create domain group command (creategroup) added to rpcclient.

renamed do_samr_xxxx to samr_xxxx.
(This used to be commit 1e5d81c154740349a2cda4c1892b33a21c0683a8)

7 files changed, 427 insertions, 118 deletions

diff --git a/source3/include/proto.h b/source3/include/proto.h
index fb4a9b75ea..41b25a2c73 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -1580,6 +1580,10 @@ BOOL do_reg_close(struct cli_state *cli, POLICY_HND *hnd);
 
 /*The following definitions come from  rpc_client/cli_samr.c  */
 
+BOOL create_samr_domain_group(struct cli_state *cli, 
+				POLICY_HND *pol_open_domain,
+				const char *acct_name, const char *acct_desc,
+				uint32 *rid);
 BOOL get_samr_query_usergroups(struct cli_state *cli, 
 				POLICY_HND *pol_open_domain, uint32 user_rid,
 				uint32 *num_groups, DOM_GID *gid);
@@ -1587,40 +1591,48 @@ BOOL get_samr_query_userinfo(struct cli_state *cli,
 				POLICY_HND *pol_open_domain,
 				uint32 info_level,
 				uint32 user_rid, SAM_USER_INFO_21 *usr);
-BOOL do_samr_chgpasswd_user(struct cli_state *cli,
+BOOL samr_chgpasswd_user(struct cli_state *cli,
 		char *srv_name, char *user_name,
 		char nt_newpass[516], uchar nt_oldhash[16],
 		char lm_newpass[516], uchar lm_oldhash[16]);
-BOOL do_samr_unknown_38(struct cli_state *cli, char *srv_name);
-BOOL do_samr_query_dom_info(struct cli_state *cli, 
+BOOL samr_unknown_38(struct cli_state *cli, char *srv_name);
+BOOL samr_query_dom_info(struct cli_state *cli, 
 				POLICY_HND *domain_pol, uint16 switch_value);
-BOOL do_samr_enum_dom_users(struct cli_state *cli, 
+BOOL samr_enum_dom_users(struct cli_state *cli, 
 				POLICY_HND *pol, uint16 num_entries, uint16 unk_0,
 				uint16 acb_mask, uint16 unk_1, uint32 size,
 				struct acct_info **sam,
 				int *num_sam_users);
-BOOL do_samr_connect(struct cli_state *cli, 
+BOOL samr_connect(struct cli_state *cli, 
 				char *srv_name, uint32 unknown_0,
 				POLICY_HND *connect_pol);
-BOOL do_samr_open_user(struct cli_state *cli, 
+BOOL samr_open_user(struct cli_state *cli, 
 				POLICY_HND *pol, uint32 unk_0, uint32 rid, 
 				POLICY_HND *user_pol);
-BOOL do_samr_open_domain(struct cli_state *cli, 
+BOOL samr_open_group(struct cli_state *cli, 
+				POLICY_HND *domain_pol, uint32 rid,
+				POLICY_HND *group_pol);
+BOOL samr_create_dom_group(struct cli_state *cli, 
+				POLICY_HND *domain_pol, const char *acct_name,
+				POLICY_HND *group_pol, uint32 *rid);
+BOOL samr_set_groupinfo(struct cli_state *cli, 
+				POLICY_HND *group_pol, GROUP_INFO_CTR *ctr);
+BOOL samr_open_domain(struct cli_state *cli, 
 				POLICY_HND *connect_pol, uint32 rid, DOM_SID *sid,
 				POLICY_HND *domain_pol);
-BOOL do_samr_query_unknown_12(struct cli_state *cli, 
+BOOL samr_query_unknown_12(struct cli_state *cli, 
 				POLICY_HND *pol, uint32 rid, uint32 num_gids, uint32 *gids,
 				uint32 *num_names,
 				fstring names[MAX_LOOKUP_SIDS],
 				uint32  type [MAX_LOOKUP_SIDS]);
-BOOL do_samr_query_useraliases(struct cli_state *cli, 
+BOOL samr_query_useraliases(struct cli_state *cli, 
 				POLICY_HND *pol, DOM_SID *sid,
 				uint32 *num_aliases, uint32 *rid);
-BOOL do_samr_query_usergroups(struct cli_state *cli, 
+BOOL samr_query_usergroups(struct cli_state *cli, 
 				POLICY_HND *pol, uint32 *num_groups, DOM_GID *gid);
-BOOL do_samr_query_userinfo(struct cli_state *cli, 
+BOOL samr_query_userinfo(struct cli_state *cli, 
 				POLICY_HND *pol, uint16 switch_value, void* usr);
-BOOL do_samr_close(struct cli_state *cli, POLICY_HND *hnd);
+BOOL samr_close(struct cli_state *cli, POLICY_HND *hnd);
 
 /*The following definitions come from  rpc_client/cli_srvsvc.c  */
 
@@ -2051,12 +2063,12 @@ void samr_io_r_open_group(char *desc,  SAMR_R_OPEN_GROUP *r_u, prs_struct *ps, i
 void make_samr_group_info1(GROUP_INFO1 *gr1,
 				char *acct_name, char *acct_desc);
 void samr_io_group_info1(char *desc,  GROUP_INFO1 *gr1, prs_struct *ps, int depth);
-void make_samr_group_info4(GROUP_INFO4 *gr4, char *acct_desc);
+void make_samr_group_info4(GROUP_INFO4 *gr4, const char *acct_desc);
 void samr_io_group_info4(char *desc,  GROUP_INFO4 *gr4, prs_struct *ps, int depth);
 void samr_group_info_ctr(char *desc,  GROUP_INFO_CTR *ctr, prs_struct *ps, int depth);
 void make_samr_q_create_dom_group(SAMR_Q_CREATE_DOM_GROUP *q_e,
 				POLICY_HND *pol,
-				char *acct_desc);
+				const char *acct_desc);
 void samr_io_q_create_dom_group(char *desc,  SAMR_Q_CREATE_DOM_GROUP *q_e, prs_struct *ps, int depth);
 void make_samr_r_create_dom_group(SAMR_R_CREATE_DOM_GROUP *r_u, POLICY_HND *pol,
 		uint32 rid, uint32 status);
@@ -2451,6 +2463,7 @@ void cmd_reg_get_key_sec(struct client_info *info);
 
 void cmd_sam_ntchange_pwd(struct client_info *info);
 void cmd_sam_test(struct client_info *info);
+void cmd_sam_create_dom_group(struct client_info *info);
 void cmd_sam_enum_users(struct client_info *info);
 void cmd_sam_query_user(struct client_info *info);
 void cmd_sam_query_groups(struct client_info *info);
diff --git a/source3/include/rpc_samr.h b/source3/include/rpc_samr.h
index 6ca715bdf6..bbb249f352 100644
--- a/source3/include/rpc_samr.h
+++ b/source3/include/rpc_samr.h
@@ -751,7 +751,8 @@ typedef struct samr_group_info4
 /* GROUP_INFO_CTR */
 typedef struct group_info_ctr
 {
-	uint16 switch_value;
+	uint16 switch_value1;
+	uint16 switch_value2;
 
 	union
  	{
diff --git a/source3/rpc_client/cli_samr.c b/source3/rpc_client/cli_samr.c
index eb1acb2524..6e0e6ab71b 100644
--- a/source3/rpc_client/cli_samr.c
+++ b/source3/rpc_client/cli_samr.c
@@ -36,6 +36,45 @@ extern int DEBUGLEVEL;
 /****************************************************************************
 do a SAMR query user groups
 ****************************************************************************/
+BOOL create_samr_domain_group(struct cli_state *cli, 
+				POLICY_HND *pol_open_domain,
+				const char *acct_name, const char *acct_desc,
+				uint32 *rid)
+{
+	POLICY_HND pol_open_group;
+	GROUP_INFO_CTR ctr;
+	if (pol_open_domain == NULL || acct_name == NULL || acct_desc == NULL) return False;
+
+	/* send create group*/
+	if (!samr_create_dom_group(cli,
+				pol_open_domain,
+				acct_name,
+				&pol_open_group, rid))
+	{
+		return False;
+	}
+
+	DEBUG(5,("create_samr_domain_group: name: %s rid 0x%x\n",
+	          acct_name, *rid));
+
+	ctr.switch_value1 = 4;
+	ctr.switch_value2 = 4;
+	make_samr_group_info4(&ctr.group.info4, acct_desc);
+
+	/* send user groups query */
+	if (!samr_set_groupinfo(cli,
+				&pol_open_group,
+				&ctr))
+	{
+		DEBUG(5,("create_samr_domain_group: error in samr_set_groupinfo\n"));
+	}
+
+	return samr_close(cli, &pol_open_group);
+}
+
+/****************************************************************************
+do a SAMR query user groups
+****************************************************************************/
 BOOL get_samr_query_usergroups(struct cli_state *cli, 
 				POLICY_HND *pol_open_domain, uint32 user_rid,
 				uint32 *num_groups, DOM_GID *gid)
@@ -44,7 +83,7 @@ BOOL get_samr_query_usergroups(struct cli_state *cli,
 	if (pol_open_domain == NULL || num_groups == NULL || gid == NULL) return False;
 
 	/* send open domain (on user sid) */
-	if (!do_samr_open_user(cli,
+	if (!samr_open_user(cli,
 				pol_open_domain,
 				0x02011b, user_rid,
 				&pol_open_user))
@@ -53,14 +92,14 @@ BOOL get_samr_query_usergroups(struct cli_state *cli,
 	}
 
 	/* send user groups query */
-	if (!do_samr_query_usergroups(cli,
+	if (!samr_query_usergroups(cli,
 				&pol_open_user,
 				num_groups, gid))
 	{
-		DEBUG(5,("do_samr_query_usergroups: error in query user groups\n"));
+		DEBUG(5,("samr_query_usergroups: error in query user groups\n"));
 	}
 
-	return do_samr_close(cli, &pol_open_user);
+	return samr_close(cli, &pol_open_user);
 }
 
 /****************************************************************************
@@ -77,7 +116,7 @@ BOOL get_samr_query_userinfo(struct cli_state *cli,
 	bzero(usr, sizeof(*usr));
 
 	/* send open domain (on user sid) */
-	if (!do_samr_open_user(cli,
+	if (!samr_open_user(cli,
 				pol_open_domain,
 				0x02011b, user_rid,
 				&pol_open_user))
@@ -86,21 +125,21 @@ BOOL get_samr_query_userinfo(struct cli_state *cli,
 	}
 
 	/* send user info query */
-	if (!do_samr_query_userinfo(cli,
+	if (!samr_query_userinfo(cli,
 				&pol_open_user,
 				info_level, (void*)usr))
 	{
-		DEBUG(5,("do_samr_query_userinfo: error in query user info, level 0x%x\n",
+		DEBUG(5,("samr_query_userinfo: error in query user info, level 0x%x\n",
 		          info_level));
 	}
 
-	return do_samr_close(cli, &pol_open_user);
+	return samr_close(cli, &pol_open_user);
 }
 
