projectdiscovery/nuclei · error

samr connect: %w

Error message

samr connect: %w

What it means

In SamrEnumerateUsers, after the 'samr' pipe opened and bound, samr.Connect() — the SAMR Connect/Connect5 call that acquires a SAM handle — failed. Almost always an authorization failure: the account authenticates to SMB but is not permitted to open the SAM database remotely (null-session restrictions, SAM-RPC hardening, insufficient rights).

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:248

//
// @example
// ```javascript
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// const users = c.SamrEnumerateUsers();
// for (const u of users) { log(u.Name + ' ' + u.RID); }
// ```
func (c *Client) SamrEnumerateUsers() ([]DomainUser, error) {
	rpc, err := c.rpcOverNamedPipe("samr", gpsamr.UUID, gpsamr.MajorVersion, gpsamr.MinorVersion)
	if err != nil {
		return nil, err
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	samr := gpsamr.NewSamrClient(rpc, rpc.GetSessionKey())
	if err := samr.Connect(); err != nil {
		return nil, fmt.Errorf("samr connect: %w", err)
	}
	if err := samr.OpenDomain(c.Domain); err != nil {
		return nil, fmt.Errorf("samr open domain: %w", err)
	}
	defer samr.Close()
	return samr.EnumerateDomainUsers()
}

// SamrAddComputer creates a new machine account using the supplied password.
// Useful as the first step in many AD escalations (RBCD / shadow credentials).
//
// @example
// ```javascript
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// c.SamrAddComputer('NUCLEI$', 'C0mputerP@ss!');
// ```
func (c *Client) SamrAddComputer(name, password string) error {
	c.nj.Require(name != "", "computer name cannot be empty")

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Use domain credentials with SAMR rights (any authenticated domain user by default, unless hardened).
2. Target a domain controller and set the constructor's Domain to its AD domain.
3. If remote-SAM hardening blocks you, try LsaLookupSids()/EnumSessions() or credentials with admin rights.
4. Confirm SMB authentication itself works to rule out a credential typo surfacing earlier as a different error.

Example fix

// before
const c = new dcerpc.Client('dc01', 'ACME', 'guest', '');
c.SamrEnumerateUsers(); // samr connect: ACCESS_DENIED

// after
const c = new dcerpc.Client('dc01', 'ACME', 'svc-scan', 'S3cure!pass'); // authenticated domain user
c.SamrEnumerateUsers();

try {
  const users = c.SamrEnumerateUsers();
} catch (e) {
  const msg = String(e);
  if (msg.includes('samr connect')) {
    // SAM handle refused: credentials lack SAMR rights or hardening blocks
    log('SAMR connect denied: ' + msg);
  } else throw e;
}

When it happens

Trigger: SamrEnumerateUsers() with guest/null credentials, a non-domain account against a DC, or a DC configured with 'network restriction: remote SAM management' hardening; also a workgroup name in Domain while targeting a member host.

Common situations: Anonymous/guest enumeration attempts against hardened DCs; low-privilege domain users where admins enabled SAMR filtering; targeting a non-DC and expecting domain user listings.

Related errors

• samr open domain: %w
• open pipe %q: %w
• lsa init: %w
• lsa OpenPolicy2: %w
• winstation OpenServer: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/c4f9a6d7768a8263. Report an issue: GitHub.