On 2019-05-29 03:16, Maayan Apelboim wrote:
> On Tuesday, May 28, 2019 6:15 PM, Brian Inglis wrote:
>> On 2019-05-28 02:36, Maayan Apelboim wrote:
>>> Brian Inglis wrote:
>>>> Systems may have tens to hundreds of local user accounts, and domains
>>>> may have hundreds to hundreds of thousands of user accounts.
>>>> The system probably caches only active users, and getent enumerates
>>>> those if no /etc/passwd file exists, as it was designed to enumerate
>>>> only a few entries from local files.
>>>> As it is, getent will not even enumerate hosts from the local hosts
>>>> files or resolver.
>>>> It appears that mkpasswd enumerates all local and system accounts in
>>>> the Security Accounts Manager file at $SYSTEMROOT/System32/config/SAM
>>>> loaded into /proc/registry/HKEY_LOCAL_MACHINE/SAM/, so it probably
>>>> does the same for domain accounts from Active Directory Domain Service.
>>>
>>> Ok, I understand why it won't display all users, but even when I query
>>> for this specific user that exists in the domain - it returns nothing.
>>> It only works when I have /etc/passwd file in place (generated by
>>> mkpasswd -d), but I was told in a previous thread that I should not
>>> use mkpasswd -d anymore, and use getent instead.
>>> Is there something I need to do with getent to get access for all my
>>> domain users?
>>> Should I keep my previous passwd file generated by mkpasswd -d?
>>
>> Does "getent passwd" display any active domain+accounts on your system?
>> If someone is logged on to that system from a domain+account?
>>
>> Check your domain membership:
>>
>> $ echo $USERDOMAIN $USERDOMAIN_ROAMINGPROFILE
>>
>> and any other DOMAIN environment variables you have, and explicitly specify a
>> known account in that domain before the userid using a plus sign "+"
>> separator:>
>> $ getent passwd domain+account
>>
>> similar to Trusted Installer:
>>
>> $ getent passwd nt\ service+trustedinstaller
>> NT SERVICE+TrustedInstaller:*:328384:328384:U-NT
>> SERVICE\TrustedInstaller,S-1-5-80-...:/:/sbin/nologin
>>
>> If the account doesn't display, check you are using the correct domain
>> membership using AD DS tools or e.g a PowerShell script.
>
> Yes, my active domain user is displayed.
> The user I'm searching for is also displayed after a few teaks / restarts.
> Couldn't replicate a stable workaround that always works for me - best
> solution I found was create passwd with mkpasswd -d and then move the file
> (was also not very stable, the user was found, then it wasn't and I needed to
> run it again, for now it works).
>
> I'm looking for something that will force getent to query my DC, or maybe
> delete its cache.
> Any idea?
>From what I've seen, only accounts of active processes seem to be retrieved by
getent, as least under Windows 10: please post the output from your system of
the commands:
$ uname -srvmo
CYGWIN_NT-10.0 3.0.7(0.338/5/3) 2019-04-30 18:08 x86_64 Cygwin
$ cmd /c ver
Microsoft Windows [Version 10.0.17763.503]
You could try running getent from strace and save the output from both a
successful and a failed run e.g. run:
$ strace -o getent.strace getent passwd domain+account
then rename getent.strace to getent.good|bad.strace depending on the outcome;
also run cygcheck -hrsv > cygcheck.out; and attach all three files as text
attachments to a post here so that, when they are available, someone with
relevant Cygwin and Windows background can take a look at them.
--
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada
This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