 /****************************************************************************
 do a SAMR change user password command
 ****************************************************************************/
-BOOL do_samr_chgpasswd_user(struct cli_state *cli,
+BOOL samr_chgpasswd_user(struct cli_state *cli,
 		char *srv_name, char *user_name,
 		char nt_newpass[516], uchar nt_oldhash[16],
 		char lm_newpass[516], uchar lm_oldhash[16])
@@ -157,7 +196,7 @@ BOOL do_samr_chgpasswd_user(struct cli_state *cli,
 /****************************************************************************
 do a SAMR unknown 0x38 command
 ****************************************************************************/
-BOOL do_samr_unknown_38(struct cli_state *cli, char *srv_name)
+BOOL samr_unknown_38(struct cli_state *cli, char *srv_name)
 {
 	prs_struct data;
 	prs_struct rdata;
@@ -209,7 +248,7 @@ BOOL do_samr_unknown_38(struct cli_state *cli, char *srv_name)
 /****************************************************************************
 do a SAMR unknown 0x8 command
 ****************************************************************************/
-BOOL do_samr_query_dom_info(struct cli_state *cli, 
+BOOL samr_query_dom_info(struct cli_state *cli, 
 				POLICY_HND *domain_pol, uint16 switch_value)
 {
 	prs_struct data;
@@ -218,15 +257,15 @@ BOOL do_samr_query_dom_info(struct cli_state *cli,
 	SAMR_Q_QUERY_DOMAIN_INFO q_e;
 	BOOL valid_un8 = False;
 
+	DEBUG(4,("SAMR Unknown 8 switch:%d\n", switch_value));
+
+	if (domain_pol == NULL) return False;
+
 	/* create and send a MSRPC command with api SAMR_ENUM_DOM_USERS */
 
 	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
 	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
 
-	DEBUG(4,("SAMR Unknown 8 switch:%d\n", switch_value));
-
-	if (domain_pol == NULL) return False;
-
 	/* store the parameters */
 	make_samr_q_query_dom_info(&q_e, domain_pol, switch_value);
 
@@ -266,7 +305,7 @@ BOOL do_samr_query_dom_info(struct cli_state *cli,
 /****************************************************************************
 do a SAMR enumerate users
 ****************************************************************************/
-BOOL do_samr_enum_dom_users(struct cli_state *cli, 
+BOOL samr_enum_dom_users(struct cli_state *cli, 
 				POLICY_HND *pol, uint16 num_entries, uint16 unk_0,
 				uint16 acb_mask, uint16 unk_1, uint32 size,
 				struct acct_info **sam,
@@ -276,17 +315,17 @@ BOOL do_samr_enum_dom_users(struct cli_state *cli,
 	prs_struct rdata;
 
 	SAMR_Q_ENUM_DOM_USERS q_e;
-    BOOL valid_pol = False;
+	BOOL valid_pol = False;
+
+	DEBUG(4,("SAMR Enum SAM DB max size:%x\n", size));
+
+	if (pol == NULL || num_sam_users == NULL) return False;
 
 	/* create and send a MSRPC command with api SAMR_ENUM_DOM_USERS */
 
 	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
 	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
 
-	DEBUG(4,("SAMR Enum SAM DB max size:%x\n", size));
-
-	if (pol == NULL || num_sam_users == NULL) return False;
-
 	/* store the parameters */
 	make_samr_q_enum_dom_users(&q_e, pol,
 	                           num_entries, unk_0,
@@ -320,7 +359,7 @@ BOOL do_samr_enum_dom_users(struct cli_state *cli,
 			if (*num_sam_users > MAX_SAM_ENTRIES)
 			{
 				*num_sam_users = MAX_SAM_ENTRIES;
-				DEBUG(2,("do_samr_enum_dom_users: sam user entries limited to %d\n",
+				DEBUG(2,("samr_enum_dom_users: sam user entries limited to %d\n",
 				          *num_sam_users));
 			}
 
@@ -346,7 +385,7 @@ BOOL do_samr_enum_dom_users(struct cli_state *cli,
 				{
 					bzero((*sam)[i].acct_name, sizeof((*sam)[i].acct_name));
 				}
-				DEBUG(5,("do_samr_enum_dom_users: idx: %4d rid: %8x acct: %s\n",
+				DEBUG(5,("samr_enum_dom_users: idx: %4d rid: %8x acct: %s\n",
 				          i, (*sam)[i].user_rid, (*sam)[i].acct_name));
 			}
 			valid_pol = True;
@@ -362,7 +401,7 @@ BOOL do_samr_enum_dom_users(struct cli_state *cli,
 /****************************************************************************
 do a SAMR Connect
 ****************************************************************************/
-BOOL do_samr_connect(struct cli_state *cli, 
+BOOL samr_connect(struct cli_state *cli, 
 				char *srv_name, uint32 unknown_0,
 				POLICY_HND *connect_pol)
 {
@@ -370,18 +409,18 @@ BOOL do_samr_connect(struct cli_state *cli,
 	prs_struct rdata;
 
 	SAMR_Q_CONNECT q_o;
-    BOOL valid_pol = False;
-
-	/* create and send a MSRPC command with api SAMR_CONNECT */
-
-	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
-	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+	BOOL valid_pol = False;
 
 	DEBUG(4,("SAMR Open Policy server:%s undoc value:%x\n",
 				srv_name, unknown_0));
 
 	if (srv_name == NULL || connect_pol == NULL) return False;
 
+	/* create and send a MSRPC command with api SAMR_CONNECT */
+
+	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
+	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+
 	/* store the parameters */
 	make_samr_q_connect(&q_o, srv_name, unknown_0);
 
@@ -420,7 +459,7 @@ BOOL do_samr_connect(struct cli_state *cli,
 /****************************************************************************
 do a SAMR Open User
 ****************************************************************************/
-BOOL do_samr_open_user(struct cli_state *cli, 
+BOOL samr_open_user(struct cli_state *cli, 
 				POLICY_HND *pol, uint32 unk_0, uint32 rid, 
 				POLICY_HND *user_pol)
 {
@@ -428,18 +467,18 @@ BOOL do_samr_open_user(struct cli_state *cli,
 	prs_struct rdata;
 
