X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:subject:to:references:from:message-id
	:date:mime-version:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=ovxsJDTdAb5SiBd6
	o2DGwR+SbwE/l+BqU59cK8HUxOW5h7+2B1tehvBmixKppd+I8SzHwUqeg63OWmrN
	E4OUy732BagBa/JDZUbQoB2oIchPqR0RjxiZHA27G2uvaInukC9d+uXdHiga0G2h
	u8aQgAM9WbkX2MBJ3oOspXSjW1I=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:subject:to:references:from:message-id
	:date:mime-version:in-reply-to:content-type
	:content-transfer-encoding; s=default; bh=4Y+0wpepBOjetl13AZkkbW
	jDxOU=; b=p8qBwvTFfveRrEZbBpwYnm1ZdYODlwuVTHUqxP05wQfqJatg7B7tEZ
	Xmz+EgPWmCL9CdjEJClA6gstpgfSSQmTI2lIrkA0ReNrN8mSc19to6n3mM8X+CGN
	yA+hjeWN47c0wKJ1aOCGL7NvCZZ9tPA85M4mAix2rb1+k921qOO94=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-3.1 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 spammy=Cygwin, processes, Manager
X-HELO: smtp-out-no.shaw.ca
Reply-To: Brian DOT Inglis AT SystematicSw DOT ab DOT ca
Subject: Re: getent doesn't show all domain users
To: cygwin AT cygwin DOT com
References: <7e76691f-5184-fbc6-e6ff-90f5d69b83c2 AT SystematicSw DOT ab DOT ca> <AM6PR07MB5334E3CFB13C52429A865591951F0 AT AM6PR07MB5334 DOT eurprd07 DOT prod DOT outlook DOT com>
From: Brian Inglis <Brian DOT Inglis AT SystematicSw DOT ab DOT ca>
Openpgp: preference=signencrypt
Message-ID: <9f4cef60-5803-5872-91e3-285848244145@SystematicSw.ab.ca>
Date: Wed, 29 May 2019 07:25:24 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0
MIME-Version: 1.0
In-Reply-To: <AM6PR07MB5334E3CFB13C52429A865591951F0@AM6PR07MB5334.eurprd07.prod.outlook.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes

On 2019-05-29 03:16, Maayan Apelboim wrote:
> On Tuesday, May 28, 2019 6:15 PM, Brian Inglis wrote:
>> On 2019-05-28 02:36, Maayan Apelboim wrote:
>>> Brian Inglis wrote:
>>>> Systems may have tens to hundreds of local user accounts, and domains 
>>>> may have hundreds to hundreds of thousands of user accounts.
>>>> The system probably caches only active users, and getent enumerates 
>>>> those if no /etc/passwd file exists, as it was designed to enumerate 
>>>> only a few entries from local files.
>>>> As it is, getent will not even enumerate hosts from the local hosts 
>>>> files or resolver.
>>>> It appears that mkpasswd enumerates all local and system accounts in 
>>>> the Security Accounts Manager file at $SYSTEMROOT/System32/config/SAM 
>>>> loaded into /proc/registry/HKEY_LOCAL_MACHINE/SAM/, so it probably 
>>>> does the same for domain accounts from Active Directory Domain Service.
>>> 
>>> Ok, I understand why it won't display all users, but even when I query 
>>> for this specific user that exists in the domain - it returns nothing.
>>> It only works when I have /etc/passwd file in place (generated by 
>>> mkpasswd -d), but I was told in a previous thread that I should not 
>>> use mkpasswd -d anymore, and use getent instead.
>>> Is there something I need to do with getent to get access for all my 
>>> domain users?
>>> Should I keep my previous passwd file generated by mkpasswd -d?
>> 
>> Does "getent passwd" display any active domain+accounts on your system?
>> If someone is logged on to that system from a domain+account?
>> 
>> Check your domain membership:
>> 
>> 	$ echo $USERDOMAIN $USERDOMAIN_ROAMINGPROFILE
>> 
>> and any other DOMAIN environment variables you have, and explicitly specify a
>> known account in that domain before the userid using a plus sign "+"
>> separator:> 
>> 	$ getent passwd domain+account
>> 
>> similar to Trusted Installer:
>> 
>> 	$ getent passwd nt\ service+trustedinstaller
>> 	NT SERVICE+TrustedInstaller:*:328384:328384:U-NT
>>  	SERVICE\TrustedInstaller,S-1-5-80-...:/:/sbin/nologin
>> 
>> If the account doesn't display, check you are using the correct domain 
>> membership using AD DS tools or e.g a PowerShell script.
> 
> Yes, my active domain user is displayed.
> The user I'm searching for is also displayed after a few teaks / restarts.
> Couldn't replicate a stable workaround that always works for me - best 
> solution I found was create passwd with mkpasswd -d and then move the file 
> (was also not very stable, the user was found, then it wasn't and I needed to
> run it again, for now it works).
>
> I'm looking for something that will force getent to query my DC, or maybe 
> delete its cache.
> Any idea?

From what I've seen, only accounts of active processes seem to be retrieved by
getent, as least under Windows 10: please post the output from your system of
the commands:

	$ uname -srvmo
	CYGWIN_NT-10.0 3.0.7(0.338/5/3) 2019-04-30 18:08 x86_64 Cygwin
	$ cmd /c ver

	Microsoft Windows [Version 10.0.17763.503]

You could try running getent from strace and save the output from both a
successful and a failed run e.g. run:

	$ strace -o getent.strace getent passwd domain+account

then rename getent.strace to getent.good|bad.strace depending on the outcome;
also run cygcheck -hrsv > cygcheck.out; and attach all three files as text
attachments to a post here so that, when they are available, someone with
relevant Cygwin and Windows background can take a look at them.

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple