You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
NetpManageMachineAccountWithSid: status of NetUserSetInfo on '\\ADATUMDC01' for 'TESTNAME97$': 0x5 Access Denied
26
26
```
27
27
28
-
`NetUserSetInfo` targets the domain controller (DC) Security Accounts Manager Server (SAM) server component, which uses the SAM Remote Procedure Call (RPC) function on Server Message Block (SMB) Named Pipes. Here is the complete TCP connection network traffic during the NetSetup failure event, which indicates the failure at a SAM connection:
28
+
`NetUserSetInfo` targets the domain controller (DC) Security Accounts Manager Server (SAM) server component, which uses the SAM Remote Procedure Call (RPC) function on Server Message Block (SMB) Named Pipes. Here's the complete TCP connection network traffic during the NetSetup failure event, which indicates the failure at a SAM connection:
Only security groups allowed to read for the Remote SAM Remote Procedure Call (RPC) access defined in the policy setting, can set up a SAM connection with the target machine.
53
+
Only security groups allowed to read the Remote SAM Remote Procedure Call (RPC) access defined in the policy setting can set up a SAM connection with the target machine.
54
54
55
-
This policy setting isn't useful on DCs, because Active Directory objects have their own access control settings, which isn't available for domain members or stand-alone machines with the SAM database.
55
+
This policy setting isn't useful on DCs because Active Directory objects have their own access control settings, which aren't available for domain members or stand-alone machines with the SAM database.
56
56
57
57
DCs might have the setting as it stays configured when you promote a member server with this setting to be a DC.
58
58
@@ -62,7 +62,7 @@ To resolve this issue, you can use one of the following methods:
62
62
63
63
Set the **Network access: Restrict clients allowed to make remote calls to SAM** policy to allow **Everyone** or **Authenticated Users** and apply it to all DCs.
64
64
65
-
This will resolve the problem for all DCs, and ensure they all use the same setting.
65
+
This resolves the problem for all DCs, and ensures they all use the same setting.
66
66
67
67
## Method 2: Delete the registry value RestrictRemoteSam
A customized SDDL for the policy might result in unexpected failures. Here are some scenarios to be aware of:
78
+
A customized SDDL for the policy might result in unexpected failures. Here're some scenarios to be aware of:
79
79
80
80
- Admin tools, scripts, and software that previously enumerated users, groups, and group memberships might fail.
81
81
- Remote Desktop Protocol (RDP) connections to Remote Desktop Services (RDS) Servers fail when the RDS tries to retrieve user details using remote SAM RPC calls.
0 commit comments