Re: getent doesn't show all domain users

[Brian Inglis <Brian.Inglis@SystematicSw.ab.ca>]

On 2019-05-29 03:16, Maayan Apelboim wrote:
> On Tuesday, May 28, 2019 6:15 PM, Brian Inglis wrote:
>> On 2019-05-28 02:36, Maayan Apelboim wrote:
>>> Brian Inglis wrote:
>>>> Systems may have tens to hundreds of local user accounts, and domains 
>>>> may have hundreds to hundreds of thousands of user accounts.
>>>> The system probably caches only active users, and getent enumerates 
>>>> those if no /etc/passwd file exists, as it was designed to enumerate 
>>>> only a few entries from local files.
>>>> As it is, getent will not even enumerate hosts from the local hosts 
>>>> files or resolver.
>>>> It appears that mkpasswd enumerates all local and system accounts in 
>>>> the Security Accounts Manager file at $SYSTEMROOT/System32/config/SAM 
>>>> loaded into /proc/registry/HKEY_LOCAL_MACHINE/SAM/, so it probably 
>>>> does the same for domain accounts from Active Directory Domain Service.
>>> 
>>> Ok, I understand why it won't display all users, but even when I query 
>>> for this specific user that exists in the domain - it returns nothing.
>>> It only works when I have /etc/passwd file in place (generated by 
>>> mkpasswd -d), but I was told in a previous thread that I should not 
>>> use mkpasswd -d anymore, and use getent instead.
>>> Is there something I need to do with getent to get access for all my 
>>> domain users?
>>> Should I keep my previous passwd file generated by mkpasswd -d?
>> 
>> Does "getent passwd" display any active domain+accounts on your system?
>> If someone is logged on to that system from a domain+account?
>> 
>> Check your domain membership:
>> 
>> 	$ echo $USERDOMAIN $USERDOMAIN_ROAMINGPROFILE
>> 
>> and any other DOMAIN environment variables you have, and explicitly specify a
>> known account in that domain before the userid using a plus sign "+"
>> separator:> 
>> 	$ getent passwd domain+account
>> 
>> similar to Trusted Installer:
>> 
>> 	$ getent passwd nt\ service+trustedinstaller
>> 	NT SERVICE+TrustedInstaller:*:328384:328384:U-NT
>>  	SERVICE\TrustedInstaller,S-1-5-80-...:/:/sbin/nologin
>> 
>> If the account doesn't display, check you are using the correct domain 
>> membership using AD DS tools or e.g a PowerShell script.
> 
> Yes, my active domain user is displayed.
> The user I'm searching for is also displayed after a few teaks / restarts.
> Couldn't replicate a stable workaround that always works for me - best 
> solution I found was create passwd with mkpasswd -d and then move the file 
> (was also not very stable, the user was found, then it wasn't and I needed to
> run it again, for now it works).
>
> I'm looking for something that will force getent to query my DC, or maybe 
> delete its cache.
> Any idea?

From what I've seen, only accounts of active processes seem to be retrieved by
getent, as least under Windows 10: please post the output from your system of
the commands:

	$ uname -srvmo
	CYGWIN_NT-10.0 3.0.7(0.338/5/3) 2019-04-30 18:08 x86_64 Cygwin
	$ cmd /c ver

	Microsoft Windows [Version 10.0.17763.503]

You could try running getent from strace and save the output from both a
successful and a failed run e.g. run:

	$ strace -o getent.strace getent passwd domain+account

then rename getent.strace to getent.good|bad.strace depending on the outcome;
also run cygcheck -hrsv > cygcheck.out; and attach all three files as text
attachments to a post here so that, when they are available, someone with
relevant Cygwin and Windows background can take a look at them.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple