{"record":{"id":"6bb8f863b29d5dac","repo":"projectdiscovery/nuclei","slug":"samr-open-domain-w","errorCode":null,"errorMessage":"samr open domain: %w","messagePattern":"samr open domain: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":251,"sourceCode":"// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// const users = c.SamrEnumerateUsers();\n// for (const u of users) { log(u.Name + ' ' + u.RID); }\n// ```\nfunc (c *Client) SamrEnumerateUsers() ([]DomainUser, error) {\n\trpc, err := c.rpcOverNamedPipe(\"samr\", gpsamr.UUID, gpsamr.MajorVersion, gpsamr.MinorVersion)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tsamr := gpsamr.NewSamrClient(rpc, rpc.GetSessionKey())\n\tif err := samr.Connect(); err != nil {\n\t\treturn nil, fmt.Errorf(\"samr connect: %w\", err)\n\t}\n\tif err := samr.OpenDomain(c.Domain); err != nil {\n\t\treturn nil, fmt.Errorf(\"samr open domain: %w\", err)\n\t}\n\tdefer samr.Close()\n\treturn samr.EnumerateDomainUsers()\n}\n\n// SamrAddComputer creates a new machine account using the supplied password.\n// Useful as the first step in many AD escalations (RBCD / shadow credentials).\n//\n// @example\n// ```javascript\n// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// c.SamrAddComputer('NUCLEI$', 'C0mputerP@ss!');\n// ```\nfunc (c *Client) SamrAddComputer(name, password string) error {\n\tc.nj.Require(name != \"\", \"computer name cannot be empty\")\n\tc.nj.Require(password != \"\", \"computer password cannot be empty\")\n\trpc, err := c.rpcOverNamedPipe(\"samr\", gpsamr.UUID, gpsamr.MajorVersion, gpsamr.MinorVersion)\n\tif err != nil {","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L233-L269","documentation":"samr.OpenDomain(c.Domain) failed inside SamrEnumerateUsers: the domain passed to the Client constructor could not be opened on the target — STATUS_NO_SUCH_DOMAIN for a name the host does not know, or ACCESS_DENIED when the caller may connect but not open that domain. The string must match a domain the target recognizes (typically the flat NetBIOS label of its AD domain).","triggerScenarios":"SamrEnumerateUsers() with Domain set to '' or a wrong value ('acme.local' where the flat name is 'ACME', a typo, another forest's suffix), or pointing the client at a member server while naming a domain it cannot resolve.","commonSituations":"Passing the FQDN where SAMR expects the NetBIOS name; unjoined/workgroup targets; cross-forest domain names without a trust relationship.","solutions":["Set the constructor's domain argument to the flat NetBIOS domain label (e.g. 'ACME').","Verify the name independently (EnumSessions, LSA queries, or nltest /dsgetdc from a domain-joined box).","Run the enumeration against a domain controller of that domain.","Double-check credentials — bind succeeded, so focus on the domain string."],"exampleFix":"// before\nconst c = new dcerpc.Client('dc01', 'acme.local', 'user', 'pass');\nc.SamrEnumerateUsers(); // samr open domain: NO_SUCH_DOMAIN\n\n// after\nconst c = new dcerpc.Client('dc01', 'ACME', 'user', 'pass'); // flat NetBIOS domain name\nc.SamrEnumerateUsers();","handlingStrategy":"validation","validationCode":"// before constructing the client\nfunction validDomain(d) {\n  return typeof d === 'string' && /^[A-Za-z0-9._-]{1,15}$/.test(d) && !d.includes(' ');\n}\nif (!validDomain(domain)) {\n  throw new Error('domain must be a short non-empty label, got: ' + JSON.stringify(domain));\n}","typeGuard":null,"tryCatchPattern":"try {\n  const users = c.SamrEnumerateUsers();\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('samr open domain')) {\n    // domain string not recognized by the target: try the flat NetBIOS label\n    log('domain rejected: ' + msg);\n  } else throw e;\n}","preventionTips":["Standardize on the flat NetBIOS domain label in scan configuration.","Resolve and cache domain names via LSA/nltest before mass-enumeration runs.","Reject empty domain strings early in template code."],"tags":["samr","active-directory","domain","dcerpc"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}