 	SAMR_Q_OPEN_USER q_o;
-    BOOL valid_pol = False;
-
-	/* create and send a MSRPC command with api SAMR_OPEN_USER */
-
-	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
-	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+	BOOL valid_pol = False;
 
 	DEBUG(4,("SAMR Open User.  unk_0: %08x RID:%x\n",
 	          unk_0, rid));
 
 	if (pol == NULL || user_pol == NULL) return False;
 
+	/* create and send a MSRPC command with api SAMR_OPEN_USER */
+
+	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
+	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+
 	/* store the parameters */
 	make_samr_q_open_user(&q_o, pol, unk_0, rid);
 
@@ -476,9 +515,179 @@ BOOL do_samr_open_user(struct cli_state *cli,
 }
 
 /****************************************************************************
+do a SAMR Open Group
+****************************************************************************/
+BOOL samr_open_group(struct cli_state *cli, 
+				POLICY_HND *domain_pol, uint32 rid,
+				POLICY_HND *group_pol)
+{
+	prs_struct data;
+	prs_struct rdata;
+
+	SAMR_Q_OPEN_GROUP q_o;
+	BOOL valid_pol = False;
+
+	DEBUG(4,("SAMR Open Group. RID:%x\n", rid));
+
+	if (group_pol == NULL || domain_pol == NULL) return False;
+
+	/* create and send a MSRPC command with api SAMR_OPEN_GROUP */
+
+	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
+	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+
+	/* store the parameters */
+	make_samr_q_open_group(&q_o, domain_pol, 0x0001, rid);
+
+	/* turn parameters into data stream */
+	samr_io_q_open_group("", &q_o,  &data, 0);
+
+	/* send the data on \PIPE\ */
+	if (rpc_api_pipe_req(cli, SAMR_OPEN_GROUP, &data, &rdata))
+	{
+		SAMR_R_OPEN_GROUP r_o;
+		BOOL p;
+
+		samr_io_r_open_group("", &r_o, &rdata, 0);
+		p = rdata.offset != 0;
+
+		if (p && r_o.status != 0)
+		{
+			/* report error code */
+			DEBUG(0,("SAMR_R_OPEN_GROUP: %s\n", get_nt_error_msg(r_o.status)));
+			p = False;
+		}
+
+		if (p)
+		{
+			memcpy(group_pol, &r_o.pol, sizeof(r_o.pol));
+			valid_pol = True;
+		}
+	}
+
+	prs_mem_free(&data   );
+	prs_mem_free(&rdata  );
+
+	return valid_pol;
+}
+
+/****************************************************************************
+do a SAMR Create Domain Group
+****************************************************************************/
+BOOL samr_create_dom_group(struct cli_state *cli, 
+				POLICY_HND *domain_pol, const char *acct_name,
+				POLICY_HND *group_pol, uint32 *rid)
+{
+	prs_struct data;
+	prs_struct rdata;
+
+	SAMR_Q_CREATE_DOM_GROUP q_o;
+	BOOL valid_pol = False;
+
+	if (group_pol == NULL || domain_pol == NULL || acct_name == NULL || rid == NULL) return False;
+
+	/* create and send a MSRPC command with api SAMR_CREATE_DOM_GROUP */
+
+	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
+	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+
+	DEBUG(4,("SAMR Create Domain Group. Name:%s\n", acct_name));
+
+	/* store the parameters */
+	make_samr_q_create_dom_group(&q_o, domain_pol, acct_name);
+
+	/* turn parameters into data stream */
+	samr_io_q_create_dom_group("", &q_o,  &data, 0);
+
+	/* send the data on \PIPE\ */
+	if (rpc_api_pipe_req(cli, SAMR_CREATE_DOM_GROUP, &data, &rdata))
+	{
+		SAMR_R_CREATE_DOM_GROUP r_o;
+		BOOL p;
+
+		samr_io_r_create_dom_group("", &r_o, &rdata, 0);
+		p = rdata.offset != 0;
+
+		if (p && r_o.status != 0)
+		{
+			/* report error code */
+			DEBUG(0,("SAMR_R_CREATE_DOM_GROUP: %s\n", get_nt_error_msg(r_o.status)));
+			p = False;
+		}
+
+		if (p)
+		{
+			memcpy(group_pol, &r_o.pol, sizeof(r_o.pol));
+			*rid = r_o.rid;
+			valid_pol = True;
+		}
+	}
+
+	prs_mem_free(&data   );
+	prs_mem_free(&rdata  );
+
+	return valid_pol;
+}
+
+/****************************************************************************
+do a SAMR Set Group Info
+****************************************************************************/
+BOOL samr_set_groupinfo(struct cli_state *cli, 
+				POLICY_HND *group_pol, GROUP_INFO_CTR *ctr)
+{
+	prs_struct data;
+	prs_struct rdata;
+
+	SAMR_Q_SET_GROUPINFO q_o;
+	BOOL valid_pol = False;
+
+	if (group_pol == NULL || ctr == NULL) return False;
+
+	/* create and send a MSRPC command with api SAMR_SET_GROUPINFO */
+
+	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
+	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+
+	DEBUG(4,("SAMR Set Group Info\n"));
+
+	/* store the parameters */
+	make_samr_q_set_groupinfo(&q_o, group_pol, ctr);
+
+	/* turn parameters into data stream */
+	samr_io_q_set_groupinfo("", &q_o,  &data, 0);
+
+	/* send the data on \PIPE\ */
+	if (rpc_api_pipe_req(cli, SAMR_SET_GROUPINFO, &data, &rdata))
+	{
+		SAMR_R_SET_GROUPINFO r_o;
+		BOOL p;
+
+		samr_io_r_set_groupinfo("", &r_o, &rdata, 0);
+		p = rdata.offset != 0;
+
+		if (p && r_o.status != 0)
+		{
+			/* report error code */
+			DEBUG(0,("SAMR_R_SET_GROUPINFO: %s\n", get_nt_error_msg(r_o.status)));
+			p = False;
+		}
+
+		if (p)
+		{
+			valid_pol = True;
+		}
+	}
+
+	prs_mem_free(&data   );
+	prs_mem_free(&rdata  );
+
+	return valid_pol;
+}
+
+/****************************************************************************
 do a SAMR Open Domain
 ****************************************************************************/
-BOOL do_samr_open_domain(struct cli_state *cli, 
+BOOL samr_open_domain(struct cli_state *cli, 
 				POLICY_HND *connect_pol, uint32 rid, DOM_SID *sid,
 				POLICY_HND *domain_pol)
 {
@@ -489,16 +698,16 @@ BOOL do_samr_open_domain(struct cli_state *cli,
 	SAMR_Q_OPEN_DOMAIN q_o;
 	BOOL valid_pol = False;
 
