pdbedit

Name

pdbedit — manage the SAM database

Synopsis

pdbedit [-L] [-v] [-w] [-u username] [-f fullname] [-h homedir] [-D drive] [-S script] [-p profile] [-a] [-m] [-r] [-x] [-i passdb-backend] [-e passdb-backend] [-b passdb-backend] [-g] [-d debuglevel] [-s configfile] [-P account-policy] [-C value] [-c account-control]

DESCRIPTION

This tool is part of the Samba(7) suite.

The pdbedit program is used to manage the users accounts - stored in the sam database and can only be run by root.

The pdbedit tool uses the passdb modular interface and is - independent from the kind of users database used (currently there - are smbpasswd, ldap, nis+ and tdb based and more can be added - without changing the tool).

There are five main ways to use pdbedit: adding a user account, - removing a user account, modifing a user account, listing user - accounts, importing users accounts.

OPTIONS

-L

This option lists all the user accounts - present in the users database. - This option prints a list of user/uid pairs separated by - the ':' character.

Example: pdbedit -L

-sorce:500:Simo Sorce
-samba:45:Test User
-

-v

This option enables the verbose listing format. - It causes pdbedit to list the users in the database, printing - out the account fields in a descriptive format.

Example: pdbedit -L -v

----------------
-username:       sorce
-user ID/Group:  500/500
-user RID/GRID:  2000/2001
-Full Name:      Simo Sorce
-Home Directory: \\BERSERKER\sorce
-HomeDir Drive:  H:
-Logon Script:   \\BERSERKER\netlogon\sorce.bat
-Profile Path:   \\BERSERKER\profile
----------------
-username:       samba
-user ID/Group:  45/45
-user RID/GRID:  1090/1091
-Full Name:      Test User
-Home Directory: \\BERSERKER\samba
-HomeDir Drive:  
-Logon Script:   
-Profile Path:   \\BERSERKER\profile
-

-w

This option sets the "smbpasswd" listing format. - It will make pdbedit list the users in the database, printing - out the account fields in a format compatible with the - smbpasswd file format. (see the - smbpasswd(5) for details)

Example: pdbedit -L -w

-sorce:500:508818B733CE64BEAAD3B435B51404EE:D2A2418EFC466A8A0F6B1DBB5C3DB80C:[UX         ]:LCT-00000000:
-samba:45:0F2B255F7B67A7A9AAD3B435B51404EE:BC281CE3F53B6A5146629CD4751D3490:[UX         ]:LCT-3BFA1E8D:
-

-u username

This option specifies the username to be - used for the operation requested (listing, adding, removing). - It is required in add, remove and modify - operations and optional in list - operations.

-f fullname

This option can be used while adding or - modifing a user account. It will specify the user's full - name.

Example: -f "Simo Sorce"

-h homedir

This option can be used while adding or - modifing a user account. It will specify the user's home - directory network path.

Example: -h "\\\\BERSERKER\\sorce" -

-D drive

This option can be used while adding or - modifing a user account. It will specify the windows drive - letter to be used to map the home directory.

Example: -d "H:" -

-S script

This option can be used while adding or - modifing a user account. It will specify the user's logon - script path.

Example: -s "\\\\BERSERKER\\netlogon\\sorce.bat" -

-p profile

This option can be used while adding or - modifing a user account. It will specify the user's profile - directory.

Example: -p "\\\\BERSERKER\\netlogon" -

-G SID|rid

- This option can be used while adding or modifying a user account. It - will specify the users' new primary group SID (Security Identifier) or - rid.

Example: -G S-1-5-21-2447931902-1787058256-3961074038-1201

-U SID|rid

- This option can be used while adding or modifying a user account. It - will specify the users' new SID (Security Identifier) or - rid.

Example: -U S-1-5-21-2447931902-1787058256-3961074038-5004

-c account-control

This option can be used while adding or modifying a user - account. It will specify the users' account control property. Possible - flags that can be set are: N, D, H, L, X. -

Example: -c "[X ]"

-a

This option is used to add a user into the - database. This command needs a user name specified with - the -u switch. When adding a new user, pdbedit will also - ask for the password to be used.

Example: pdbedit -a -u sorce -

new password:
-retype new password
-

-r

This option is used to modify an existing user - in the database. This command needs a user name specified with the -u - switch. Other options can be specified to modify the properties of - the specified user. This flag is kept for backwards compatibility, but - it is no longer necessary to specify it. -

-m

This option may only be used in conjunction - with the -a option. It will make - pdbedit to add a machine trust account instead of a user - account (-u username will provide the machine name).

Example: pdbedit -a -m -u w2k-wks -

-x

This option causes pdbedit to delete an account - from the database. It needs a username specified with the - -u switch.

Example: pdbedit -x -u bob

-i passdb-backend

Use a different passdb backend to retrieve users - than the one specified in smb.conf. Can be used to import data into - your local user database.

This option will ease migration from one passdb backend to - another.

Example: pdbedit -i smbpasswd:/etc/smbpasswd.old -

-e passdb-backend

Exports all currently available users to the - specified password database backend.

This option will ease migration from one passdb backend to - another and will ease backing up.

Example: pdbedit -e smbpasswd:/root/samba-users.backup

-g

If you specify -g, - then -i in-backend -e out-backend - applies to the group mapping instead of the user database.

This option will ease migration from one passdb backend to - another and will ease backing up.

-b passdb-backend

Use a different default passdb backend.

Example: pdbedit -b xml:/root/pdb-backup.xml -l

-P account-policy

Display an account policy

Valid policies are: minimum password age, reset count minutes, disconnect time, - user must logon to change password, password history, lockout duration, min password length, - maximum password age and bad lockout attempt.

Example: pdbedit -P "bad lockout attempt"

-account policy value for bad lockout attempt is 0
-

-C account-policy-value

Sets an account policy to a specified value. - This option may only be used in conjunction - with the -P option. -

Example: pdbedit -P "bad lockout attempt" -C 3

-account policy value for bad lockout attempt was 0
-account policy value for bad lockout attempt is now 3
-

-h|--help

Print a summary of command line options. -

-V

Prints the program version number. -

-s <configuration file>

The file specified contains the -configuration details required by the server. The -information in this file includes server-specific -information such as what printcap file to use, as well -as descriptions of all the services that the server is -to provide. See smb.conf for more information. -The default configuration file name is determined at -compile time.

-d|--debug=debuglevel

debuglevel is an integer -from 0 to 10. The default value if this parameter is -not specified is zero.

The higher this value, the more detail will be -logged to the log files about the activities of the -server. At level 0, only critical errors and serious -warnings will be logged. Level 1 is a reasonable level for -day-to-day running - it generates a small amount of -information about operations carried out.

Levels above 1 will generate considerable -amounts of log data, and should only be used when -investigating a problem. Levels above 3 are designed for -use only by developers and generate HUGE amounts of log -data, most of which is extremely cryptic.

Note that specifying this parameter here will -override the log level parameter -in the smb.conf file.

-l|--logfile=logbasename

File name for log/debug files. The extension -".client" will be appended. The log file is -never removed by the client. -

NOTES

This command may be used only by root.

VERSION

This man page is correct for version 3.0 of - the Samba suite.

AUTHOR

The original Samba software and related utilities - were created by Andrew Tridgell. Samba is now developed - by the Samba Team as an Open Source project similar - to the way the Linux kernel is developed.