projectdiscovery/nuclei · error

samr open domain: %w

Error message

samr open domain: %w

What it means

samr.OpenDomain(c.Domain) failed inside SamrEnumerateUsers: the domain passed to the Client constructor could not be opened on the target — STATUS_NO_SUCH_DOMAIN for a name the host does not know, or ACCESS_DENIED when the caller may connect but not open that domain. The string must match a domain the target recognizes (typically the flat NetBIOS label of its AD domain).

Source

Thrown at pkg/js/libs/dcerpc/dcerpc.go:251

// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// const users = c.SamrEnumerateUsers();
// for (const u of users) { log(u.Name + ' ' + u.RID); }
// ```
func (c *Client) SamrEnumerateUsers() ([]DomainUser, error) {
	rpc, err := c.rpcOverNamedPipe("samr", gpsamr.UUID, gpsamr.MajorVersion, gpsamr.MinorVersion)
	if err != nil {
		return nil, err
	}
	defer func() {
		_ = rpc.Transport.Close()
	}()

	samr := gpsamr.NewSamrClient(rpc, rpc.GetSessionKey())
	if err := samr.Connect(); err != nil {
		return nil, fmt.Errorf("samr connect: %w", err)
	}
	if err := samr.OpenDomain(c.Domain); err != nil {
		return nil, fmt.Errorf("samr open domain: %w", err)
	}
	defer samr.Close()
	return samr.EnumerateDomainUsers()
}

// SamrAddComputer creates a new machine account using the supplied password.
// Useful as the first step in many AD escalations (RBCD / shadow credentials).
//
// @example
// ```javascript
// const c = new dcerpc.Client('dc01', 'acme.local', 'admin', 'P@ss');
// c.SamrAddComputer('NUCLEI$', 'C0mputerP@ss!');
// ```
func (c *Client) SamrAddComputer(name, password string) error {
	c.nj.Require(name != "", "computer name cannot be empty")
	c.nj.Require(password != "", "computer password cannot be empty")
	rpc, err := c.rpcOverNamedPipe("samr", gpsamr.UUID, gpsamr.MajorVersion, gpsamr.MinorVersion)
	if err != nil {

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Set the constructor's domain argument to the flat NetBIOS domain label (e.g. 'ACME').
2. Verify the name independently (EnumSessions, LSA queries, or nltest /dsgetdc from a domain-joined box).
3. Run the enumeration against a domain controller of that domain.
4. Double-check credentials — bind succeeded, so focus on the domain string.

Example fix

// before
const c = new dcerpc.Client('dc01', 'acme.local', 'user', 'pass');
c.SamrEnumerateUsers(); // samr open domain: NO_SUCH_DOMAIN

// after
const c = new dcerpc.Client('dc01', 'ACME', 'user', 'pass'); // flat NetBIOS domain name
c.SamrEnumerateUsers();

// before constructing the client
function validDomain(d) {
  return typeof d === 'string' && /^[A-Za-z0-9._-]{1,15}$/.test(d) && !d.includes(' ');
}
if (!validDomain(domain)) {
  throw new Error('domain must be a short non-empty label, got: ' + JSON.stringify(domain));
}

try {
  const users = c.SamrEnumerateUsers();
} catch (e) {
  const msg = String(e);
  if (msg.includes('samr open domain')) {
    // domain string not recognized by the target: try the flat NetBIOS label
    log('domain rejected: ' + msg);
  } else throw e;
}

When it happens

Trigger: SamrEnumerateUsers() with Domain set to '' or a wrong value ('acme.local' where the flat name is 'ACME', a typo, another forest's suffix), or pointing the client at a member server while naming a domain it cannot resolve.

Common situations: Passing the FQDN where SAMR expects the NetBIOS name; unjoined/workgroup targets; cross-forest domain names without a trust relationship.

Related errors

• samr connect: %w
• domain controller denied by network policy
• smb connect: %w
• open pipe %q: %w
• dcerpc bind: %w

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/6bb8f863b29d5dac. Report an issue: GitHub.