Aside from a few miscellaneous commands, the rpclient commands fall into three groups: LSARPC, SAMR, and SPOOLSS. The function names mentioned in some of the commands are those documented in the Microsoft Platform SDK.
Sets the debugging level to
level. With no
argument, the current debugging level is printed.
Prints help on the commands.
Exits rpcclient. A synonym is
Lists the types of privileges known to this domain.
Lists the domains trusted by this domain.
Prints information on the privilege named
Finds a name that corresponds to a security identifier (SID).
Finds the SID for one or more names.
Queries the LSA object.
Lists SIDs for the local LSA.
Prints information on security objects for the LSA.
Adds a new user in the domain.
Removes a user from the domain.
Lists alias groups in the domain, along with their group RIDs. The
type argument can be either
builtin, to list Windows built-in groups such as
domain, to list
groups in the domain. See also the
Lists the groups in the domain, along with their group RIDs.