<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12">
<TITLE>Pwdump on 64 bit Itanium servers, Pwdump delivers computer accounts</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><SPAN LANG="de"><FONT SIZE=2 FACE="Arial">Hello;</FONT></SPAN>
</P>
<P><SPAN LANG="de"><FONT SIZE=2 FACE="Arial">a colleague tried to run Pwdump on a 64 bit Itanium W2K3 server and the lsass process crashed. Therefore the project was compiled for Itanium processor.</FONT> <FONT FACE="Times New Roman">Does someone have experience with Itanium? </FONT></SPAN></P>
<P><SPAN LANG="de"><FONT FACE="Times New Roman">I couldn't re-produce it, because I didn't have a Itanium test system.</FONT></SPAN>
<BR><SPAN LANG="de"><FONT FACE="Times New Roman">I thought about the general problem of a crashed lsass process. Does someone know, why the code must be injected into the lsass process instead of running it directly? This would be very interesting for me. I'm a C# programmer and usual avoid crushing processes by using try and catch. But the code that is injected looks like developed in C and not C++ (which I believe supports try and catch) as the rest of the code. Is there a way to migrate this part to C++? </FONT></SPAN></P>
<P><SPAN LANG="de"><FONT FACE="Times New Roman">Additionally I want to ask for a small feature request. The Pwdump tool delivers on Domain Controllers also all Computer Accounts, that are normally not in focus, because passwords are very strong set by Microsoft and should never be possible to crack. In big environments it would be much more faster. to avoid enumerate such accounts. To do this the 3rd parameter of the function "SamrEnumerateUsersInDomain" ("pSamrEnumerateUsersInDomain" in your code) must be set to 0x10. </FONT></SPAN></P>
<P><SPAN LANG="de"><FONT FACE="Times New Roman">More information's about this could be found under </FONT></SPAN><A HREF="http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/%5BMS-SAMR%5D.pdf"><SPAN LANG="de"><U><FONT COLOR="#0000FF" FACE="Times New Roman">http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/%5BMS-SAMR%5D.pdf</FONT></U></SPAN></A><SPAN LANG="de"><FONT FACE="Times New Roman"> (chapter 3.1.5.2.5 SamrEnumerateUsersInDomain and chapter 2.2.1.12 USER_ACCOUNT Codes). In my environment this works very well.</FONT></SPAN></P>
<BR>
<P><SPAN LANG="en-gb"><FONT SIZE=2 FACE="Arial">Regards,</FONT></SPAN>
<BR><SPAN LANG="en-gb"><B><FONT SIZE=2 FACE="Arial">Thomas</FONT></B></SPAN><SPAN LANG="de"> </SPAN>
</P>
</BODY>
</HTML>