-	/* create and send a MSRPC command with api SAMR_OPEN_DOMAIN */
-
-	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
-	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
-
 	sid_to_string(sid_str, sid);
 	DEBUG(4,("SAMR Open Domain.  SID:%s RID:%x\n", sid_str, rid));
 
 	if (connect_pol == NULL || sid == NULL || domain_pol == NULL) return False;
 
+	/* create and send a MSRPC command with api SAMR_OPEN_DOMAIN */
+
+	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
+	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+
 	/* store the parameters */
 	make_samr_q_open_domain(&q_o, connect_pol, rid, sid);
 
@@ -537,7 +746,7 @@ BOOL do_samr_open_domain(struct cli_state *cli,
 /****************************************************************************
 do a SAMR Query Unknown 12
 ****************************************************************************/
-BOOL do_samr_query_unknown_12(struct cli_state *cli, 
+BOOL samr_query_unknown_12(struct cli_state *cli, 
 				POLICY_HND *pol, uint32 rid, uint32 num_gids, uint32 *gids,
 				uint32 *num_names,
 				fstring names[MAX_LOOKUP_SIDS],
@@ -549,6 +758,9 @@ BOOL do_samr_query_unknown_12(struct cli_state *cli,
 	SAMR_Q_UNKNOWN_12 q_o;
 	BOOL valid_query = False;
 
+	if (pol == NULL || rid == 0 || num_gids == 0 || gids == NULL ||
+	    num_names == NULL || names == NULL || type == NULL ) return False;
+
 	/* create and send a MSRPC command with api SAMR_UNKNOWN_12 */
 
 	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
@@ -556,9 +768,6 @@ BOOL do_samr_query_unknown_12(struct cli_state *cli,
 
 	DEBUG(4,("SAMR Query Unknown 12.\n"));
 
-	if (pol == NULL || rid == 0 || num_gids == 0 || gids == NULL ||
-	    num_names == NULL || names == NULL || type == NULL ) return False;
-
 	/* store the parameters */
 	make_samr_q_unknown_12(&q_o, pol, rid, num_gids, gids);
 
@@ -621,7 +830,7 @@ BOOL do_samr_query_unknown_12(struct cli_state *cli,
 /****************************************************************************
 do a SAMR Query User Aliases
 ****************************************************************************/
-BOOL do_samr_query_useraliases(struct cli_state *cli, 
+BOOL samr_query_useraliases(struct cli_state *cli, 
 				POLICY_HND *pol, DOM_SID *sid,
 				uint32 *num_aliases, uint32 *rid)
 {
@@ -631,15 +840,15 @@ BOOL do_samr_query_useraliases(struct cli_state *cli,
 	SAMR_Q_QUERY_USERALIASES q_o;
 	BOOL valid_query = False;
 
+	DEBUG(4,("SAMR Query User Aliases.\n"));
+
+	if (pol == NULL || sid == NULL || rid == NULL || num_aliases == 0) return False;
+
 	/* create and send a MSRPC command with api SAMR_QUERY_USERALIASES */
 
 	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
 	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
 
-	DEBUG(4,("SAMR Query User Aliases.\n"));
-
-	if (pol == NULL || sid == NULL || rid == NULL || num_aliases == 0) return False;
-
 	/* store the parameters */
 	make_samr_q_query_useraliases(&q_o, pol, sid);
 
@@ -682,7 +891,7 @@ BOOL do_samr_query_useraliases(struct cli_state *cli,
 /****************************************************************************
 do a SAMR Query User Groups
 ****************************************************************************/
-BOOL do_samr_query_usergroups(struct cli_state *cli, 
+BOOL samr_query_usergroups(struct cli_state *cli, 
 				POLICY_HND *pol, uint32 *num_groups, DOM_GID *gid)
 {
 	prs_struct data;
@@ -691,15 +900,15 @@ BOOL do_samr_query_usergroups(struct cli_state *cli,
 	SAMR_Q_QUERY_USERGROUPS q_o;
 	BOOL valid_query = False;
 
+	DEBUG(4,("SAMR Query User Groups.\n"));
+
+	if (pol == NULL || gid == NULL || num_groups == 0) return False;
+
 	/* create and send a MSRPC command with api SAMR_QUERY_USERGROUPS */
 
 	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
 	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
 
-	DEBUG(4,("SAMR Query User Groups.\n"));
-
-	if (pol == NULL || gid == NULL || num_groups == 0) return False;
-
 	/* store the parameters */
 	make_samr_q_query_usergroups(&q_o, pol);
 
@@ -742,24 +951,24 @@ BOOL do_samr_query_usergroups(struct cli_state *cli,
 /****************************************************************************
 do a SAMR Query User Info
 ****************************************************************************/
-BOOL do_samr_query_userinfo(struct cli_state *cli, 
+BOOL samr_query_userinfo(struct cli_state *cli, 
 				POLICY_HND *pol, uint16 switch_value, void* usr)
 {
 	prs_struct data;
 	prs_struct rdata;
 
