The samr interface is used to communicate with the SAM (Security Account Manager) subsystem.

Before Windows 2000, the samr interface is only available on the samr named pipe endpoint:

C:\> ifids -p ncacn_np -e \pipe\samr \\.

Interfaces: 4
[...]

  12345778-1234-abcd-ef00-0123456789ac v0.0

[...]

In Active Directory domains (and particularly, Active Directory domain controllers), the samr interface is also available (and used) over a TCP endpoint:

C:\> ifids -p ncacn_ip_tcp -e 1025 127.0.0.1

Interfaces: 12
[...]

  12345778-1234-abcd-ef00-0123456789ac v0.0

[...]

During Active Directory domain joins, the creation of computer accounts is implemented with samr operations called on the TCP endpoint of Active Directory domain controllers.

IDL (Interface Definition Language) for the samr interface is available in Samba 4 [55].

To connect to the SAM server, one of the following operations are used:

Then, available domains in the SAM server can be enumerated using the following operation:

The following operation is used to obtain the SID of a domain, given its name:

This operation typically returns the BUILTIN domain (S-1-5-32) and the machine domain (local domain for a non-domain controller machine, NT 4 or Active Directory domain for a domain controller machine).

The domain SID can then be used to open a given domain:

General information about the opened domain can be obtained or set with the following operations:

Once a domain is opened, it is possible to enumerate groups, aliases and users, using the following operations:

RID and names resolution inside an opened domain are implemented by the following operations:

Domain password policies can be obtained with the following operations:

To create a new group, alias or user in the opened domain, the following operations can be used:

To open an existing group, alias or user in the opened domain, the following operations exist:

To delete an existing group, alias or user in the opened domain, the following operations exist:

To obtain a list of members in groups or aliases, the following operations can be used:

To add or remove a member to a group or alias, the following operations are available:

For aliases, it is also possible to add or remove multiple members to or from an alias:

To obtain or set information about a given group or alias, the following operations exist:

Similar operations exist for accounts management:

A list of groups containing a given user can be obtained with the following operation:

Finally, handles returned by the following operations are supposed to be closed, using the SamrCloseHandle (0x01) operation: