858</refsect1> 1859 1860</refentry> 1861