 	SAMR_Q_QUERY_USERINFO q_o;
-    BOOL valid_query = False;
+	BOOL valid_query = False;
+
+	DEBUG(4,("SAMR Query User Info.  level: %d\n", switch_value));
+
+	if (pol == NULL || usr == NULL || switch_value == 0) return False;
 
 	/* create and send a MSRPC command with api SAMR_QUERY_USERINFO */
 
 	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
 	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
 
-	DEBUG(4,("SAMR Query User Info.  level: %d\n", switch_value));
-
-	if (pol == NULL || usr == NULL || switch_value == 0) return False;
-
 	/* store the parameters */
 	make_samr_q_query_userinfo(&q_o, pol, switch_value);
 
@@ -806,22 +1015,22 @@ BOOL do_samr_query_userinfo(struct cli_state *cli,
 /****************************************************************************
 do a SAMR Close
 ****************************************************************************/
-BOOL do_samr_close(struct cli_state *cli, POLICY_HND *hnd)
+BOOL samr_close(struct cli_state *cli, POLICY_HND *hnd)
 {
 	prs_struct data;
 	prs_struct rdata;
 
 	SAMR_Q_CLOSE_HND q_c;
-    BOOL valid_close = False;
+	BOOL valid_close = False;
 
-	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
-	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
+	DEBUG(4,("SAMR Close\n"));
 
 	if (hnd == NULL) return False;
 
-	/* create and send a MSRPC command with api SAMR_CLOSE_HND */
+	prs_init(&data , 1024, 4, SAFETY_MARGIN, False);
+	prs_init(&rdata, 0   , 4, SAFETY_MARGIN, True );
 
-	DEBUG(4,("SAMR Close\n"));
+	/* create and send a MSRPC command with api SAMR_CLOSE_HND */
 
 	/* store the parameters */
 	make_samr_q_close_hnd(&q_c, hnd);
diff --git a/source3/rpc_parse/parse_samr.c b/source3/rpc_parse/parse_samr.c
index 90e60a36cd..4a84d8c175 100644
--- a/source3/rpc_parse/parse_samr.c
+++ b/source3/rpc_parse/parse_samr.c
@@ -1336,7 +1336,7 @@ void samr_io_group_info1(char *desc,  GROUP_INFO1 *gr1, prs_struct *ps, int dept
 /*******************************************************************
 makes a GROUP_INFO4 structure.
 ********************************************************************/
-void make_samr_group_info4(GROUP_INFO4 *gr4, char *acct_desc)
+void make_samr_group_info4(GROUP_INFO4 *gr4, const char *acct_desc)
 {
 	int acct_len = acct_desc != NULL ? strlen(acct_desc) : 0;
 	if (gr4 == NULL) return;
@@ -1374,10 +1374,10 @@ void samr_group_info_ctr(char *desc,  GROUP_INFO_CTR *ctr, prs_struct *ps, int d
 	prs_debug(ps, depth, desc, "samr_group_info_ctr");
 	depth++;
 
-	prs_uint16("switch_value", ps, depth, &(ctr->switch_value));
-	prs_align(ps);
+	prs_uint16("switch_value1", ps, depth, &(ctr->switch_value1));
+	prs_uint16("switch_value2", ps, depth, &(ctr->switch_value2));
 
-	switch (ctr->switch_value)
+	switch (ctr->switch_value1)
 	{
 		case 1:
 		{
@@ -1405,7 +1405,7 @@ makes a SAMR_Q_CREATE_DOM_GROUP structure.
 ********************************************************************/
 void make_samr_q_create_dom_group(SAMR_Q_CREATE_DOM_GROUP *q_e,
 				POLICY_HND *pol,
-				char *acct_desc)
+				const char *acct_desc)
 {
 	int acct_len = acct_desc != NULL ? strlen(acct_desc) : 0;
 	if (q_e == NULL || pol == NULL) return;
diff --git a/source3/rpc_server/srv_samr.c b/source3/rpc_server/srv_samr.c
index 7bc12afe74..455b26318e 100644
--- a/source3/rpc_server/srv_samr.c
+++ b/source3/rpc_server/srv_samr.c
@@ -794,13 +794,13 @@ static void samr_reply_query_groupinfo(SAMR_Q_QUERY_GROUPINFO *q_u,
 		if (q_u->switch_level == 1)
 		{
 			r_e.ptr = 1;
-			ctr.switch_value = 1;
+			ctr.switch_value1 = 1;
 			make_samr_group_info1(&ctr.group.info1, "account name", "account description");
 		}
 		else if (q_u->switch_level == 4)
 		{
 			r_e.ptr = 1;
-			ctr.switch_value = 4;
+			ctr.switch_value1 = 4;
 			make_samr_group_info4(&ctr.group.info4, "account description");
 		}
 		else
diff --git a/source3/rpcclient/cmd_samr.c b/source3/rpcclient/cmd_samr.c
index 4d77f67b54..6c6c9465d0 100644
--- a/source3/rpcclient/cmd_samr.c
+++ b/source3/rpcclient/cmd_samr.c
@@ -94,10 +94,10 @@ void cmd_sam_ntchange_pwd(struct client_info *info)
 	res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR) : False;
 
 	/* establish a connection. */
-	res = res ? do_samr_unknown_38(smb_cli, srv_name) : False;
+	res = res ? samr_unknown_38(smb_cli, srv_name) : False;
 
 	/* establish a connection. */
-	res = res ? do_samr_chgpasswd_user(smb_cli,
+	res = res ? samr_chgpasswd_user(smb_cli,
 	                                   srv_name, smb_cli->user_name,
 	                                   nt_newpass, nt_hshhash,
 	                                   lm_newpass, lm_hshhash) : False;
@@ -156,7 +156,7 @@ void cmd_sam_test(struct client_info *info)
 	res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR) : False;
 
