{"record":{"id":"c4f9a6d7768a8263","repo":"projectdiscovery/nuclei","slug":"samr-connect-w","errorCode":null,"errorMessage":"samr connect: %w","messagePattern":"samr connect: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/dcerpc/dcerpc.go","lineNumber":248,"sourceCode":"//\n// @example\n// ```javascript\n// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// const users = c.SamrEnumerateUsers();\n// for (const u of users) { log(u.Name + ' ' + u.RID); }\n// ```\nfunc (c *Client) SamrEnumerateUsers() ([]DomainUser, error) {\n\trpc, err := c.rpcOverNamedPipe(\"samr\", gpsamr.UUID, gpsamr.MajorVersion, gpsamr.MinorVersion)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer func() {\n\t\t_ = rpc.Transport.Close()\n\t}()\n\n\tsamr := gpsamr.NewSamrClient(rpc, rpc.GetSessionKey())\n\tif err := samr.Connect(); err != nil {\n\t\treturn nil, fmt.Errorf(\"samr connect: %w\", err)\n\t}\n\tif err := samr.OpenDomain(c.Domain); err != nil {\n\t\treturn nil, fmt.Errorf(\"samr open domain: %w\", err)\n\t}\n\tdefer samr.Close()\n\treturn samr.EnumerateDomainUsers()\n}\n\n// SamrAddComputer creates a new machine account using the supplied password.\n// Useful as the first step in many AD escalations (RBCD / shadow credentials).\n//\n// @example\n// ```javascript\n// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');\n// c.SamrAddComputer('NUCLEI$', 'C0mputerP@ss!');\n// ```\nfunc (c *Client) SamrAddComputer(name, password string) error {\n\tc.nj.Require(name != \"\", \"computer name cannot be empty\")","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/dcerpc/dcerpc.go#L230-L266","documentation":"In SamrEnumerateUsers, after the 'samr' pipe opened and bound, samr.Connect() — the SAMR Connect/Connect5 call that acquires a SAM handle — failed. Almost always an authorization failure: the account authenticates to SMB but is not permitted to open the SAM database remotely (null-session restrictions, SAM-RPC hardening, insufficient rights).","triggerScenarios":"SamrEnumerateUsers() with guest/null credentials, a non-domain account against a DC, or a DC configured with 'network restriction: remote SAM management' hardening; also a workgroup name in Domain while targeting a member host.","commonSituations":"Anonymous/guest enumeration attempts against hardened DCs; low-privilege domain users where admins enabled SAMR filtering; targeting a non-DC and expecting domain user listings.","solutions":["Use domain credentials with SAMR rights (any authenticated domain user by default, unless hardened).","Target a domain controller and set the constructor's Domain to its AD domain.","If remote-SAM hardening blocks you, try LsaLookupSids()/EnumSessions() or credentials with admin rights.","Confirm SMB authentication itself works to rule out a credential typo surfacing earlier as a different error."],"exampleFix":"// before\nconst c = new dcerpc.Client('dc01', 'ACME', 'guest', '');\nc.SamrEnumerateUsers(); // samr connect: ACCESS_DENIED\n\n// after\nconst c = new dcerpc.Client('dc01', 'ACME', 'svc-scan', 'S3cure!pass'); // authenticated domain user\nc.SamrEnumerateUsers();","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const users = c.SamrEnumerateUsers();\n} catch (e) {\n  const msg = String(e);\n  if (msg.includes('samr connect')) {\n    // SAM handle refused: credentials lack SAMR rights or hardening blocks\n    log('SAMR connect denied: ' + msg);\n  } else throw e;\n}","preventionTips":["Never rely on anonymous/guest sessions for SAMR enumeration against modern DCs.","Provision a dedicated low-priv domain account for enumeration and verify SAMR access once.","Detect hardening in a first pass and mark the technique unavailable for that host."],"tags":["samr","dcerpc","active-directory","authorization","windows"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}