Net User /domain is supposed to list all user accounts in the domain.
By default, any authenticated user should be able to run the command and list all domain user accounts.
In certain cases, the following may be seen:
1. Command returns Access Denied
C:\>net user /domain
The request will be processed at a domain controller for domain Litware.com.
System error 5 has occurred.
Access is denied.
2. Network capture shows "nca_s_fault_access_denied" error from the domain controller
Request:
No. Time Source SrcPort Destination DstPort Protocol Info
1189 25.835895 10.100.10.5 50848 10.100.10.4 445 SAMR Connect5 request
Frame 1189: 314 bytes on wire (2512 bits), 314 bytes captured (2512 bits) on interface 0
Ethernet II, Src: Microsof_f4:cb:85 (00:0d:3a:f4:cb:85), Dst: 12:34:56:78:9a:bc (12:34:56:78:9a:bc)
Internet Protocol Version 4, Src: 10.100.10.5, Dst: 10.100.10.4
Transmission Control Protocol, Src Port: 50848, Dst Port: 445, Seq: 4195, Ack: 1518, Len: 260
NetBIOS Session Service
SMB2 (Server Message Block Protocol version 2)
SMB2 Header
Ioctl Request (0x0b)
StructureSize: 0x0039
Reserved: 0000
Function: FSCTL_PIPE_TRANSCEIVE (0x0011c017)
GUID handle File: samr
Max Ioctl In Size: 0
Max Ioctl Out Size: 1024
Flags: 0x00000001
Reserved: 00000000
Blob Offset: 0x00000078
Blob Length: 136
In Data
Blob Offset: 0x00000078
Blob Length: 0
Out Data: NO DATA
Distributed Computing Environment / Remote Procedure Call (DCE/RPC) Request, Fragment: Single, FragLen: 136, Call: 2, Ctx: 1, [Resp: #1195]
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
Data Representation: 10000000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Frag Length: 136
Auth Length: 0
Call ID: 2
Alloc hint: 112
Context ID: 1
Opnum: 64
[Response in frame: 1195]
Complete stub data (112 bytes)
SAMR (pidl), Connect5
Operation: Connect5 (64)
[Response in frame: 1195]
Pointer to System Name (uint16): \\LitwareRootDC01.Litware.com
Access Mask: 0x00000030
Level In: 1
Pointer to Info In (samr_ConnectInfo)
Response:
No. Time Source SrcPort Destination DstPort Protocol Info
1195 25.836898 10.100.10.4 445 10.100.10.5 50848 DCERPC Fault: call_id: 2, Fragment: Single, Ctx: 1, status: nca_s_fault_access_denied
Frame 1195: 202 bytes on wire (1616 bits), 202 bytes captured (1616 bits) on interface 0
Ethernet II, Src: AristaNe_6b:0a:b7 (74:83:ef:6b:0a:b7), Dst: Microsof_f4:cb:85 (00:0d:3a:f4:cb:85)
Internet Protocol Version 4, Src: 10.100.10.4, Dst: 10.100.10.5
Transmission Control Protocol, Src Port: 445, Dst Port: 50848, Seq: 1518, Ack: 4455, Len: 148
NetBIOS Session Service
SMB2 (Server Message Block Protocol version 2)
SMB2 Header
Ioctl Response (0x0b)
StructureSize: 0x0031
Unknown: 0000
Function: FSCTL_PIPE_TRANSCEIVE (0x0011c017)
GUID handle File: samr
Reserved: 00000000
Reserved: 00000000
Blob Offset: 0x00000070
Blob Length: 0
In Data: NO DATA
Blob Offset: 0x00000070
Blob Length: 32
Out Data
Distributed Computing Environment / Remote Procedure Call (DCE/RPC) Fault, Fragment: Single, FragLen: 32, Call: 2, [Req: #1189]
Version: 5
Version (minor): 0
Packet type: Fault (3)
Packet Flags: 0x03
Data Representation: 10000000 (Order: Little-endian, Char: ASCII, Float: IEEE)
Frag Length: 32
Auth Length: 0
Call ID: 2
Alloc hint: 32
Context ID: 1
Cancel count: 0
Fault flags: 0x00
Status: nca_s_fault_access_denied (0x00000005)
[Expert Info (Note/Response): Fault: nca_s_fault_access_denied]
[Fault: nca_s_fault_access_denied]
[Severity level: Note]
[Group: Response]
Reserved: 00000000
[Opnum: 64]
[Request in frame: 1189]
[Time from request: 0.001003000 seconds]
Fault stub data (0 bytes)This may be accompanied by the following event in the SYSTEM log of the domain controller:
Log Name: System
Source: Microsoft-Windows-Directory-Services-SAM
Date: 10/24/2019 2:30:03 PM
Event ID: 16963
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: LitwareRootDC01.Litware.com
Description:
Remote calls to the SAM database are being restricted using the configured registry security descriptor: O:BAG:BAD:(A;;RC;;;BA).
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
CAUSE
The following policy setting is applying to the domain controller:
Computer Configuration \ Windows Settings \ Security Settings \ Local Policies \ Security Options - Network access: Restrict clients allowed to make remote calls to SAM
Note: The Group Policy setting is only available on computers that run Windows Server 2016 or Windows 10, version 1607 and later. This is the only option to configure this setting by using a user interface (UI).
This sets the following registry value:
HKLM \ System \ CurrentControlSet \ Control \ Lsa - RestrictRemoteSam
And the user running the command is not assigned permission to make remote calls to SAM
![]()
For more information see Network access: Restrict clients allowed to make remote calls to SAM - https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls
RESOLUTION:
Since a user can use SAMRPC to enumerate users, including privileged accounts such as local or domain administrators, or to enumerate groups and group memberships from Active Directory, and this information can provide important context and
serve as a starting point for an attacker to compromise a domain or networking environment, over the long term, enable this setting and using a security group, allowremote RPC connections to SAM and Active Directory for users and groups that you define.
![]()
Since this setting has the potential to affect applications and services, it is recommended to implement the following registryas well to test applications before enabling the policy in production:
HKLM \ SYSTEM \ CurrentControlSet \ Control \ Lsa - RestrictRemoteSamAuditOnlyMode (DWORD): 1
This allows all users to make SAMR calls but logs the following events in the SYSTEM event log of the domain controllers:
Log Name: System
Source: Microsoft-Windows-Directory-Services-SAM
Date: 10/25/2019 3:03:56 PM
Event ID: 16968
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: LitwareRootDC01.Litware.com
Description:
Audit only mode is currently enabled for remote calls to the SAM database.
The following client would have been normally denied access:
Client SID: S-1-5-21-1004346403-213167161-248345275-1607 from network address: 10.100.10.5.
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
You can use the
Events 16962 - 16969 Reader script to parse the event logs, as explained in the next section.