 	/* establish a connection. */
-	res = res ? do_samr_unknown_38(smb_cli, srv_name) : False;
+	res = res ? samr_unknown_38(smb_cli, srv_name) : False;
 
 	/* close the session */
 	cli_nt_session_close(smb_cli);
@@ -171,6 +171,91 @@ void cmd_sam_test(struct client_info *info)
 	}
 }
 
+/****************************************************************************
+SAM create domain group.
+****************************************************************************/
+void cmd_sam_create_dom_group(struct client_info *info)
+{
+	fstring srv_name;
+	fstring domain;
+	fstring acct_name;
+	fstring acct_desc;
+	fstring sid;
+	DOM_SID sid1;
+	BOOL res = True;
+	BOOL res1 = True;
+	uint32 admin_rid = 0x220; /* absolutely no idea. */
+	uint32 group_rid; 
+
+	sid_copy(&sid1, &info->dom.level5_sid);
+	sid_to_string(sid, &sid1);
+	fstrcpy(domain, info->dom.level5_dom);
+
+	if (sid1.num_auths == 0)
+	{
+		fprintf(out_hnd, "please use 'lsaquery' first, to ascertain the SID\n");
+		return;
+	}
+
+
+	fstrcpy(srv_name, "\\\\");
+	fstrcat(srv_name, info->dest_host);
+	strupper(srv_name);
+
+	if (!next_token(NULL, acct_name, NULL, sizeof(acct_name)))
+	{
+		fprintf(out_hnd, "creategroup: <acct name> [acct description]\n");
+	}
+
+	if (!next_token(NULL, acct_desc, NULL, sizeof(acct_desc)))
+	{
+		acct_desc[0] = 0;
+	}
+
+
+	fprintf(out_hnd, "SAM Create Domain Group\n");
+	fprintf(out_hnd, "Domain: %s Name: %s Description: %s\n",
+	                  domain, acct_name, acct_desc);
+
+	/* open SAMR session.  negotiate credentials */
+	res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR) : False;
+
+	/* establish a connection. */
+	res = res ? samr_connect(smb_cli, 
+				srv_name, 0x00000020,
+				&info->dom.samr_pol_connect) : False;
+
+	/* connect to the domain */
+	res = res ? samr_open_domain(smb_cli, 
+	            &info->dom.samr_pol_connect, admin_rid, &sid1,
+	            &info->dom.samr_pol_open_domain) : False;
+
+	/* read some users */
+	res1 = res ? create_samr_domain_group(smb_cli, 
+				&info->dom.samr_pol_open_domain,
+	                        acct_name, acct_desc, &group_rid) : False;
+
+	res = res ? samr_close(smb_cli,
+	            &info->dom.samr_pol_open_domain) : False;
+
+	res = res ? samr_close(smb_cli,
+	            &info->dom.samr_pol_connect) : False;
+
+	/* close the session */
+	cli_nt_session_close(smb_cli);
+
+	if (res && res1)
+	{
+		DEBUG(5,("cmd_sam_create_dom_group: succeeded\n"));
+		fprintf(out_hnd, "Create Domain Group: OK\n");
+	}
+	else
+	{
+		DEBUG(5,("cmd_sam_create_dom_group: failed\n"));
+		fprintf(out_hnd, "Create Domain Group: FAILED\n");
+	}
+}
+
 
 /****************************************************************************
 experimental SAM users enum.
@@ -263,22 +348,22 @@ void cmd_sam_enum_users(struct client_info *info)
 	res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR) : False;
 
 	/* establish a connection. */
-	res = res ? do_samr_connect(smb_cli, 
+	res = res ? samr_connect(smb_cli, 
 				srv_name, 0x00000020,
 				&info->dom.samr_pol_connect) : False;
 
 	/* connect to the domain */
-	res = res ? do_samr_open_domain(smb_cli, 
+	res = res ? samr_open_domain(smb_cli, 
 	            &info->dom.samr_pol_connect, admin_rid, &sid1,
 	            &info->dom.samr_pol_open_domain) : False;
 
 	/* connect to the S-1-5-20 domain */
-	res1 = res ? do_samr_open_domain(smb_cli, 
+	res1 = res ? samr_open_domain(smb_cli, 
 	            &info->dom.samr_pol_connect, admin_rid, &sid_1_5_20,
 	            &info->dom.samr_pol_open_builtindom) : False;
 
 	/* read some users */
-	res = res ? do_samr_enum_dom_users(smb_cli, 
+	res = res ? samr_enum_dom_users(smb_cli, 
 				&info->dom.samr_pol_open_domain,
 	            num_entries, unk_0, acb_mask, unk_1, 0xffff,
 				&info->dom.sam, &info->dom.num_sam_entries) : False;
@@ -337,7 +422,7 @@ void cmd_sam_enum_users(struct client_info *info)
 				sid_append_rid(&als_sid, user_rid);
 
 				/* send user alias query */
-				if (do_samr_query_useraliases(smb_cli,
+				if (samr_query_useraliases(smb_cli,
 				                        &info->dom.samr_pol_open_domain,
 				                        &als_sid, &num_aliases, rid))
 				{
@@ -347,7 +432,7 @@ void cmd_sam_enum_users(struct client_info *info)
 			}
 
 			/* send user alias query */
-			if (res1 && do_samr_query_useraliases(smb_cli,
+			if (res1 && samr_query_useraliases(smb_cli,
 						&info->dom.samr_pol_open_builtindom,
 						&als_sid, &num_aliases, rid))
 			{
@@ -358,13 +443,13 @@ void cmd_sam_enum_users(struct client_info *info)
 		}
 	}
 
-	res1 = res1 ? do_samr_close(smb_cli,
+	res1 = res1 ? samr_close(smb_cli,
 	            &info->dom.samr_pol_open_builtindom) : False;
 
-	res = res ? do_samr_close(smb_cli,
+	res = res ? samr_close(smb_cli,
 	            &info->dom.samr_pol_open_domain) : False;
 
-	res = res ? do_samr_close(smb_cli,
+	res = res ? samr_close(smb_cli,
 	            &info->dom.samr_pol_connect) : False;
 
 	/* close the session */
@@ -436,12 +521,12 @@ void cmd_sam_query_user(struct client_info *info)
 	res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR) : False;
 
 	/* establish a connection. */
-	res = res ? do_samr_connect(smb_cli,
+	res = res ? samr_connect(smb_cli,
 				srv_name, 0x00000020,
 				&info->dom.samr_pol_connect) : False;
 
 	/* connect to the domain */
-	res = res ? do_samr_open_domain(smb_cli,
+	res = res ? samr_open_domain(smb_cli,
 	            &info->dom.samr_pol_connect, admin_rid, &sid1,
 	            &info->dom.samr_pol_open_domain) : False;
 
@@ -462,10 +547,10 @@ void cmd_sam_query_user(struct client_info *info)
 		}
 	}
 
-	res = res ? do_samr_close(smb_cli,
+	res = res ? samr_close(smb_cli,
 	            &info->dom.samr_pol_connect) : False;
 
-	res = res ? do_samr_close(smb_cli,
+	res = res ? samr_close(smb_cli,
 	            &info->dom.samr_pol_open_domain) : False;
 
 	/* close the session */
@@ -524,23 +609,23 @@ void cmd_sam_query_groups(struct client_info *info)
 	res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR) : False;
 
 	/* establish a connection. */
-	res = res ? do_samr_connect(smb_cli, 
+	res = res ? samr_connect(smb_cli, 
 				srv_name, 0x00000020,
 				&info->dom.samr_pol_connect) : False;
 
 	/* connect to the domain */
-	res = res ? do_samr_open_domain(smb_cli, 
+	res = res ? samr_open_domain(smb_cli, 
 	            &info->dom.samr_pol_connect, admin_rid, &sid1,
 	            &info->dom.samr_pol_open_domain) : False;
 
 	/* send a samr 0x8 command */
-	res = res ? do_samr_query_dom_info(smb_cli,
+	res = res ? samr_query_dom_info(smb_cli,
 	            &info->dom.samr_pol_open_domain, switch_value) : False;
 
-	res = res ? do_samr_close(smb_cli,
+	res = res ? samr_close(smb_cli,
 	            &info->dom.samr_pol_connect) : False;
 
-	res = res ? do_samr_close(smb_cli, 
+	res = res ? samr_close(smb_cli, 
 	            &info->dom.samr_pol_open_domain) : False;
 
 	/* close the session */
@@ -615,17 +700,17 @@ void cmd_sam_enum_aliases(struct client_info *info)
 	res = res ? cli_nt_session_open(smb_cli, PIPE_SAMR) : False;
 
 	/* establish a connection. */
-	res = res ? do_samr_connect(smb_cli,
+	res = res ? samr_connect(smb_cli,
 				srv_name, 0x00000020,
 				&info->dom.samr_pol_connect) : False;
 
 	/* connect to the domain */
-	res = res ? do_samr_open_domain(smb_cli,
+	res = res ? samr_open_domain(smb_cli,
 	            &info->dom.samr_pol_connect, admin_rid, &sid1,
 	            &info->dom.samr_pol_open_domain) : False;
 
 	/* send a query on the aliases */
-	res = res ? do_samr_query_unknown_12(smb_cli,
+	res = res ? samr_query_unknown_12(smb_cli,
 	            &info->dom.samr_pol_open_domain, admin_rid, num_aliases, alias_rid,
 	            &num_aliases, alias_names, num_als_usrs) : False;
 
@@ -639,7 +724,7 @@ void cmd_sam_enum_aliases(struct client_info *info)
 #if 0
 
 	/* read some users */
-	res = res ? do_samr_enum_dom_users(smb_cli,
+	res = res ? samr_enum_dom_users(smb_cli,
 				&info->dom.samr_pol_open_domain,
 	            num_entries, unk_0, acb_mask, unk_1, 0xffff,
 				info->dom.sam, &info->dom.num_sam_entries) : False;
@@ -697,10 +782,10 @@ void cmd_sam_enum_aliases(struct client_info *info)
 	}
 #endif
 
-	res = res ? do_samr_close(smb_cli, 
+	res = res ? samr_close(smb_cli, 
 	            &info->dom.samr_pol_connect) : False;
 
-	res = res ? do_samr_close(smb_cli,
+	res = res ? samr_close(smb_cli,
 	            &info->dom.samr_pol_open_domain) : False;
 
 	/* close the session */
diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c
index 220c81d61e..6abc4071e5 100644
--- a/source3/rpcclient/rpcclient.c
+++ b/source3/rpcclient/rpcclient.c
@@ -124,6 +124,7 @@ struct
   {"lookupsids", cmd_lsa_lookup_sids,  "Resolve names from SIDs"},
   {"lookupnames",cmd_lsa_lookup_names,  "Resolve SIDs from names"},
   {"enumusers",  cmd_sam_enum_users,   "SAM User Database Query (experimental!)"},
+  {"creategroup",cmd_sam_create_dom_group,"SAM Create Domain Group"},
   {"ntpass",     cmd_sam_ntchange_pwd, "NT SAM Password Change"},
   {"samuser",    cmd_sam_query_user,   "<username> SAM User Query (experimental!)"},
   {"samtest",    cmd_sam_test      ,   "SAM User Encrypted RPC test (experimental!)"},